Cybercrime is the use of technology to support or directly facilitate a criminal activity, with logon credentials being the main information asset targeted during a cybercrime. The one time passwords used by banks to protect their clients from cybercrime are also under attack by cybercriminals. The Internet has made it easy to commit cybercrime, with perpetrators experiencing virtually no risk with huge returns. Individual cybercrime cases are sometimes small in nature, which means that the police can be reluctant to commit the resources necessary to investigate every incident. There is a distinct lack of resources, skills, knowledge and training in relation to identifying, understanding and responding to the growing threat of cybercrime. This research addresses how to solve these issues in South Africa in order for cybercrime to be tackled effectively and for perpetrators to be prosecuted.

Research report submitted to the School of Economic and Business Sciences, University of the Witwatersrand in partial fulfilment of the requirements for the degree of Master of Commerce (Information Systems) by coursework and research. Johannesburg, 28 February 2017. / This study is informed by very little empirical research in the field of cybercrime and specifically in the context of South African banks. The study bridges this gap in knowledge by analyzing the cybercrime phenomenon from the perspective of a South African bank. It also provides a sound basis for conducting future studies using a different perspective. In order to achieve this, an interpretive research approach was adopted using a case study in one of the biggest banks in South Africa where cybercrime is currently a topical issue and one that is receiving attention from senior management. Cohen and Felson (1979) Routine Activity Theory was used as a theoretical lens to formulate a conceptual framework which informed the data collection, analysis and synthesis of cybercrime in the selected bank. Primary data was obtained via semistructured interviews. Secondary data was also obtained which allowed for data triangulation. From the perspective of a South African bank, the study concluded that weak security and access controls, poor awareness and user education, prevalent use of the internet, low conviction rates and perceived material gain are the major factors that lead to cybercriminal activity. In order to curb the ever increasing rate of cybercrime, South African banking institutions should consider implementing stronger security and access controls to safeguard customer information, increase user awareness and education, implement effective systems and processes and actively participate in industry wide focus groups. The transnational nature of cybercrime places an onus on all banks in South Africa and other countries to collaborate and define a joint effort to combat the increasing exposure to cybercriminal activity. The use of the Routine Activity Theory provided an avenue to study the cybercrime phenomenon through a different theoretical lens and aided a holistic understanding of the trends and the behavioral attributes contributing to cybercriminal activity that can help South African banks model practical solutions to proactively combat the splurge of cybercrime. Keywords: Cybercrime, internet, crime, computer networks, Routine Activity Theory, South African banks. / GR2018

M.Com. (Accounting & Auditing) / External and Internal auditors have to deal with computer systems which are becoming increasingly complex. An auditor's interest in such an environment is primarily an understanding of the controls over the computer system and the risk of error and fraud. When dealing with controls two issues are important. The first deals with the ability to control a complex computer system. Unless the control issues are understood and the impact of various alternatives appreciated it would be impossible to control a computer system. Under such circumstances there is a high risk of error and fraud and the information present in a business could be very unreliable. Secondly the auditor needs to evaluate controls for purposes of his audit. Usually the objective is to assure himself that they adequately safeguard the business assets and prevent or detect errors present in the accounting records of the concern...

Text in Afrikaans / Parralel met die snelle groei van rekenaartegnologie en die groteiwordende rol wat rekenaars in ans alledaagse lewe speel, is daar ongelukkig 'n toename in die misbruik van rekenaars. Benewens die wyses om rekenaarmisbruik by wyse van remedies in die siviele reg aan te spreek, is dit hoofsaaklik die taak van die strafreg om sodanige misbruik te kriminaliseer en deur middel van straf sulke misbruik te voorkom en oortreders af te skrik. Uit 'n ontleding van die Suid-Afrikaanse strafreg het dit geblyk dat bestaande misdrywe, beide gemeenregtelik en statuter, nie voldoende rekenaarmisbruik kan kriminaliseer en aanspreek nie. Wetgewing blyk die mees gepaste optossing te wees. Uit 'n regsvergelykende studie van die hantering van rekenaarmisbruik in jurisdiksies waar die wetgewer verskillende benaderings toegepas het, het dit geblyk dat die mees gepaste wyse om rekenaarmisbruik te kriminaliseer sal wees om ongemagtigde rekenaarbetreding as moedermisdaad te bestraf aangesien dit die fondament is waarop enige verdere misbruik van 'n rekenaar gebaseer word. Daarbenewens moet verdere meer spesifieke misbruikshandelinge wyd omskryfword as misdrywe, ten opsigte van meer emstige misbruik na betreding van 'n rekenaar / Parallel with the growth in computer technology and increasing use of computers, there has been an increase in computer misuse. In addition to addressing different methods of computer misuse in terms of civil law remedies, it is mainly the task of the criminal law to criminalise such misuse, prevent computer misuse and deter offenders by means of punishment. It was clear from a study of South African criminal law that existing offences, both statutory and in terms of the common law, do not criminalise and address computer misuse effectively. It therefore seems that legislation would be the most appropriate solution. It appeared from a comparative study of jurisdictions where legislators approach computer misuse differently, that the most effective way of criminalising computer misuse would be to criminalise una1,1thorised computer accessing as basic offence. In addition thereto more specific further acts of serious computer misuse, defined broadly, should be criminalised / Criminal & Procedural Law / LL.M. (Criminal & Procedural Law)

Text in Afrikaans / Parralel met die snelle groei van rekenaartegnologie en die groteiwordende rol wat rekenaars in ans alledaagse lewe speel, is daar ongelukkig 'n toename in die misbruik van rekenaars. Benewens die wyses om rekenaarmisbruik by wyse van remedies in die siviele reg aan te spreek, is dit hoofsaaklik die taak van die strafreg om sodanige misbruik te kriminaliseer en deur middel van straf sulke misbruik te voorkom en oortreders af te skrik. Uit 'n ontleding van die Suid-Afrikaanse strafreg het dit geblyk dat bestaande misdrywe, beide gemeenregtelik en statuter, nie voldoende rekenaarmisbruik kan kriminaliseer en aanspreek nie. Wetgewing blyk die mees gepaste optossing te wees. Uit 'n regsvergelykende studie van die hantering van rekenaarmisbruik in jurisdiksies waar die wetgewer verskillende benaderings toegepas het, het dit geblyk dat die mees gepaste wyse om rekenaarmisbruik te kriminaliseer sal wees om ongemagtigde rekenaarbetreding as moedermisdaad te bestraf aangesien dit die fondament is waarop enige verdere misbruik van 'n rekenaar gebaseer word. Daarbenewens moet verdere meer spesifieke misbruikshandelinge wyd omskryfword as misdrywe, ten opsigte van meer emstige misbruik na betreding van 'n rekenaar / Parallel with the growth in computer technology and increasing use of computers, there has been an increase in computer misuse. In addition to addressing different methods of computer misuse in terms of civil law remedies, it is mainly the task of the criminal law to criminalise such misuse, prevent computer misuse and deter offenders by means of punishment. It was clear from a study of South African criminal law that existing offences, both statutory and in terms of the common law, do not criminalise and address computer misuse effectively. It therefore seems that legislation would be the most appropriate solution. It appeared from a comparative study of jurisdictions where legislators approach computer misuse differently, that the most effective way of criminalising computer misuse would be to criminalise una1,1thorised computer accessing as basic offence. In addition thereto more specific further acts of serious computer misuse, defined broadly, should be criminalised / Criminal and Procedural Law / LL.M. (Criminal & Procedural Law)

If you cannot measure, you cannot manage. This is an age old saying, but still very true, especially within the current South African cybercrime scene and the ever-growing Internet footprint. Due to the significant increase in cybercrime across the globe, information security specialists are starting to see the intrinsic value of logs that can ‘tell a story’. Logs do not only tell a story, but also provide a tool to measure a normally dark force within an organisation. The collection of current logs from installed systems, operating systems and devices is imperative in the event of a hacking attempt, data leak or even data theft, whether the attempt is successful or unsuccessful. No logs mean no evidence, and in many cases not even the opportunity to find the mistake or fault in the organisation’s defence systems. Historically, it remains difficult to choose what logs are required by your organization. A number of questions should be considered: should a centralised or decentralised approach for collecting these logs be followed or a combination of both? How many events will be collected, how much additional bandwidth will be required and will the log collection be near real time? How long must the logs be saved and what if any hashing and encryption (integrity of data) should be used? Lastly, what system must be used to correlate, analyse, and make alerts and reports available? This thesis will address these myriad questions, examining the current lack of log analysis, practical implementations in modern organisation, and also how a need for the latter can be fulfilled by means of a basic approach. South African organizations must use technology that is at hand in order to know what electronic data are sent in and out of their organizations network. Concentrating only on FreeBSD PF firewall logs, it is demonstrated within this thesis the excellent results are possible when logs are collected to obtain a visual display of what data is traversing the corporate network and which parts of this data are posing a threat to the corporate network. This threat is easily determined via a visual interpretation of statistical outliers. This thesis aims to show that in the field of corporate data protection, if you can measure, you can manage.

Thesis (LLM)--Stellenbosch University, 2004 / ENGLISH ABSTRACT: This thesis deals with the criminal liability of Internet providers. The focus is on Germany, but the analysis is put in a wider, comparative context. This is done with reference to South Africa, as well as Europe and the American system. This thesis demonstrates and discusses the existing legal norms to regulate Internet provider liability for illegal content on the Internet and the international efforts to deal with this issue. In the introduction it is shown how the Internet has given rise to a new form of global communication and the accompanying legal problems. This is followed by an examination of the different functions Internet providers have. A survey of some of the important crimes affecting the Internet and also some Internet-specific offences put the more general issue of liability in a more specific context. Traditional and new forms of crimes are discussed. This section is followed by an analysis of Internet provider liability under German criminal law and Germany's Teleservices Act. From an international criminal law perspective some international instruments, like the Cybercrime Convention of the Council of Europe, is discussed. National legislation, especially in the context of the European Union, must always be put in the proper regional and international context. The thesis concludes with some thoughts on alternative, or perhaps complementary, methods to fight illegal and criminal conduct on the Internet. This is done not as a critique of the responses to Internet crime, but rather to strengthen the many hands trying to reduce Internet crime. / AFRIKAANSE OPSOMMING: Hierdie tesis handeloor die strafregtelike aanspreekliheid van Internet diensverskaffers. Die fokus val op Duitsland, maar die analise word ook geplaas in 'n wyer, vergelykende konteks. Dit word gedoen met verwysing na Suid-Afrika, sowel as Europa en die VSA. Die tesis demonstreer en bespreek die bestaande regsnorme wat Internet diensverskaffers reguleer met spesifieke verwysing na aanspreeklikheid vir onwettige inhoud op die Internet en internasionale pogings om hierdie probleem aan te spreek. Ter inleiding word daar aangetoon hoe die Internet aanleiding gee tot nuwe vorme van globale kommunikasie en die regsprobleme wat dit tot gevolg het. Dit word gevolg deur 'n ondersoek na die verskillende funksies van Internet verskaffers. 'n Ontleding en bespreking van Internet-spesifieke misdrywe plaas die meer algemene vraagstuk in 'n meer gefokusde konteks. Tradisionele en nuwe vorme van misdaad word bespreek. Hierdie afdeling word gevolg deur 'n ontleding van Internet diensverskaffer aanspreeklikheid ingevolge Duitse reg en die Duitse wetgewing op die terrein van telediens. Uit 'n internasionale strafreg oogpunt word sekere internasionale instrumente, soos die Cybercrime Convention van die Raad van Europa, bespreek. Nasionale wetgewing, veral in die konteks van die Europese Unie, word ook in die relevante regionale en internasionale konteks geplaas. Die tesis word afgesluit met sekere gedagtes oor alternatiewe, of moontlik komplimentêre, metodes in die stryd teen Internet-kriminaliteit. Dit moet nie gesien word as kritiek op die huidige stand van sake nie, maar eerder as 'n poging om die talle rolspelers in die stryd teen Internet misdaad se hande te sterk.

PhD (Business Management) / Department of Business Management / See the attached abstract below

MGS / Institute for Gender and Youth Studies / Most people view bullying as a childhood challenge which children outgrow with age. However, bullies grow up and even go to universities where they continue with their bullying tactics; harassing their fellow students. The development of technology has allowed bullying to be taken to adulthood through cyber-bullying. Technology has become a big part of young people’s lives and it plays an increasingly important role in their day-to-day activities. However, it has also become a platform for young people to intimidate and harass each other. Cyber-bullying has become a huge problem for university students, which can cause long term effects to victims. It involves sending hurtful, threatening or embarrassing messages to one another. Cyber-bullying causes problems such as depression, anxiety, suicide, poor school attendance and performance for the victims of such an act. Both males and females take part in cyber-bullying. Avenues for cyber-bullying by students include emails, blogs, text messages, and social network sites such as Facebook, My Space, Whatsapp, Instagram and twitter among others. The main aim of this study was to probe cyber-bullying experiences of both male and female first year students at the University of Venda. Qualitative research approach was used. Snowball sampling, a subtype of non-probability sampling was used to select the respondents for the study. Semi-structured interviews were used as the data collecting tool. The data was analysed using thematic analysis. Confidentiality, anonymity, voluntary participation and informed consent were among the ethical considerations that were followed. The study found that cyber-bullying is prevalent at the University of Venda and it socially, academically, psychologically and physically affects students. More female students were found to be victims of cyber-bullying when compared to male students. In view of the magnitude of cyber-bullying among university students; there is a need for urgent action by the University of Venda management to come up with / NRF

MCom (Business Information Systems) / Department of Business Information Systems / Today, information and communication technologies (ICT) have become an integral part of humans lives more especially in business, be it those in developed or developing countries. The evolution of ICT’s has also led to the introduction of e-Commerce services. Both the public and private sectors, develop these technologies with customer satisfaction in mind. Out of all the efforts by businesses and ICT experts, e-commerce systems continue to fail because of low user acceptance and user attitude, especially in developing nations. Security issues are known to be of top most concern for online shoppers. A survey was administered to 161 respondents, to find out how cyber security affects consumer’s intentions and actual use of e-commerce systems. The study encompasses both users of e-commerce systems and non-users of e-commerce systems across Vhembe district of Limpopo Province in South Africa. A quantitative research approach was used. The findings revealed that perceived security was the main concern for non-users of e-commerce intentions to use e-commerce systems because of lack of information and lack of trust on e-commerce systems. The study also revealed that users of e-commerce systems are still concerned about security, even though they intend to continue using e-commerce systems. For the success of e-commerce in rural communities, government needs to join hands with retailers and SME’s to start awareness campaigns that will clarify how e-commerce systems work and eradicate negative perception on e-commerce systems. / NRF