Andrea Perez-Sobers
Senior Reporter
andrea.perez-sobers@guardian.co.tt
Cyber threats, both in the region and globally, are increasing substantially and that is why government ministries and companies must ensure that their cybersecurity measures are up to date and confidential data is protected at all times.
That’s the advice from Anil Persad, cybersecurity and data privacy leader at Ernest and Young.
Persad told Business Guardian on Tuesday, that there are complexities and inevitable consequences when it comes to cyberattacks, which continue to plague the region and T&T in ways that can be bewildering to the average man on the street. Most recently, he said a local telecommunications provider responded to news circulating that there was an attack on, and breach of, its technology systems.
“While there is some uncertainty about the event at this time, what is certain is that there is a constant barrage of cyber threats across the globe attempting to exploit and infiltrate networks and technologies. Just a few months ago, one of our Government Ministries fell victim to an attack and was severely crippled. This type of news appears commonplace today, and frankly, a substantial number of the attacks stay under the radar as the laws do not enforce disclosure,” Persad disclosed.
On Monday, Telecommunications Services of Trinidad and Tobago (TSTT) confirmed that it was a victim of a cyberattack on October 9, but stated there was no loss of customer data from its databases, but it rejected reports that it suffered loss, manipulation or compromise of customer data from its databases.
Over the weekend, Falcon Feeds, an India-based technology security company, reported on its X social media account that RansomExx, a ransomware group, added TSTT (http://tstt.co.tt) to its victim list. It claimed to have access to 6GB of organisation data.
One website described RansonExx as a notorious ransomware group that has carried out cyberattacks globally since 2018. It rose to prominence in 2020 after it attacked high-profile organisations.
Persad said indicators suggest that there has been an increase in cyberattacks in Trinidad over the past year.
Shedding more light on issue, the cybersecurity expert said the digital troublemakers behind the cyberattacks are typically organised groups that ply their trade over the internet (Lockbit, Conti, Lazarus to name a few), who are good at hiding their identities, and have financial, social, or political motives.
The most popular over the past decade, he pointed out, has certainly been ransomware attacks for financial gain.
“In addition to breaking in, taking control, and encrypting critical technology systems and making them unusable for the organisation, the attackers make financial demands in exchange for decryption keys. The attackers also threaten to publish stolen data even after the victim has paid the ransom.
“While a seemingly simple business model, and with the advent of next-generation security and monitoring technologies in today’s world, the process of tracking and bringing these groups and individuals to justice is extremely convoluted, especially in this age of digital payments, cryptocurrency, anonymity, and the darknet,” Persad revealed.
Why is this happening?
The cybersecurity expert said as technologies and people evolve to meet the needs of the ever-changing global business environment, the cyber world has also adapted, at the cost of increasingly complex solutions. The adoption of these tools has not been paralleled by secure practices, and this has left an enticing and opportunist playground for cyber-villains.
In many instances Persad pointed out that the attacks were successful as some employees may have fallen victim to a social engineering email, allowing a virtual perpetrator into the organisation’s internal virtual environment of the business, and thereafter exploiting some vulnerable or weak system(s) that would typically exist on a corporate network today.
“One would assume that securing/monitoring the system and educating the employee would be an easy fix, but it is easier said than done. Companies today have undoubtedly raised awareness of the need and channeled investments into cybersecurity, but the efforts are not always stacked using the best strategies. We see leading security software being bought by many companies, but they are not optimised,” he remarked.
Persad noted that in the absence of a well-tailored cybersecurity program to design, operate, monitor, and continuously improve the cybersecurity posture, companies will continue to face enormous challenges with having an adequate response to cyberattacks.
“This is even more topical for our companies within Trinidad and Tobago today, in light of the Cybersecurity Investment Tax Allowance that is being offered investments in cybersecurity software and network security monitoring equipment.”
So, what can be done to keep the cyber attackers at bay Persad advised that companies should not only enhance their security technology environment but develop the ability to identify and respond to cyberattacks within the shortest possible timeframe via effective operational processes and clear assigned responsibilities for its personnel.
“Notwithstanding, if the compromise does occur, there should be adequate infrastructure, plans, and processes to get the company back to a good state without being at the mercy of the attacker,” he added.
Also giving insight into cyberattacks was Terrence Nichols, information security manager at ANSA McAL Group of Companies, who said the trend of the cyberattacks has been across multiple industries such as insurance, distribution, retail, and telecommunications.
“Email is always a major concern as it is often the source of the attacks through phishing or malware. Attackers also heavily take advantage of unpatched vulnerabilities in systems.”
Nichols said in the prevention of attacks email protection is important, but there should also be a heavy focus on protecting identities from compromise.
“Multifactor authentication (MFA) should be enforced by default. There is no silver bullet but security awareness training for employees is also essential. IT departments must pay strict attention to patching vulnerabilities promptly. Incident response and backup and disaster recovery capabilities are also critical for getting the business operational again after a cyberattack.
“Protecting data requires a multi-layered approach and each business would have its own unique set of challenges. Risk assessments can help in developing a strategy that defines the approach based on the actual gaps that exist and the specific business needs,” the information security manager concluded.
Rise in global cyberattacks
According to a cybersecurity report by Fortinet in July, during the first half of 2022, there were 137 billion cyber-attack attempts registered in Latin America.
The cybersecurity solutions and services company based in the US said the main type of cyber-attack was ransomware attempts, which aim to encrypt a company’s information and prohibit system access until a ransom is paid.
“These attempts doubled compared to 2021. The report identifies Mexico as having the most cyber-attacks in the region, followed by Brazil and Colombia. This increase is not only in numbers but in sophistication. New variants of this malicious program have been created, as well as “ransomware as a service” (RaaS), where developers sell or distribute ransomware to third parties (usually on the dark web) in exchange for a percentage of the profits,” the company explained.
