Cybersecurity and governance framework of information systems in the South African mining industry

Abstract

South Africa’s political, social, and economic landscape has been dominated by mining, given that, for so many years, the sector has been the mainstay of the South African economy. The South African mining industry can be attributed to the high level of the industries’ technical and production expertise, as well as its comprehensive research and development activities. Mining in South Africa is of interest in that mining enterprises are particularly vulnerable to the theft of corporate information as opposed to operational information. ICT security has never been more important to mining enterprises than now. Mining enterprises face cybersecurity threats as mining is a contentious area and not everyone is pro-mining. Due to the occurrence of several high-impact cybersecurity incidents, it is apparent that the new cyberspace not only offers benefits but also generates cyber-risks to all industries. Consequently, enterprises must have comprehensive plans to deal with information systems security attacks. The purpose of this study was to assess cybersecurity in the South African mining industry. This study was quantitative and descriptive in nature and used a web-based questionnaire to collect data. This study concluded that the enterprises in the South African mining industry conform to IT governance practices, have an appreciation and support for information security access control processes, excellent network security infrastructure and reliable information security policies. However, management and executives in the South African mining industry is not easily convinced to fund security solutions. Furthermore, non-compliant or weak and unreliable control measures will essentially expose enterprises to negative IT security audit findings, cyber security risks and data breaches to classified information. The study established factors that influence information security in the South African mining industry positively and negatively. Recommendations are made to help mining enterprises to protect their ICT environments more securely, efficiently, and effectively.