{"id":97458,"date":"2017-04-19T08:07:17","date_gmt":"2017-04-19T13:07:17","guid":{"rendered":"http:\/\/www.ict-pulse.com\/?p=97458"},"modified":"2017-04-19T08:07:17","modified_gmt":"2017-04-19T13:07:17","slug":"expert-insights-3-cyber-threats-security-caribbean-2017-update","status":"publish","type":"post","link":"https:\/\/ict-pulse.com\/2017\/04\/expert-insights-3-cyber-threats-security-caribbean-2017-update\/","title":{"rendered":"Expert insights 3: Cyber threats and security in the Caribbean 2017 update"},"content":{"rendered":"

Our 2017 Expert Insight series on cybersecurity in the Caribbean\u00a0continues – the third in this year’s series \u2013\u00a0\u00a0with Sean Slattery, a network\/IT security professional based in the Cayman Islands.<\/em><\/span><\/p>\n

 <\/p>\n

Sean Slattery is founder and CTO of Caribbean Solutions Lab – a cybersecurity service provider that helps businesses throughout the Caribbean and North America to defend and protect themselves from cyber threats. Based in Cayman for nearly 20 years, Sean has spent the last nine years focused purely on cybersecurity, holds a US Government Secret security clearance, is an FBI Infragard member and regularly delivers cybersecurity presentations. Sean was also a McAfee instructor for five years.<\/span><\/p>\n

ICT Pulse: \u00a0 Sean, give us a quick recap of what have been the most prevalent types of incidents in \u00a0the Cayman Islands and\/or in the Caribbean region over the past year or so? How has the threat landscape changed?<\/strong><\/p>\n

\"\"Sean Slattery: \u00a0<\/strong>Ransomware is still the most well known and headline-making malware threat. While phishing remains the preferred delivery method, we have also seen a noticeable increase in mobile based and targeted threats. With respect to phishing and mobile threats, the bad guys are definitely improving their skills notably in language. It is now rare to receive an email in broken english. The messages and sites are well crafted, very targeted and nearly indiscernible from a legitimate one. Consistent user training, security awareness and developing a distrust for the Internet communications remain the best countermeasures. The latter being the most difficult for the Caribbean as we are inherently quite trusting due to our smaller communities. The targeting of financial institutions continues to be popular in the cybercrime playbook. Many in the Caribbean believe that we aren\u2019t targeted. I have first-hand evidence that we are indeed targeted. Also, we have been able to compare data with our US and European peers and see that regional activity, campaigns and attacks match theirs. Not only are we targeted but we are also enjoy the benefits of being associated with the larger jurisdictions. In the end, a bank account, credential, computer is valuable to cybercriminals regardless of location. The Internet is a great leveler in that regard.<\/span><\/p>\n

ICTP: \u00a0Over the past year, ransomware incidents appeared to have been quite plentiful across the region. Are they still as huge a threat?<\/strong><\/p>\n

SS: \u00a0<\/strong>Yes, ransomware is still quite prevalent, simply because it works. The reality is that ransomware pays very well – an estimated $1 billion and 400 new variants in 2016 alone. Understand that cybercrime is a business, a big business in fact. If no one paid the ransoms the business model would fail. Clearly people are paying the ransoms. <\/span><\/p>\n

ICTP: \u00a0What are some of the new and emerging threats of which we should be more aware? And are there any particular areas of concern that you have for Caribbean organisations?<\/b><\/p>\n

SS: \u00a0<\/strong>There is a natural evolution to the industry. As the saying goes, when you build better mousetraps, you will get smarter mice – wash, rinse and repeat. In addition to the improving existing techniques, a few things come to mind. Fileless malware is a particularly interesting threat. This type runs completely in memory and leaves virtually no trace for a traditional antivirus to detect and action. firmware attacks. We are also seeing improved automation used by cybercriminals to generate malware. Let\u2019s not go into the nuances of AI (Artificial Intelligence), mathematical modeling and machine learning but suffice it to say, that the bad guys are taking a page out of our own playbooks and using it against us. Another emerging type threat, on our radar, is based in firmware. We\u2019re referring to the software that sits inside of the hardware chips that run our computers, home audio\/visual equipment, cars, etc – the Internet of Things – IoT. Face it, everything is or has a computer now. Being able to validate, prove and continuously monitor the integrity of that new server, firewall or router you purchased is increasingly important. <\/span><\/p>\n

ICTP: \u00a0At the CARICOM\/regional level, there has been a growing awareness of cybercrime and cybersecurity, and calls by leaders for something be done. In your opinion, has there been any improvement in the cybersecurity-associated resources or support structures in the Cayman Islands, and\/or perhaps regionally? What might still be missing? <\/b><\/p>\n

SS: \u00a0<\/strong>I agree that regional awareness is improving but is only part of the battle. An impacted business\u2019 customers will care more about action than awareness. Locally, the Cayman Islands government has embraced cybersecurity and is driving adoption of the NIST framework from the top down. We continue to have success with a threat sharing network of local organizations. When a member is targeted or experiences a threat, pertinent information is quickly shared to the benefit of others not yet targeted or impacted. In a way, the more the group is targeted the safer it becomes. The biggest challenge we see with organizations is the propensity to consider cybersecurity an IT problem. Cybersecurity is a business problem that affects the board, shareholders, legal, compliance, HR to name a few non-IT areas. Only a handful of organizations have recognized this and taken action by establishing cybersecurity departments or teams. From a technical perspective, a cybersecurity group or team needs to include endpoint (desktop\/server), network, and application stakeholders. Often these might actually be outsourced positions or fulfilled by service providers and that is OK too. <\/span><\/p>\n

ICTP: \u00a0Does it even make sense for small companies to send their network administrators to security training courses when security is not their full-time job, and given the pace at which the security landscape is changing? Or should such companies just accept the fact that they need to outsource this function? <\/b><\/p>\n

SS: \u00a0<\/strong>Where possible, SMB\u2019s should definitely invest in cybersecurity training for their staff. There are many affordable online or computer based training resources. It should be a matter of HR policy to conduct annual security awareness training for all staff. Outsourcing can be a bad word for small businesses. Supplementing security from, partnering or teaming with a cybersecurity provider can be a more palatable term! Seeking help or external expertise is not a sign of weakness. It is actually a sign of maturity. Organizations should seek to work with cybersecurity providers or IT providers with dedicated cybersecurity teams. Simply outsourcing security to an all-purpose IT provider is insufficient – jack of all trades, master of none.s with any physical skills, mental skills must be regularly practiced or risk atrophy. Cybersecurity is no different in the context of general IT.<\/span><\/p>\n

ICTP: \u00a0Do you agree that user naivet\u00e9 is the number one security threat facing organisations? If not, what do you think is the most significant threat? <\/b><\/p>\n

SS: \u00a0<\/strong>User naivete is certainly a major factor but a larger issue is business naivete, particularly at senior\/board levels. In addition to the previously mentioned notion of security being an IT problem, users including board-level ones often fail to recognize the importance of cybersecurity to the business. A user only has to not receive their pay following a ransomware attack they inadvertantly caused by opening a file to recognize the business impact. Another area of significant naivete is the outdated notion that having a firewall, antivirus, web and email security systems is sufficient. You can be sure that in every headlining breach or attack, every one of those organizations had those tools in place, and yet they were still impacted. Insanity is doing the same thing over and over and expecting a different result. Please let\u2019s stop the insanity!<\/span><\/p>\n

ICTP: \u00a0Should any organisation still be using tapes for data backup purposes?<\/b><\/p>\n

SS: \u00a0<\/strong>Great question and yes! With technology advances in hard drive and cloud-based storage, it is easy to overlook the value of offline backups – tapes still being the most cost effective. Tapes are easy to transport, offer high capacities and \u00a0difficult to infect with malware such as ransomware. Do not forget to regularly test your backup systems! In the words of Andrew Tanenbaum, \u201cNever underestimate the bandwidth of a station wagon full of tapes hurtling down the freeway.\u201d Sometimes sending a few terabytes of tapes by FedEx is more efficient than sending that same data across the network or Internet. Disaster recovery and business continuity do not change in response to the event. That event might be a hurricane, plumbing leak, disgruntled employee or major ransomware attack. Online or near-line backups are great tools but you can never have too many copies of your critical data. Do not forget to regularly test your recovery procedures. In the Caribbean, we are used to practicing for hurricane season, but the more often this is practiced the faster the recovery process will run in the event of an actual disaster. In general, I recommend that all organizations be able to recover minimal core functions within 24 hours and secondary functions within 48 hours.<\/span><\/p>\n

ICTP: \u00a0And finally, what are the top three (3) things businesses should be doing this year to improve your network\/IT security?<\/b><\/p>\n

SS: \u00a0<\/strong>Hmm, picking just three is tough! Let\u2019s go beyond the usual angles of board-level\/business awareness, establishing policy and user training.<\/span><\/p>\n

First, let\u2019s accept that every organization will suffer a breach or significant cybersecurity event sooner or later. Short of gross negligence it isn\u2019t going to be anyone\u2019s fault – it just is. As a potential customer of said organization, I accept that. However, I would want assurance that the event was quickly detected, contained and mitigated. It is paramount to learn from the event to help prevent a similar recurrence. Ensuring cybersecurity staff\/groups\/teams are regularly informed and stay abreast of the industry trends is the key here.<\/span><\/p>\n

Second, let\u2019s finally accept that firewalls, antivirus, web and email systems are insufficient. Firewalls and antivirus were invented over 25 years ago to address problems from 25 years ago. Just as we cannot expect a delivery service today to run on horse and carriage, we cannot expect yesterday\u2019s tools to protect against tomorrow\u2019s or even today\u2019s threats. Organizations should look to invest in complementary and advanced tools that not only provide additional layers of security but can do so in a way that is easy to use and can even save time. Look for terms like AI, machine learning, and mathematics. This can be endpoint, network or even cloud based. Partnering with a cybersecurity service provider for these tools is also beneficial due to the potential for threat sharing.<\/span><\/p>\n

Third, organizations should seek local and regional networking opportunities for cybersecurity. This can be at levels such as board members developing policies or technical level for security staff to interact with peers. Perhaps the most important networking aspect is for threat sharing. Obviously most organizations cannot disclose details about a breach or tools employed, but there is a middle ground somewhere. This is often through a trusted third party such as common cybersecurity provider. It may be simply a matter of allowing the transmission of a new malware file or phishing email\/url. To more people know about a threat, the better the chances of prevention. An ounce of prevention is worth a pound of cure.<\/span><\/p>\n

Lastly, I will leave readers with a few bullet points that can help guide them. An organization that can accurately and consistently answer the following questions will be in a very good position to address cybersecurity issues and concerns.<\/span><\/p>\n