MITIGATING VULNERABILITIES AND RISKS IN THE SOCIAL RELIEF OF DISTRESS SYSTEM: SASSA’S STRATEGIC EFFORTS TO SAFEGUARD GRANTS

By Precious Mupenzi

• The South African Social Security Agency (SASSA) has taken significant steps to address vulnerabilities and risks within its Social Relief of Distress system, particularly those related to fraud and identity theft.
• SASSA has developed sophisticated risk algorithms designed to detect fraudulent activities and introduced electronic Know Your Customer verification, as well as strengthening cellphone verification controls for cash-send payments.
• “We understand that as the system evolves, so do the risks,” SASSA Acting CEO Themba Matlou said, which is why monitoring mechanisms are in place to identify and address any emerging threats swiftly.

The South African Social Security Agency (SASSA) has taken significant steps to address vulnerabilities and risks within its Social Relief of Distress (SRD) system, which has been under scrutiny due to security risks and operational challenges.

In a detailed presentation to the portfolio committee on social development on 26 February 2025, SASSA’s Acting CEO Themba Matlou provided a comprehensive update on the agency’s efforts to protect the integrity of the SRD system, especially in the wake of rising concerns around fraud and identity theft.

SASSA’s comprehensive approach to fraud prevention

A major challenge highlighted by Matlou was the increase in identity theft and fraudulent applications, which had made it difficult to ensure that only eligible individuals received the grants.

In response, SASSA has developed sophisticated risk algorithms designed to detect fraudulent activities and introduced electronic Know Your Customer verification, as well as strengthening cellphone verification controls for cash-send payments.

“Fraud remains a major concern, but we have put robust systems in place to protect the integrity of the SRD and ensure that the right people receive the support they need,” said Matlou, underscoring the importance of ensuring that beneficiaries are not subject to fraudulent practices.

Matlou also announced that biometric verification would soon be implemented for all online transactions, offering an additional layer of security to prevent identity fraud, which is increasingly seen as a key solution to safeguard the system.

Addressing security risks and cyber threats

The presentation continued with an overview of the steps taken to mitigate security vulnerabilities in the SRD system.

SASSA identified several critical risks, including exposed directories, outdated software, and unencrypted communications, all of which posed significant threats to the integrity of the system.

To address these vulnerabilities, SASSA undertook various technical improvements. These included reconfiguring webserver settings to prevent external manipulation, upgrading security protocols such as the KrakenD API gateway and firewall, and ensuring secure communication by replacing the GET HTTPS method with POST.

Additionally, SASSA implemented rate-limiting to block abnormal web traffic and established a regular schedule for patch updates and vulnerability tests.

Tackling data accuracy and verification challenges

SASSA also identified significant challenges related to data accuracy and verification.

The agency had been relying on third-party data sources, such as South African Revenue Services, the Unemployment Insurance Fund, and banking institutions, for identity verification and means testing, which led to errors in both inclusion and exclusion of beneficiaries.

To resolve these issues, SASSA strengthened its collaboration with these institutions, improving its Memoranda of Understanding and implementing real-time data-sharing protocols.

Furthermore, the Department of Social Development issued practice notes on how data should be triangulated and used in cases where conflicting information arises, ensuring that decisions are based on the most accurate and reliable data available.

Long-term strategies for securing the SRD system

SASSA’s strategy also includes a long-term plan to enhance security and prevent future vulnerabilities.

These initiatives include expanding the Security Operations Centre to cover additional data sources, introducing cyber threat intelligence monitoring, and deploying a Web Application Firewall to prevent unauthorised access.

In addition, biometric authentication for all online transactions is expected to be rolled out, alongside efforts to combat fraudulent websites that impersonate SASSA and scam beneficiaries.

“We understand that as the system evolves, so do the risks,” Matlou said. “That is why we have put continuous monitoring mechanisms in place to swiftly identify and address any emerging threats.”

SASSA’s commitment to risk management includes ongoing assessments, internal audits, and engagement with stakeholders such as IT specialists and financial institutions to ensure the effectiveness of its interventions.

Portfolio committee deliberations

Following the presentation, the portfolio committee on social development expressed support for SASSA’s proactive approach to mitigating cybersecurity risks. Members acknowledged the critical importance of cybersecurity in the modern world and praised the agency for its diligent efforts to safeguard the SRD system.

One committee member stated: “We should not attack them and fail them after they’ve done such a great job. This is not a simple task; it requires engineers and network specialists to consolidate such a detailed report.”

This sentiment reflected the committee’s consensus on the necessity of supporting SASSA’s efforts, recognising the technical complexity and the expertise required to handle such a challenging task.

The committee also acknowledged the department’s successful penetration tests and threat analysis, which demonstrated clear progress in identifying and addressing critical vulnerabilities.

Furthermore, members were impressed with the accessible presentation, which conveyed complex information in a way that was understandable to non-experts.

Committee members expressed excitement about the enhanced security capabilities SASSA is putting in place, particularly regarding web application security, threat detection, and traffic analysis.

They also welcomed the planned improvements in incident response, vulnerability analysis, and data forensic capabilities, which would provide robust safeguards against malicious activities.

Concerns and recommendations for continued progress

The portfolio committee raised several important concerns during their discussion with SASSA, particularly around external factors such as budget constraints, which could potentially impact the effectiveness of the project.

Members emphasised the need for SASSA to continue closely monitoring the situation to ensure that these external pressures do not hinder progress.

A significant point of discussion centred on the issue of fraudulent websites that exploit SASSA beneficiaries. The committee urged SASSA to clarify whether legal actions would be pursued against those responsible for running these fraudulent sites and how perpetrators would be held accountable for their actions.

Additionally, the committee inquired about the safeguards in place at retail outlets where beneficiaries access SASSA services. Members stressed the importance of ensuring these outlets are equipped with proper security measures to protect beneficiaries from cyber threats.

Despite these concerns, the committee made it clear that they fully supported SASSA’s ongoing efforts to improve the security of the SRD system.

Members urged SASSA to maintain its commitment to the project, underscoring the importance of effectively managing both internal and external risks to ensure the continued success of the system.

Matlou, addressed these concerns, emphasising that there is no need for internal consequence management, as the challenges stem from external attacks.

He confirmed that SASSA will continue to monitor its auditing and risk mitigation processes, with quarterly reports to ensure ongoing evaluation.

Matlou was satisfied with the progress made, particularly regarding the biometric implementation, which had initially faced resistance but is now fully supported for the benefit of the country.

He also highlighted the importance of budgeting for the next steps, stating: “We need to budget outside today, out of this report that we’ve received.”

The committee’s endorsement of SASSA’s efforts signals a strong commitment to securing the SRD system and ensuring the continued integrity of the grant process.