Cyber security is now a widely used term to describe how computer systems are protected from unauthorised access, malicious damage or deliberate attacks. Cyber security is most strongly associated with cybercrime with good reason. Cyber crime is one of the fastest growing criminal activities in the world. It transcends borders, jurisdictions and economies. Estimates put the global cost of cyber crime at some US$388 billion a year.
Cyber security should be the concern of every computer user and a priority for every business owner. The danger is real and includes the ability of disgruntled employees to sabotage your systems; the use of mobile messaging by criminal gangs to arrange nefarious activity; the capacity of hacktivists (hackers with a political agenda) to ground businesses or destabilise society; the capability of competing businesses to steal your intellectual capital; and the power of another nation to compromise critical infrastructure and industrial processes. These real-world threats make cyber security a top priority for governments and businesses alike.
Clear and present danger
The Norton Cybercrime Report 2011 found that some 431 million adults experienced some sort of cyber crime in the last year alone. More disturbingly, the global economic crisis has created an environment in which cyber crime is good business for bad people. More businesses are tacitly supporting cybercrime in the interests of strategic advantage. For example, there is a thriving market for stolen corporate data. Consequently, technical staff inside of organisations such as banks are being courted by the criminals because of their skills and inside knowledge of systems.
The growing risks that attend our increasingly connected societies makes cyber security an imposing challenge for businesses and governments the world over. Within the resource-constrained Caribbean context, the challenge is particularly acute. Caribbean businesses, especially those with large networks, like financial institutions and insurance and energy companies, are under constant assault. Networks managed by governments, manufacturing sector firms, small businesses and academic institutions are not spared either. Yet, cyber security remains somewhat of a "terra incognita" within the region. Very little is reported about the level or impact of cyber crime or the profile of victims. Many computer network administrators are blissfully ignorant of the severity of the threat, or the mechanisms to detect intrusion or protect corporate systems–leaving their organisations exposed.
Companies in Latin America and the Caribbean have had gigabytes of data stolen by local and international private hacking groups. In various surveys, more than half of corporations in the region report being victims of cyber attacks and data theft. These corporations, when they detect the intrusion, generally do not report the problems to the government security services. For most countries, current legislative frameworks do not adequately address issues of prosecution, penalisation or restitution. Even where statutes are in place, security forces are ill-equipped to deal with the growing complexity of cyber risks. In light of the global nature of cyber crime, and in the absence of a coherent national or regional cyber security framework, the business community needs to take decisive steps to protect their intellectual and economic interests. At the same time, governments need to take urgent action to ensure that citizens, critical infrastructure and national interests are effectively protected.
Security begins at home
For private and public sector organisations, a good cyber security policy must address issues of:
Access control: Ensure the right people have access to the right information and tools at the right time. This applies not just to systems at the office, but to mobile phones, tablets, laptops and home computers. An integrated approach is needed. Policies and staff training: The abuse of Internet access and corporate e-mail creates gaps for cyber criminals to exploit. It also places a business' brand and reputation in danger. Staff training and the development of a culture of secure business practices is critical to both prevention of and recovery from security breaches. Notification, back-up and recovery: In the event a security breach or a cyber attack, businesses need to have a coherent notification and recovery strategy. These include initial steps for immediately limiting the impact of the security breach, finding and securing the security flaw and restoring necessary tools and data.
Public-private dialogue and partnership: Who does one call? What help should IT vendors provide? What role law enforcement agencies play? What legal recourse is available? These questions are problematic for Caribbean businesses. Greater collaboration between businesses, law enforcement officials, academia and policymakers is a must. A multi-pronged attack needs a multi-faceted defense. It is not sufficient to simply be afraid. Businesses and users need to be informed, be alert and, most importantly, they need to act.
Bevil Wooding is the chief knowledge officer at Congress WBN, an international non-profit organisation and an Internet strategist with US-research firm, Packet Clearing House.
He is also the founder of BrightPath Foundation, creating Caribbean-focused digital content, apps and training programmes.
Twitter: @bevilwooding Facebook:
facebook.com/bevilwooding
