FROM OVERSIGHT TO ACTION: SASSA LEADS CYBERSECURITY DIALOGUE AT IMST FORUM

By Cuma Pantshwa

• South Africa’s social assistance program is evolving into a digital era where data security is not a luxury, but a fundamental requirement.
• At the Department of Social Development’s IMST Forum, a frank assessment of past vulnerabilities has opened the door to more accountable, collaborative cybersecurity strategies.
• Through leaders like SASSA’s Mr Tau and legal voices such as Advocate Mathaphuna, the message is clear: cybersecurity is not just a risk, it’s a shared responsibility and a national priority.

Each digital revolution introduces new risks. Opening the second day of the IMST Forum, Mr Tau, Senior Manager of Financial Systems at SASSA, delivered a sobering yet forward-looking presentation titled “Lessons Learned on Cybersecurity.”

Reflecting on the widely publicised 2023 incident where Stellenbosch students exposed weaknesses in the SRD system, Mr Tau acknowledged a key oversight: “Cybersecurity wasn’t integrated into our system design from the start,” he said. “We developed under immense pressure and missed critical steps such as threat modelling, secure API integration, and proactive defence mechanisms.”

As the custodian of sensitive personal and financial data for over 20 million South Africans, SASSA’s experience serves as a powerful reminder that even well-intentioned digital transformation must be matched with robust cybersecurity planning from the outset.

Mr Tau’s honesty about the gaps in the initial design sparked vital discussions around data protection, ethical hacking, internal threats, and compliance with the Protection of Personal Information Act (POPIA).

“Someone is always watching,” he noted. “But the question is: are we watching them?.” The presentation also addressed the emergence of fake SASSA websites and fraudulent social media pages—many of which target vulnerable recipients. Over 200 domains were flagged as impersonating SASSA, reinforcing the urgency of digital vigilance.

In response, SASSA has moved quickly to improve its digital defence posture, working with major tech companies like Meta and Google to track and remove misleading content. In a related media statement, SASSA CEO Mr Themba Matlou reaffirmed the agency’s zero-tolerance stance on fraud and corruption:

“What we have seen in the last few weeks is the culmination of our hard work in collaboration with the SAPS to clamp down on fraud and corruption at SASSA.”

Mr Tau’s presentation laid out a clear roadmap for action going forward, including:
•⁠ ⁠Threat modelling and secure API development
•⁠ ⁠Regular penetration testing and vulnerability scanning
•⁠ ⁠Independent security assessments
•⁠ ⁠Strategic partnerships that leverage AI and cybersecurity intelligence

He further confirmed that SASSA now conducts monthly internal risk scans and annual testing of critical platforms, including payment systems. “Cybersecurity is no longer just a technical issue, it’s a people issue,” Mr Tau emphasised.

To that end, the agency plans to launch public education campaigns across its communication platforms.

The session also drew critical input from Advocate Mandla Mathaphuna, Legal Compliance Analyst within the Integrated Justice System (IJS). Raising the broader social implications of digital crime, he asked: “Does DSD have an approved Cybercrime Policy in place? And to what extent have we considered how cybercrime facilitates broader social ills such as human trafficking or domestic violence?”

He underscored the importance of a coordinated, legally compliant response. “A fully realised cybersecurity framework must be integrated across systems like the IJS, which touch every aspect of child protection, social crime prevention, and interdepartmental justice.”

The IMST Forum concluded with a renewed sense of urgency and cooperation. Through shared insights and transparent reflection, departments like SASSA and DSD are now working together to ensure that digital dignity, protection, and trust remain central to their service delivery ethos.

As South Africa expands its digital footprint, cybersecurity can no longer be reactive. It must be proactive, inclusive, and firmly embedded in our national governance fabric.