The changing threat landscape
Over the past decade, confidence in traditional cyber and information security methods has been severely eroded. Notwithstanding sharply rising global spend on cyber-security, governments and business continue to experience breaches of expanding impact. Concurrently, acts of influence through cyber means (including, but not limited to, ‘fake news’) are increasing exponentially. The threat landscape is furthermore characterised by the morphing of high-end threats – i.e. the blurring distinction between what was conventionally labelled as state-sponsored Advanced Persistent Threats (APTs) and the actions of other actors (such as criminal groupings, corporate entities, hacktivists). The tradecraft, activities and even aims of various classes of threat actors in cyber space are often difficult to separate and reflect state-grade skills in intelligence and counterintelligence. For both state and non-state actors correspondingly, multi-vectored intelligence operations (which combine human, cyber and other technical vectors) are now a precursor to extensive breaches.Cyber Counterintelligence’s role
The proactive engagement and countering of the above-noted threats is the signature role of Counterintelligence (CI) and its subset Cyber Counterintelligence (CCI). While CCI is not a wonder cure for all cyber ills, it offers a conceptual and practicable approach for state and non-state actors to assert and advance their interests in the cyber arena. It combines clever, proactive defences with the engagement and exploitation of adversaries.CI has been practiced for millennia and CCI has existed de facto in the state security apparatus of several countries for decades. However, it was only during the late 1990s that CCI crystallised as a formalised multi-disciplinary, specialisation field. Although CCI is not a novel concept, it is academically vastly, under-explored. In fact, outside the circles of governments’ security apparatus, some large corporates and niche vendors that offer specialised services, CCI remains mostly unknown and often misunderstood. Unclassified, academic literature on the subject is scarce, with formalised and academic training (outside the government sector) very limited.
Cyber Counterintelligence as a specialisation field and academic subject
Counterintelligence (CI) has been practised for millennia and Cyber Counterintelligence (CCI) has existed de facto in the state security apparatus of several countries for decades. However, it was only during the late 1990s that CCI crystallised as a formalised multi-disciplinary, specialisation field. Although CCI is not a novel concept, it is academically vastly under-explored. In fact, outside the circles of governments’ security apparatus, some large corporates and niche vendors that offer specialised services, CCI remains largely unknown and often misunderstood. Unclassified, academic literature on the subject is growing but still relatively limited, with formalised and academic training (outside the government sector) limited.The need for collaborative research
As is clear from the above, CCI is not only the domain of state security. Effective CCI requires cooperation and collaborative undertakings, enmeshing state and non-state actors. Such non-state actors include business, civil society and academic institutions. Academic institutions’ interest in CCI is not limited to research. Given its above-noted relevance, CCI also ought to be a topic of instruction (i.e. part of the curricula of various subjects in the field of natural and social sciences). In a few developed countries, cooperation between the state and selected tertiary institutions on CCI education and training do exist. To the knowledge of UJ’s Cyber Security Centre, this is by far the exception and not the rule. Within the African continental context (of countries with emerging and developing economies), the need for at least some academic institutions to fulfil a research and education role in CCI is arguably even more urgent. UJ’s Cyber Security Centre is of the view that CCI’s development in the African academic sphere will benefit several academic disciplines such as Political Science, Computer Science/Informatics/Information Systems as well as Economic and Management SciencesCCI-research at UJ’s Cyber Security Centre
Against the above background, UJ’s Cyber Security Centre in 2014 launched a project aimed at promoting CCI as a multi-disciplinary field of inquiry – specifically within the context of South Africa as a middle-income emerging economy. The project strives to cooperate with interested role players locally, regionally and internationally on joint research projects.UJ’s Cybersecurity Centre is particularly proud of the project’s tangible output thus far. Exceptionally positive feedback has been received on numerous CCI-research papers delivered at local, regional and international conferences. Likewise, several articles were published on-invitation in well-known, peer-reviewed journals. In addition, two doctoral theses have been completed with a further one in progress. Growing citations of the UJ research by academics internationally, further adds credence to the project. Aspects of the CCI research have also found practical application and are incorporated in a training programme designed in cooperation with a South African state entity.
An inventory of published research flowing from the project is provided at the bottom of the webpage. The inventory shows focus areas of this research including:
- - Defining and conceptualising CCI as a mulita-disciplinary research field.
- - CCI and its relation with Cyber Intelligence and Cyber Threat Intelligence.
- - An integrated defensive-offensive organisational approach to CCI.
- - A framework for a CCI maturity model (foundational to a toolkit allowing an organisation to do a self-assessment/test with regard to its own cyber counterintelligence maturity status).
- - CCI awareness and skills training.
- - CCI literature review./li>
In addition to the above, the following are topics currently being researched:
- - Governance imperatives of Cyber Counterintelligence in securing the Fourth Industrial Revolution’
- - The effects of Covid-19 on Cyber Counterintelligence (CCI), specifically considering the additional cyber risks resulting from the whole ‘work from home’ environment.
- - A PhD study on CCI Awareness and CCI skills development.
Invitation to interaction and cooperation
UJ’s Cyber Security Centre welcomes cooperation with interested parties and individuals on CCI research. Contact details of the research team are provided on the webpage.
