An­drea Perez-Sobers

Se­nior Re­porter

an­drea.perez-sobers@guardian.co.tt

Cy­ber threat ac­tiv­i­ties in this coun­try have climbed from 35 in­ci­dents in 2021 to 52 in 2023, an in­crease of 48.5 per cent.

That’s ac­cord­ing to da­ta pro­vid­ed by the Trinidad and To­ba­go Cy­ber­se­cu­ri­ty In­ci­dent Re­sponse Team (TTC­SIRT).

In an in­ter­view with the Busi­ness Guardian cy­ber ex­pert and se­nior man­ag­er at Ernest & Young (EY), Je­re­my Naipaul, said the da­ta pro­vid­ed by the TTC­SIRT, il­lus­trates a clear es­ca­la­tion in cy­ber threat ac­tiv­i­ty.

Analy­sis of the da­ta from 2019 to 2023, he not­ed, re­vealed that phish­ing emerged as the most com­mon form of at­tack, with 68 re­port­ed in­ci­dents. This was close­ly trailed by in­stances of sys­tem com­pro­mise/da­ta breach­es, which stood at 47, and web­site de­face­ment or de­nial-of-ser­vice at­tacks, to­talling 39 in­ci­dents in the same time­frame.

Naipaul said this not on­ly high­lights that cy­ber­crim­i­nals are pay­ing more at­ten­tion to the re­gion but al­so the need for stronger cy­ber­se­cu­ri­ty con­trols.

Both the pri­vate and pub­lic sec­tors are aware of the risks posed by these threats and in re­sponse, Naipaul said com­pa­nies have at­tempt­ed to strength­en their tech­ni­cal and non-tech­ni­cal cy­ber­se­cu­ri­ty con­trols via ad­di­tion­al in­vest­ments.

For ex­am­ple, he said com­pa­nies are on­board­ing ser­vice providers to per­form pe­ri­od­ic se­cu­ri­ty test­ing to val­i­date that their im­ple­ment­ed se­cu­ri­ty so­lu­tions are work­ing as in­tend­ed.

Look­ing at the ex­pen­di­ture side, Naipaul in­di­cat­ed that gran­u­lar sta­tis­tics on lo­cal cy­ber­se­cu­ri­ty ex­pen­di­ture may not be avail­able as or­gan­i­sa­tions are not for­mal­ly re­quired to dis­close their an­nu­al spend­ing on cy­ber­se­cu­ri­ty nor the costs in­curred due to a suc­cess­ful cy­ber­se­cu­ri­ty at­tack.

How­ev­er, he said EY has worked with or­gan­i­sa­tions that have de­vel­oped ded­i­cat­ed cy­ber­se­cu­ri­ty strate­gies along with clear bud­get al­lo­ca­tions to dri­ve a mul­ti­fac­eted ap­proach to cy­ber­se­cu­ri­ty.

Asked what more needs to be done by the Gov­ern­ment and com­pa­nies to safe­guard da­ta, the cy­ber ex­pert said or­gan­i­sa­tions tra­di­tion­al­ly added tech­nol­o­gy and pri­va­cy safe­guards on­ly in re­sponse to prob­lems, with­out a proac­tive plan that in­cludes their whole tech en­vi­ron­ment and those who use it.

“We are now see­ing more gov­ern­ments in the re­gion in­tro­duce laws that con­trol how per­son­al da­ta is used, push­ing busi­ness­es to­wards tighter da­ta se­cu­ri­ty prac­tices. Bar­ba­dos and Ja­maica, for ex­am­ple, have re­cent­ly put new da­ta pro­tec­tion laws in place. Trinidad is al­so work­ing on its own law, but it is still in the works.”

At the com­pa­ny lev­el, he not­ed pro­tect­ing da­ta means hav­ing a mix of se­cu­ri­ty steps and this in­cludes tech­ni­cal things like en­cryp­tion and con­stant se­cu­ri­ty checks, along with mak­ing sure staff know how cru­cial it is to han­dle sen­si­tive da­ta care­ful­ly . These steps should be part of a larg­er cy­ber­se­cu­ri­ty plan, led by re­spec­tive ex­perts in the or­gan­i­sa­tion

Naipaul high­light­ed to in­cen­tivise lo­cal or­gan­i­sa­tions, the T&T Gov­ern­ment is en­cour­ag­ing com­pa­nies to in­vest fur­ther in cy­ber­se­cu­ri­ty so­lu­tions by grant­i­ng a Cy­ber­se­cu­ri­ty Tax In­vest­ment Al­lowance (af­fec­tion­ate­ly termed “CI­TA”) of up to TT$500,000 for ex­pen­di­tures re­lat­ed to in­vest­ments in cy­ber­se­cu­ri­ty soft­ware and net­work se­cu­ri­ty mon­i­tor­ing equip­ment.

“This is avail­able to all lo­cal or­gan­i­sa­tions and ap­plic­a­ble with­in the pe­ri­od Jan­u­ary 1, 2024, to De­cem­ber 31, 2025. This will fur­ther en­cour­age in­vest­ments in stronger tech­ni­cal pro­tec­tion mea­sures in the short and medi­um term.”

How to pro­tect against breach­es

Last No­vem­ber, ma­jor­i­ty state-owned Telecom­mu­ni­ca­tions Ser­vices of T&T (TSTT) was hit with a ran­somware at­tack which led to the breach of thou­sands of cus­tomers’ da­ta in­clud­ing that of Prime Min­is­ter Dr Kei­th Row­ley. When asked how com­pa­nies can en­sure it does not fall prey to hack­ers, Naipaul stat­ed there have been sim­i­lar cy­ber­se­cu­ri­ty chal­lenges seen across the Caribbean.

“No­tably, there has been a con­sis­tent uptick in phish­ing—cy­ber-at­tacks where peo­ple are de­ceived in­to dis­clos­ing sen­si­tive in­for­ma­tion or ex­e­cut­ing harm­ful ac­tions, of­ten through de­cep­tive emails. In 2023 alone, TTC­SIRT re­port­ed 18 phish­ing at­tacks that suc­cess­ful­ly breached sys­tems. We have seen cas­es where front-line staff have re­ceived emails from at­tack­ers prompt­ing them to open at­tached doc­u­ments where­by, up­on open­ing, spe­cial­ly craft­ed mal­ware is trig­gered. This re­sult­ed in ran­somware be­ing in­stalled on their sys­tem and spread au­tonomous­ly to key sys­tems with­in the or­gan­i­sa­tion’s net­work with­in a mat­ter of min­utes,” Naipaul de­tailed.

Ad­di­tion­al­ly, as com­pa­nies con­tin­ue to grow, the cy­ber ex­pert point­ed out that they are not ad­e­quate­ly scal­ing their se­cu­ri­ty mea­sures to ad­dress the emerg­ing risks that come with the adop­tion of new tech­nolo­gies. For ex­am­ple, he said lo­cal com­pa­nies are in­creas­ing­ly us­ing cloud plat­forms to store com­pa­ny and in­di­vid­ual in­for­ma­tion. How­ev­er, in some cas­es the com­po­nents that the com­pa­ny is in con­trol of are not ap­pro­pri­ate­ly con­fig­ured, al­low­ing cy­ber at­tack­ers or ‘hack­ers’ to eas­i­ly find and ex­ploit weak­ness­es. This re­sults in a sys­tem com­pro­mise which se­vere­ly dam­ages the com­pa­ny’s rep­u­ta­tion and ul­ti­mate­ly in­curs fi­nan­cial loss­es.

“TTC­SIRT da­ta in­di­cates 47 sys­tem com­pro­mis­es and da­ta breach­es af­fect­ed var­i­ous sec­tors from 2019 to 2023, and un­re­port­ed cas­es would like­ly in­crease this fig­ure.”

Naipaul ad­vised that or­gan­i­sa­tions should im­ple­ment ed­u­ca­tion­al ini­tia­tives de­signed to teach about the risks as­so­ci­at­ed with dig­i­tal ac­tiv­i­ties and the best prac­tices for safe­guard­ing against cy­ber threats, as these should aim to pro­mote the un­der­stand­ing of com­mon cy­ber risks like phish­ing, mal­ware, and da­ta breach­es, and to teach be­hav­iors that con­tribute to a se­cure on­line en­vi­ron­ment.

Al­so, he said or­gan­i­sa­tions should con­sid­er their wider tech­nol­o­gy ecosys­tem and im­ple­ment strong tech­ni­cal con­trols to hard­en their de­fens­es and re­duce the like­li­hood of suc­cess­ful cy­ber-at­tacks.

“Should an at­tack be suc­cess­ful, an or­gan­i­sa­tion should have a strong cy­ber-in­ci­dent re­sponse plan that will en­able them to quick­ly and ap­pro­pri­ate­ly re­spond to a cy­ber in­ci­dent and re­cov­er with­in a rea­son­able pe­ri­od whilst keep­ing all rel­e­vant stake­hold­ers in­formed,” he men­tioned.

Emails an easy tar­get

On why emails rep­re­sent a ma­jor cy­ber­se­cu­ri­ty con­cern due to their role, Naipaul said this is due to emails be­ing used for both per­son­al and pro­fes­sion­al com­mu­ni­ca­tion, mak­ing them a pop­u­lar tar­get for hack­ers.

“Through so­cial en­gi­neer­ing tac­tics like phish­ing, at­tack­ers trick re­cip­i­ents in­to di­vulging sen­si­tive in­for­ma­tion or un­know­ing­ly in­stalling mal­ware via links or at­tach­ments con­tained in seem­ing­ly harm­less emails.”

“In many or­gan­i­sa­tions, in­clud­ing those in Trinidad, emails serve as a key mech­a­nism for shar­ing con­fi­den­tial in­for­ma­tion (such as per­son­al and fi­nan­cial da­ta) and for fa­cil­i­tat­ing im­por­tant busi­ness de­ci­sions be­fore they be­come of­fi­cial com­pa­ny records. Unau­tho­rised ac­cess to email com­mu­ni­ca­tions can lead to da­ta breach­es, where sen­si­tive de­tails are ex­ploit­ed for ma­li­cious pur­pos­es,” Naipaul em­pha­sised.

“Such sta­tis­tics high­light the emerg­ing trend of in­creas­ing cy­ber­at­tacks year on year, po­si­tion­ing the Caribbean, in­clud­ing Trinidad, as a grow­ing tar­get for cy­ber­crim­i­nals. This up­ward trend em­pha­sis­es the ur­gent need for height­ened cy­ber­se­cu­ri­ty aware­ness and ro­bust pro­tec­tive mea­sures across both the pub­lic and pri­vate sec­tors in the re­gion, he added.