Noelle van der Waag-Cowling, strategy and innovation officer at the Cyber Security Institute, speaking at ITWeb Security Summit 2025.
Lessons from real world battlefields should be applied to the cyber environment as the risk of cyber war increases.
This is according to Noelle van der Waag-Cowling, strategy and innovation officer at the Cyber Security Institute, who was addressing the ITWeb Security Summit in Sandton this week.
“Cyber space is increasingly complex and dangerous, and we’re not winning the war. The level of cyber attacks and how well resourced non-state threat actors are represent real threats to the primacy of states. Typically, states have primacy in terms of military matters, but in cyber space, that gap is narrowing dangerously and threatening to topple the stability of the international system.”
The ‘system of systems’
Van der Waag-Cowling noted that the world is increasingly digitally dependent. “We’ve introduced a whole range of technologies into the mix, such as IIOT and OT, which are increasing our cyber security attack surface. Once quantum computing becomes a reality, it is expected to turbo-charge AI at a rate we cannot begin to comprehend. At the same time, we have increased critical interdependencies between technologies and domains – the so-called system of systems which we’re living in and how complex and technologically dependent our societies have become,” she said.
“In the system of systems, all systems are interconnected. Systemic attacks and their cascading effects could bring countries to their knees. In the South African context, we can look, for example, at Eskom. If our grid goes down, the country would be down for two weeks – no food, water, petrol, diesel or comms.”
“The Swiss government has said that ransomware now poses an existential threat to Swiss business and government agencies,” she said. “The WEF estimates that cyber attacks cost most economies somewhere between 1% and 2% of GDP annually. We need to start rethinking what this actually means.
“What if we are in a ransom war? The amount of state ransomware activity driven by state proxies is colossal. Many countries are generating a substantial amount of revenue through ransomware, and for nation states, this is a national security risk that can tip the stability of the state.”
“We need to consider some lessons from the cyber battlefront,” Van der Waag-Cowling said. “We need a valid strategy, but the challenge often comes in with the execution of strategy. I propose a military doctrine known as ‘the fighting power’. It focuses on the execution of strategy, with three basic elements: the physical component, the moral component and the conceptual component. It emphasises capabilities, not capacity. We need to focus on building out hard capabilities. We need to bring the full mass of cyber capabilities together and elevate them. In the moral component, part of it boils down to effective cyber leadership, team morale and cyber ethics. The real trick here is bringing orchestration across our cyber security teams and tools.
“In the South African system, we don’t have a national cyber security agency, so no one is coming to help. We aren’t well organised in terms of sectoral cyber security responses either. It’s becoming increasingly evident that companies will need to collaborate with each other, because we can’t respond to the risks individually,” she said.
