{"id":3430,"date":"2012-03-16T06:04:59","date_gmt":"2012-03-16T11:04:59","guid":{"rendered":"http:\/\/www.ict-pulse.com\/?p=3430"},"modified":"2013-04-18T22:11:22","modified_gmt":"2013-04-19T03:11:22","slug":"expert-insights-cyber-threats-and-security-in-the-caribbean","status":"publish","type":"post","link":"https:\/\/ict-pulse.com\/2012\/03\/expert-insights-cyber-threats-and-security-in-the-caribbean\/","title":{"rendered":"Expert insights 1: cyber threats and security in the Caribbean"},"content":{"rendered":"

This is the first in our series seeking insight from network\/IT security professionals across the region on cyber intrusion and security in the Caribbean.<\/em><\/p>\n

About two weeks ago, LIME customers in Barbados experienced some degradation of their broadband service. The cause: \u201ca deliberate attack on the internet infrastructure by an external source\u201d,<\/em> LIME revealed in a press release<\/a>\u00a0issued after systems were well in the process of being restored. As expected, LIME sought reassure customers that the distributed denial-of-service (DDoS) attack\u00a0of their systems…<\/p>\n

\u2026 was not widespread and that our servers have not been compromised.\u00a0 Our firewalls are robust and are configured to international standards. In fact, to guard against these types of attacks we have increased our defences both locally and internationally… (Source: LIME<\/a>)<\/p><\/blockquote>\n

\"http:\/\/www.freedigitalphotos.net\/images\/view_photog.php?photogid=2898\"<\/p>\n

However, appreciating the considerable resources to which a company like LIME has access, and the concerns regularly being expressed that the Caribbean has become a haven for cyber criminals (see Where is Internet Governance going in the region?<\/a><\/em><\/strong>), we in the region might not fully understand the extent to which we are highly susceptible to a broad range of cyber threats and intrusions. Hence ICT Pulse will be asking IT\/network security professional across the region their views on this critical issue.<\/p>\n

To kick off this series, we posed a few questions to Niel Harper. Niel, who is based in Barbados, has over 16 years\u2019 experience in Telecommunications Engineering, Information Security Management, Business Continuity Management, Enterprise Risk Management, and ICT Regulation and Policy. He was worked for organizations such as Cable & Wireless, AT&T, Cingular Wireless and CIBC First Caribbean in the region.<\/p>\n

Should you have questions you would like to pose to Niel, or views you would like to share, please do so in the Comments area below.<\/p>\n

ICT Pulse: How prevalent do you think cyber intrusions are in Barbados, and in the wider Caribbean?<\/strong><\/p>\n

\n

\"\"Niel Harper:\u00a0 Precise figures are hard to provide due to the fact that many companies in Barbados and the wider Caribbean do not report breaches.\u00a0 This can be due to numerous reasons, ranging from the reputation (regulatory consequences and service outages) and financial (share prices hits or revenue decreases) risks associated with the compromise of private information, to the fact that there are no pervasive legislative frameworks which mandate that firms report breaches to government or to their customers.<\/p>\n

However, I would say that approximately 60% of organizations in the region have had at least one security incident over the last 1\u20132 years. This is mainly due to the growth in online data, as well as the increasing sophistication and organization of attackers. Other key factors are poor security practices, insufficient training and support, and the continuing use of unpatched or out-dated software. Comparatively, the statistics for personal users may be even higher given the significantly weaker or non-existent security controls present in many home computing environments.<\/p>\n

ICTP: \u00a0Based on your experience, what are some of the common misconceptions that organisations have about network security?<\/strong><\/p>\n

NH:\u00a0 The most common misconception about network security is that technology alone can provide adequate, effective and sustainable protection for information assets. An effective network security program encompasses people, process and technology. In the context of staffing (people), it is all about how you rationalize your IT security skill requirements to effectively address evolving security threats. This rationalization should allow for the creation of a baseline which characterizes, at a bare minimum, the core competences that IT security practitioners should possess to perform specific roles and responsibilities. These roles should be created, properly staffed and subject to on-going training.<\/p>\n

Aside from security practitioners, end-users should be exposed to education programs which foster awareness of the importance of security, as well as promote constant vigilance to prevent online fraud. From the process standpoint, there should be policies, procedures and guidelines in place which serve to govern the use of information and communication technologies. These processes should be explicit (non-ambiguous), consistent and enforceable. And finally, the technology that exists to prevent, detect and to some degree, correct security attacks is becoming more and more advanced. However, without a focus on people and process to compliment the technology, a firm\u2019s network security posture can be tantamount to having a gate with no sentry.<\/p>\n

ICTP:\u00a0 Are there any hardware and\/or software solutions that you believe might be more effective in addressing cyber intrusions?<\/strong><\/p>\n

NH:\u00a0 I tend not be an advocate of any particular vendor solution or software product, especially given the rampant commoditization in the industry. However, what I will zero in on is the importance of \u2018defence-in-depth\u2019<\/em>. This is in essence the layering of security technologies to provide a more comprehensive array of controls to better protect an organization\u2019s information assets.<\/p>\n

\"http:\/\/www.freedigitalphotos.net\/images\/view_photog.php?photogid=1152\"<\/a>Here is a quick example: The perimeter of a company can be protected by firewalls, which are bolstered with network intrusion detection \/ prevention systems. Internet facing assets such as web servers can be located in a DMZ (demilitarized zone) to prevent access to the internal network if these nodes are compromised. High risk assets (general ledger systems, core banking systems, payroll systems, etc.) can be segmented further by placing them behind internal firewalls with very tight rules which only allow access by a limited number of other services or users.\u00a0Network access control (NAC) or port-based authentication can be instituted to force any device that plugs into the network infrastructure to be authenticated. And other controls can added such as anti-spyware, anti-virus, host-based firewalls, host-based intrusion detection systems and so on, to provide \u2018layers\u2019 of protection which make it more difficult for attackers to access confidential information.<\/p>\n

However, the degree of layers put in place is highly dependent on the value of the information assets to be protected and the capital funding available to purchase these software \/ hardware solutions. One principal tenet to bear in mind is that a control should never cost more than the information asset that it is protecting.<\/p>\n

ICTP: Are there any cyber security-associated resources or support structures you believe are lacking nationally, in Barbados, and\/or perhaps at the regional level?<\/strong><\/p>\n

NH:\u00a0 On the national levels (Barbados included), there is insufficient capacity for cyber security response. When I say insufficient capacity, I am referring primarily at a high-level to the absence of a distinctive authority or institution responsible for cyber security. This means an organization with clear mandates, appropriate funding, trained personnel and the capabilities to address and respond to national security incidents.<\/p>\n

What are also needed are public-private partnerships to facilitate resource sharing and support structures between governments (who have limited funding and inadequate structures) and the private sector (whose capabilities are usually in a more evolved or mature state). And finally, I would also say that technical assistance or international cooperation partnerships are lacking as well. These represent the ways and means for governments to benefit from the funding, training and other means of support available from the international community.<\/p>\n

ICTP: \u00a0To wrap up, is there any one tip you could share that could reduce the risk of cyber intrusion to organisations, or even to the personal user?<\/strong><\/p>\n

NH:\u00a0 I would recommend that organisations, as well as casual users, take steps to classify the information which they store on their computer systems. Information classification is the basis for developing any security regime. It is basically the categorization (e.g. Top Secret, Confidential, Internal, and Public) of the various forms of information which are kept. Each category of data should have an owner; the owner should then determine who is allowed to access the data and what level of protection should be implemented to protect the data set.<\/p>\n

Images:\u00a0chanpipat<\/a>;\u00a0jscreationzs<\/a> \/ FreeDigitalPhotos.net<\/em><\/p>\n

_____________<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

This is the first in our series seeking insight from network\/IT security professionals across the region on cyber intrusion and security in the Caribbean. About two weeks ago, LIME customers […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","om_disable_all_campaigns":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[82,17,27,11],"tags":[71,105,38,39,207,32,43],"class_list":["post-3430","post","type-post","status-publish","format-standard","hentry","category-business","category-caribbean","category-computing","category-ict-tech","tag-businesses","tag-cybercrimecybersecurity","tag-data-protection","tag-equipment-security","tag-expert-insights-series","tag-information-society","tag-internet-governance","et-doesnt-have-format-content","et_post_format-et-post-format-standard"],"jetpack_publicize_connections":[],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2iE1G-Tk","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/comments?post=3430"}],"version-history":[{"count":27,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3430\/revisions"}],"predecessor-version":[{"id":3457,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3430\/revisions\/3457"}],"wp:attachment":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/media?parent=3430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/categories?post=3430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/tags?post=3430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}