THE WAR AGAINST CYBERATTACKS

The recent much-publicised breach of the South African National Defence Force's (SANDF) networks by the 'Snatch' ransomware team, in which they stole multiple terabytes of files and published them online, has thrown into sharp relief the need for strong cyber security practices for African militaries, especially as they adopt more digitised processes and products such as drones and command & control systems.

THIS PIECE WILL FOCUS on the South African Air Force (SAAF) in particular and look deeper at the implications of the Snatch group's breach on how the SAAF can and should keep its systems secure.

In this era of increasingly digitised and connected systems, and as avionics, navigation systems, and operational platforms increasingly rely on software and networked communication, cybersecurity becomes not just a box to be checked and a nice to have, but a critical and strategic capability where vulnerabilities can have catastrophic consequences.

Put simply, having all of your operational, communications, planning, and intelligence systems digitised and networked together brings massive advantages in efficiency, performance, speed of action, and a host of other areas, but it opens up a huge new vulnerability.

Shut down those systems or, worse, exploit them to feed them with false information, and you can grind an air force's operations to a halt. Reverting to paper based systems is not an option, or at least not one that can be executed in a hurry or while maintaining the same level of effectiveness. While it's feasible to design these critical systems to operate in a degraded state (such as with jammed communications), it's not practical to have fall back plans that go all the way back to analogue.

Let's take a brief overview through the South African Air Force's digital infrastructure, describing all the main systems. Note that this will necessarily include a number of smaller systems, however, it's not intended as a comprehensive list.

First, it's important to understand how the SAAF's network infrastructure is designed, which will also explain why the Snatch ransomware attack appears to have only captured administrative and office documents rather than more deeply classified information or access to key systems.