Raphael John-Lall

Busi­ness lead­ers in T&T are not in­vest­ing enough to pro­tect them­selves from po­ten­tial cy­ber­at­tacks and this could im­pact neg­a­tive­ly on their fi­nan­cial per­for­mance.

This is the view of man­ag­ing di­rec­tor of Ar­chi­tects of Caribbean En­ter­prise Strate­gic So­lu­tions, Ri­car­do Fras­er who spoke to Sun­day Busi­ness about the lat­est trends in cy­ber­se­cu­ri­ty and the con­se­quences for com­pa­nies that do not pro­tect them­selves.

Fras­er is al­so the vice pres­i­dent of the In­ter­na­tion­al In­for­ma­tion Sys­tem Se­cu­ri­ty Cer­ti­fi­ca­tion Con­sor­tium (ISC2) Caribbean and Latin Amer­i­can chap­ter. This is a non-prof­it or­gan­i­sa­tion which spe­cialis­es in train­ing and cer­ti­fi­ca­tion of cy­ber­se­cu­ri­ty pro­fes­sion­als. It has been de­scribed as the world’s largest IT se­cu­ri­ty or­gan­i­sa­tion.

He said crim­i­nals who car­ry out cy­ber­at­tacks are mo­ti­vat­ed by mon­ey and many op­er­ate out­side of the Caribbean re­gion.

Cy­ber­at­tacks can re­sult in cred­it card fraud and iden­ti­ty theft where the hack­ers steal cus­tomers’ ac­counts.

He gave ex­am­ples of dif­fer­ent sizes of busi­ness­es and what their needs might be.

For a small busi­ness with a few em­ploy­ees or a pro­fes­sion­al work­ing from home, their is need for an­ti-virus soft­ware and a fire­wall for their home net­work and per­son­al com­put­er de­vices. They al­so need spam fil­ters to pro­tect emails, and if it is a big­ger com­pa­ny, they need a de­tec­tion and re­sponse soft­ware sys­tems.

Fras­er said in T&T, some cy­ber­se­cu­ri­ty ser­vice providers of­fer ser­vices that cost TT$1,000 month­ly that will pro­tect a pro­fes­sion­al with a lap­top who works from home. How­ev­er, for larg­er com­pa­nies it can cost thou­sands of dol­lars in US cur­ren­cy.

If a com­pa­ny wants to do a vul­ner­a­bil­i­ty and pen­e­tra­tion test to de­ter­mine how vul­ner­a­ble its net­work is, the cost can be TT$50,000 a year.

“In T&T and the Caribbean, com­pa­nies are of a small size and these ser­vices can run in­to thou­sands of US dol­lars. They can cost up to US$30,000 an­nu­al­ly. Many small busi­ness­es may not be in a po­si­tion to put out or pay US$30,000 an­nu­al­ly. It all de­pends on their rev­enue.

“If a com­pa­ny gen­er­ates US$1 mil­lion an­nu­al­ly in rev­enue and it has a sig­nif­i­cant prof­it mar­gin, it may be wise to in­vest in cy­ber­se­cu­ri­ty sys­tems. Com­pa­nies are us­ing more tech­nolo­gies glob­al­ly and they will have to be pro­tect­ed. In or­der to re­main com­pet­i­tive, busi­ness­es must use the tech­nol­o­gy.”

Cy­ber­se­cu­ri­ty breach­es have caught the at­ten­tion of the pub­lic over the last few months, with the most promi­nent ex­am­ple be­ing the cy­ber­at­tack on the Telecom­mu­ni­ca­tions Ser­vices of Trinidad and To­ba­go (TSTT) last year.

The breach took place on Oc­to­ber 9, but the pub­lic was on­ly in­formed on Oc­to­ber 27 via In­dia-based tech­nol­o­gy se­cu­ri­ty com­pa­ny Fal­con Feeds. Tak­ing to its X so­cial me­dia ac­count, Fal­con Feeds said ran­somware group Ran­somExx added TSTT to its vic­tim list claim­ing to have stolen six gi­ga­bytes of da­ta.

On Oc­to­ber 30, TSTT is­sued a state­ment which said that cus­tomers’ da­ta was not com­pro­mised dur­ing the leak. How­ev­er, days lat­er, on No­vem­ber 5, the Min­is­ter of Pub­lic Util­i­ties Mar­vin Gon­za­les re­tract­ed his pre­vi­ous com­ments, con­firm­ing that TSTT was hit by a cy­ber­at­tack, and or­der­ing an in­de­pen­dent in­ves­ti­ga­tion.

On No­vem­ber 15, TSTT an­nounced that CEO Lisa Agard had been re­placed by Kent West­ern. Pri­or to his ap­point­ment, West­ern was TSTT’s gen­er­al man­ag­er, Cus­tomer Ex­pe­ri­ence and Mar­ket­ing.

There have al­so been me­dia re­ports of oth­er large com­pa­nies like Courts, PriceS­mart and statu­to­ry cor­po­ra­tions like TTPost that were hit by cy­ber­at­tacks re­cent­ly.

Brain drain

Fras­er ad­mit­ted that set­ting up sys­tems to pro­tect com­pa­nies and busi­ness­es is not cheap and he lament­ed that some busi­ness own­ers are re­luc­tant to spend the mon­ey to pro­tect their busi­ness­es.

He al­so said there is a brain drain in T&T as cy­ber­se­cu­ri­ty pro­fes­sion­als are leav­ing for the US, UK and Cana­da where they are paid much high­er wages.

Ac­cord­ing to some of the ex­am­ples he gave, some cy­ber­se­cu­ri­ty pro­fes­sion­als in T&T are of­fered wages as low as $5,000 month­ly.

“We have skilled peo­ple in T&T that have been tak­ing their skills abroad, pro­vid­ing ser­vices to in­ter­na­tion­al or­gan­i­sa­tions and even mi­grat­ing. They per­ceive that it is bet­ter to go out there and earn wages.

“The prob­lem right now in the lo­cal busi­ness com­mu­ni­ty is that there needs to be an in­creased cy­ber­se­cu­ri­ty aware­ness by de­ci­sion­mak­ers so that they will un­der­stand the in­vest­ment re­quired to im­ple­ment cy­ber­se­cu­ri­ty pro­tec­tive mea­sures.

“It be­gins with an un­der­stand­ing of the im­pact on their busi­ness­es in terms of dol­lars and cents. Cur­rent­ly we are not see­ing the sort of pen­e­tra­tion in the cy­ber­se­cu­ri­ty mar­ket and that stems from a lack of aware­ness of how at risk com­pa­nies are,” said Fras­er.

Im­pact on busi­ness­es

Fras­er said that cy­ber­at­tacks are in­creas­ing and it is even more im­por­tant for busi­ness­es to pro­tect them­selves.

“We have seen an in­creas­ing num­ber of cy­ber­at­tacks. In the last quar­ter of 2023, I would say there have been 20 at­tacks. TSTT is a ma­jor one but as peo­ple would re­call, ac­cord­ing to me­dia re­ports, there were oth­er ma­jor ones like Courts, PriceS­mart and Massy Tech­nolo­gies. These at­tacks have been in­creas­ing and we ex­pect them to in­crease steadi­ly in the com­ing months. These at­tacks are not ran­dom and the at­tack­ers probe weak­ness­es. At least 60 per cent of or­gan­i­sa­tions in T&T are vul­ner­a­ble.”

He de­fines cy­ber­se­cu­ri­ty as the prac­tice of help­ing or­gan­i­sa­tions pro­tect their dig­i­tal sys­tems from threats that may im­pact their busi­ness ob­jec­tives.

“The goal of it is to de­crease the like­li­hood or the im­pact of a threat be­cause a cy­ber­se­cu­ri­ty threat af­fects the con­fi­den­tial­i­ty, avail­abil­i­ty or in­tegri­ty of da­ta. A cy­ber­se­cu­ri­ty threat, while it may af­fect an in­for­ma­tion sys­tem mean­ing peo­ple, process­es, da­ta, tech­nol­o­gy of a sys­tem, it re­al­ly has re­al world busi­ness im­pact be­cause it af­fects the op­er­a­tions of an or­ga­ni­za­tion. It af­fects the abil­i­ty of an or­gan­i­sa­tion to gen­er­ate rev­enue. The or­gan­i­sa­tion has to in­cur ex­pens­es to al­le­vi­ate these cy­ber-at­tacks.”

He spoke about se­ri­ous con­se­quences that busi­ness­es suf­fer af­ter a cy­ber­at­tacks.

“There is the rep­u­ta­tion­al dam­age. In some or­gan­i­sa­tions rep­u­ta­tion­al dam­age can lead to a lack of cus­tomer con­fi­dence. If the or­gan­i­sa­tion is pub­licly trad­ed it can lead to de­creased share prices.”

He said once there is a breach of a com­pa­ny’s sys­tems, a foren­sic analy­sis will have to done which is look­ing for in­di­ca­tors of com­pro­mise af­ter the breach.

“That is even more cost­ly than putting these pro­tec­tions in place. What some ser­vice providers are do­ing is try­ing to de­vel­op an all-in-one so­lu­tion that pro­tects or­gan­i­sa­tions and mit­i­gates the chances of that sort of cy­ber­at­tack from tak­ing place and even if the cy­ber­at­tack has tak­en place it re­al­ly eas­es the re­turn to nor­mal op­er­a­tions.”

He con­clud­ed by of­fer­ing so­lu­tions.

“One of the things to dri­ve change that will en­cour­age or­gan­i­sa­tions to adopt cy­ber­se­cu­ri­ty tools and tech­nolo­gies would be reg­u­la­tions and laws. We have seen much suc­cess in the bank­ing sec­tor as their cy­ber­se­cu­ri­ty pro­grammes are typ­i­cal­ly reg­u­lat­ed by the cen­tral banks through­out the re­gion.

“The cen­tral banks play a reg­u­la­to­ry role to pro­tect the cy­ber­se­cu­ri­ty pro­grammes of fi­nan­cial in­sti­tu­tions.

What we need is more reg­u­la­tion for crit­i­cal in­dus­tries across the Caribbean like pub­lic util­i­ties. Imag­ine if a pub­lic util­i­ty goes down be­cause of cy­ber­at­tacks, what will be the ef­fects of civ­il so­ci­ety and busi­ness­es.

“We need reg­u­la­tion per­tain­ing to forc­ing a min­i­mum stan­dard of cy­ber­se­cu­ri­ty pro­grammes. There are the ISO stan­dards for cy­ber­se­cu­ri­ty and there is the im­por­tance of com­ply­ing with those.”