{"id":3561,"date":"2012-03-30T06:33:58","date_gmt":"2012-03-30T11:33:58","guid":{"rendered":"http:\/\/www.ict-pulse.com\/?p=3561"},"modified":"2013-04-18T22:11:17","modified_gmt":"2013-04-19T03:11:17","slug":"expert-insights-3-cyber-threats-and-security-in-the-caribbean","status":"publish","type":"post","link":"https:\/\/ict-pulse.com\/2012\/03\/expert-insights-3-cyber-threats-and-security-in-the-caribbean\/","title":{"rendered":"Expert insights 3: Cyber threats and security in the Caribbean"},"content":{"rendered":"

Aaron Manzano, of HMP Consulting in Trinidad and Tobago, and a IT\/network security expert,<\/em>\u00a0continues our Q&A series on cyber security in the region.<\/em><\/p>\n

<\/em>The only truly secure system is one that the development process is controlled from the beginning, located in at a site with a harden bunker deep underground, with no communications links to the outside and all informed and aware of its existence are terminated to prevent leaks as the site is nuked.<\/p><\/blockquote>\n
$\"\"$ <\/a>The above quote is a paraphrase of our guest expert\u2019s recollection of views expressed in the \u201cOrange Book\u201d \u2013 the US Department of Defense Trusted Computer System Evaluation Criteria \u2013 and is precisely the reason why network security is so critical. Our networks exist in an imperfect world, where we cannot control all the factors the quote suggest are necessary to create a truly secure system.<\/p>\n
In this the third in our expert series, we discuss cyber security in Trinidad and Tobago\u00a0with\u00a0Aaron Manzano, an IT\/network security professional with over 30 years\u2019 experience in the field. Aaron\u2019s specialties include IT Operations and Management, Network Design and Implementation, Information and Network Security, and Systems Development and General Management, and over the last seven years, he has been the Director of HMP Consulting, and is based \u00a0in Trinidad and Tobago.<\/p>\n
ICT Pulse:\u00a0 Hi Aaron, how prevalent do you think cyber intrusions are in Trinidad and Tobago, and in the wider Caribbean? By chance, do you access to data?<\/strong><\/p>\n
Aaron Manzano: The level of cyber intrusion in Trinidad and Tobago is unknown as organizations aren\u2019t required to submit any incident reports or even acknowledge its existence. In particular, this is a touchy subject for Media Houses, Financial Institutions and Governments who guarded about releasing such data.<\/p>\n
Based on our investigations, many networks in Trinidad and Tobago are attacked regularly.\u00a0 As indicated, the level of intrusion success is unknown; however we continue to observe constant intrusion attempts, with China, Hong Kong and Russia topping the list.<\/p>\n
It my belief this is situation is not only prevalent Trinidad and Tobago but is also the case in the wider the Caribbean.<\/p>\n
ICTP:\u00a0 Based on your experience, what are some of the common misconceptions that organisations have about network security?<\/strong><\/p>\n
AM:\u00a0 These are many, so I will just reference a few:<\/p>\n
\n
\u201cHaving a Firewall and Antivirus is enough.\u201d\u00a0 Unfortunately, that is the starting point.<\/li>\n
Management total lack of understanding\/appreciation of the issues at hand.<\/li>\n
$\"\"$ <\/a>People\u2019s idea that: \u201cPatching Microsoft Windows will break my app\u201d. Not patching my O\/S and Applications (Microsoft Windows, Linux or whatever you use) is the same as leaving the keys in the door.\u00a0 Someone eventually can or will walk in and make themselves at home and you won\u2019t know until it\u2019s too late.<\/li>\n
Configuration Management: Not having an inventory of your Hardware and Software Resources and establishing Access Controls based on Ownership, Responsibility and Functions; which is like your friend parking the car in your yard, the car he borrowed, the same car that was rented yesterday to his cousin.<\/li>\n
Depending in vendors and products to keep you safe.\u00a0 Information security is a discipline and a practice based on a constant effort to stay informed and having a process that addresses risks against business needs.\u00a0 This emphasis is lacking even within organizations that should know better.<\/li>\n
Leaving systems with defaults or obvious settings, controls or passwords on the assumption that we will get to it later.<\/li>\n
Not evaluating your service providers.<\/li>\n
Limited employee education regarding policies (if they exist), security compliancy and what to do if they are victims.<\/li>\n<\/ul>\n
ICTP:\u00a0 In your capacity as an Internet Security Strategist, what are three key questions businesses should ask themselves when assessing the secureness of their networks?<\/strong><\/p>\n
AM:\u00a0 1. \u00a0What do I need to protect?<\/p>\n
2.\u00a0 Whom am I protecting it from?<\/p>\n
3.\u00a0 What would be the business impact should there be a breach whether it occurs internally or externally?<\/p>\n
ICTP:\u00a0 Are any trends you have observed, or have been reported, regarding threats\/intrusions in Trinidad and Tobago, or in the region?<\/strong><\/p>\n
$\"\"$ <\/a>AM:\u00a0 I think the biggest trend we are observing is the presence of Command and Control BOT, Attempted Domain Hijacks and Fake Antivirus.\u00a0 Other than that, constant port scans.\u00a0 The organization with the smallest footprint fares best, but are not immune.<\/p>\n
The trend that is worrying is the uncontrolled deployment of mobile devices.\u00a0 Most organizations are allowing staff to bring and use their personal devices without a clear policy of use and responsibility of data.<\/p>\n
$\"\"$ <\/a><\/p>\n
ICTP:\u00a0 What resources and\/or support structures currently exist in Trinidad and Tobago (e.g. legislation, special interest groups, agencies, etc.) to address cyber security?<\/strong><\/p>\n
AM:\u00a0 It is difficult to answer this question fairly as there are initiatives to promote safe, responsible and legal use of Information Technology in Trinidad and Tobago.\u00a0 Moreover, it is like a preacher preaching to the converted.\u00a0 Many are hearing but hardly any are listening.\u00a0 Special Interest Groups that exist tend to be full of techies most not focused on the business issues.\u00a0 We need more Executive Management involvement and the willingness of those executives to share.<\/p>\n
On the legal side, our Parliament has drafts that keep going back for review, which is delaying any legal leverage for business accountability.<\/p>\n
ICTP:\u00a0 Finally, what do you believe should be the next steps in Trinidad and Tobago, and\/or in the wider Caribbean, to move national (and\/or regional efforts) on cyber security in the right direction?<\/strong><\/p>\n
AM:\u00a0 I have always believed that the Central Banks of the region should get together to drive these initiatives.\u00a0 They are best placed to advise governments and businesses.\u00a0 Also, they are well connected with similar agencies outside of the region where they already share information and best practices.\u00a0 Things I would like to see the Central Banks do are as follows:<\/p>\n
\n
$\"\"$ <\/a>Establish and manage a Root CA for CARICOM.\u00a0 This can be hosted in Jamaica or Barbados as they are better prepared for natural disasters.<\/li>\n
Establish Education and Compliance Guidelines for Cyber Security and monitor it.<\/li>\n
Establish a committee (I don\u2019t like committees) of business and government stakeholders to share knowledge and strategy.<\/li>\n<\/ul>\n
Do you have any questions for\u00a0<\/em><\/strong>Aaron, or views you would like to share? Please do so in the Comments area below.<\/em><\/strong><\/p>\n
Looking forward to your feedback!<\/em><\/strong><\/p>\n
<\/p>\n
Image: Victor Habbick<\/a> \/ FreeDigitalPhotos.net<\/em><\/p>\n
____________<\/p>\n","protected":false},"excerpt":{"rendered":"
Aaron Manzano, of HMP Consulting in Trinidad and Tobago, and a IT\/network security expert,\u00a0continues our Q&A series on cyber security in the region. The only truly secure system is one […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","om_disable_all_campaigns":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[82,17,27,11],"tags":[71,105,38,39,207,32,43],"class_list":["post-3561","post","type-post","status-publish","format-standard","hentry","category-business","category-caribbean","category-computing","category-ict-tech","tag-businesses","tag-cybercrimecybersecurity","tag-data-protection","tag-equipment-security","tag-expert-insights-series","tag-information-society","tag-internet-governance","et-doesnt-have-format-content","et_post_format-et-post-format-standard"],"jetpack_publicize_connections":[],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2iE1G-Vr","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/comments?post=3561"}],"version-history":[{"count":21,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3561\/revisions"}],"predecessor-version":[{"id":3589,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/posts\/3561\/revisions\/3589"}],"wp:attachment":[{"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/media?parent=3561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/categories?post=3561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ict-pulse.com\/wp-json\/wp\/v2\/tags?post=3561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}