South Africa’s International Trade Administration Commission (Itac) has said the reason it waited for three months to make its stakeholders aware of a security breach on its on-premises servers was because the organisation’s initial lack of information, including the extent of the breach, would have likely led to “panic”.
Speaking to TechCentral in an interview on Friday, Itac chief commissioner Ayabonga Cawe said the trade commission chose to follow all legal and regulatory protocols while trying to get to the bottom of the matter before making any public disclosures.
According to a report in the Sunday Times at the weekend, XA Global Trade Advisors CEO Donald MacKay said its clients, importers and exporters whose personal information is held by Itac are alarmed at the security compromise and the amount of time that passed before Itac revealed what happened.
“We became aware of the breach in early January and we had to subsequently trigger a series of disclosures to law enforcement authorities and the Information Regulator,” said Cawe.
“Because we were operating on imperfect information about what had happened, we had to commission a forensic probe, which is now under way. That is what accounted for the lag between us finding out and informing many of our stakeholders.”
Itac is a government agency that administers trade instruments and provides technical advice on trade policy to the department of trade, industry & competition. Part of its work involves administering the granting of trade permits. Itac also undertakes investigations around trade defence instruments to protect the local economy from subsidised imports and practices, including dumping. Itac also conducts investigations regarding the tariff book that informs the import duties associated with various product categories.
Data collected
As such, Itac holds data relating to both companies and individuals in its databases, as well as data pertaining to its internal operations, including personnel records and salaries. According to Cawe, this is the data that was exposed in the breach.
“A person applying for a permit to import a vehicle into the country, for example, would fill out a form which includes their personal details and details about the make, model and price of the vehicle. In the course of our investigative work, we collect information relating to the management accounts of various businesses – which includes information about sales volumes and wage books,” said Cawe.
Read: CIPC hack: customers urged to change passwords
The rise in the number of security breaches involving government entities in South Africa is a cause for concern. Itac joins the CIPC and the Government Employee Pension Fund on a growing list of public sector organisations that have been hacked this year.
According to Cawe, Itac still does not know how its servers were compromised in the first place; nor does it know how long the intruders had access to its systems.
The public disclosure of the breach itself, Cawe said, pre-empts the conclusion of the forensic investigation, which is expected to give more information about what transpired. He did not say when the probe’s findings will be disclosed to the public. In the meantime, Itac customers have been advised to exercise security hygiene by changing their passwords and ensuring they do not use the same credentials to access any other online services.
“The assurance we want to give to those who have their information with us is that we have taken steps to fortify our environment and to make it much more secure,” said Cawe. – © 2024 NewsCentral Media
