A critical review of the implementation of the security threat assessment by a selection of government department in Gauteng

Abstract

The imperative for protecting critical national infrastructure has engendered development of the Security Threat Assessment Framework that is implemented by the South African government under the guidance of the State Security Agency (SSA). The objective of the STRA Security Threat Assessment Framework is to detect any weaknesses in existing security measures, and to recommend strategies to evaluate ameliorative improvements in those identified weaknesses. The aim of the study is to critically review the implementation of the security threat assessment by a selection of government Department in Gauteng. The study has adopted a qualitative research design approach due to its constructivist-interpretivist inspiration and reliance on participant-centred mode of acquiring the study’s pertinent primary data through document analysis, semi-structured in-depth interviews with the primary participants, and observations with secondary participants. The study population comprised of security managers, vetting managers, cybercrime managers, information security managers, physical security managers, and professionals in the security environment. Additionally, the target population and sample size consisted of 47 participants from various spheres of the security sector locally. These participants were selected through the purposive and simple random sampling strategies respectively. Some of the study’s critical findings show that there was general awareness and knowledgeability concerning the appointment processes and roles of security managers and security committees. The role of technology was viewed as beneficial. As such, the security of sensitive information necessitated that personnel working in high-risk environments as well as personnel in charge of information technology systems should be subjected to security procedures. These procedures include declaration of secrecy, security profile checks of each user, limiting access to top secret to individuals nearing retirement or exiting the system; as well as backup of the sensitive information in case it may be tampered with.