Exploring the Future of Cybersecurity

There is another powerful rationale for conducting this focused discussion on cybersecurity at this time. According to Deloitte, in the pre-pandemic era, approximately 20% of cyberattacks employed previously unknown malware or techniques. However, with the onset of the pandemic, this percentage had surged to 35% in that first year. Among the emerging attack methods, some leverage machine learning capabilities to adapt and evade detection. Another concerning trend is the growing complexity of ransomware attacks. Attackers are combining data leakage tactics with ransomware, employing persuasive strategies to coerce victims into paying the ransom.

With innovative models such as malware as-a-service, the cybercriminal economy has been shifting drastically. Seasoned bad actors have commoditised and made their threat capabilities available on criminal marketplaces so that entry-level cyber criminals can easily purchase malware and malware deployment services and in turn sell stolen credentials and data in bulk. This industry practice has massified the number of cyberattacks although the scale and intensity of each attack have shifted as the seasoned criminals have positioned themselves higher up the criminal value chain to avoid detection. Cybercriminal groups have been evolving into organised entities, mirroring legitimate businesses. For example, the Conti criminal group was replete with marketing departments, human resources, and remote staff who might have been oblivious to their involvement in criminal activities.

In our review of cybersecurity preparedness in Latin America and the Caribbean, we focused on three insightful perspectives to assess our region’s cyber capabilities. Among 33 economies in the region, we found that 18 already had national cybersecurity strategic plans in place or were actively developing them. These plans serve as comprehensive, collaborative documents that outline strategic areas for enhancing cyber resilience, responding to cyber threats, promoting cyber awareness, and ensuring legal measures for delivering justice to cybercrime victims. It is paramount that these strategic plans are regularly updated, adequately resourced, and effectively implemented to enable collective cybersecurity efforts. Regarding technical responses to cyber incidents and attacks, a significant majority of countries in the region had established Computer Security Incident Response Teams (CSIRTs). These teams operated at various levels, including national, governmental, military, and sector-specific entities. Additionally, nearly all countries, except for four, had enacted cybercrime legislation. However, it is worth noting that we did not assess the effectiveness of this legislation in terms of the currentness of cybercrime definitions or the adequacy of procedural provisions to facilitate cyber investigations and cross-border cooperation among law enforcement agencies. The snapshot did help us identify important building blocks for cyber resilience at a macro level, which would indeed be required to support anything we do at a corporate level.

At meso and micro levels, our experts stressed the importance of building awareness at multiple levels of organisations and even homes, with a view to engendering a culture of cybersecurity. A culture of cybersecurity refers to a collective mindset and set of practices that prioritise and integrate cybersecurity into various aspects of our lives. It encompasses both corporate practices within organisations and the behaviours and habits that should be fostered in homes and families. In a corporate context, a culture of cybersecurity entails creating an environment where cybersecurity is seen as a shared responsibility among all employees, from top management to frontline staff. It involves promoting awareness, education, and training programmes to ensure that everyone understands the importance of cybersecurity and knows how to identify and respond to potential threats. Furthermore, our experts affirmed that organisations need to establish clear policies and procedures regarding data protection, privacy, and incident response. Encouraging an open and transparent communication culture, where employees feel comfortable reporting security incidents or potential risks, is also essential. At home, fostering a culture of cybersecurity would involve similar principles but with a focus on individual responsibility and family awareness. Parents are expected to educate themselves and their children about online safety, privacy, and the potential risks associated with using digital devices and the Internet. Grandparents should not be left out of the equation, as special attention should be placed on their needs in using digital tools and the Internet.

The interconnected and borderless nature of cybercrime and cybersecurity certainly stood out during the discussion as the experts turned their attention to the issue of cooperation. Cooperation is required on multiple fronts, including creating and nourishing trust communities among technical people with responsibility for security operations, with law enforcement agencies, and across sectors where reputational, operational and legal risks may be exacerbated (banks, for instance). Cooperation must ultimately contemplate fostering cyber confidence-building measures across countries through the use of cyber diplomacy, with the aim of enhancing cross-border cooperation and the predictability of fellow state machinery when attacks happen. With good cyber hygiene and cybersecurity being a collective endeavour, the high-level goals of enhanced cooperation would be to reduce and mitigate the impact of cyber attacks and cybercrimes.

The age-old lesson that remains pertinent since the earliest days of cybersecurity discussions at tech conferences is that the human element—people—must remain at the forefront of even the biggest cybersecurity plans. Our approaches to improving cybersecurity and safeguarding digital assets should be iterative and persistent to keep abreast of and eventually outpace the mutation of cyber risks. In this regard, everyone has a role to play. Cybersecurity is no longer “just” an IT problem.