Raphael John-Lall

A ma­jor cy­ber­se­cu­ri­ty vul­ner­a­bil­i­ty af­fect­ing soft­ware used by a large pro­por­tion of the world’s web­sites has high­light­ed how busi­ness­es can re­main ex­posed to threats they may not even know ex­ist, ac­cord­ing to Dr Ronald Wal­cott, man­ag­ing di­rec­tor of Pre­ci­sion Cy­ber Tech­nolo­gies and Dig­i­tal So­lu­tions Ltd (PCDS).

Wal­cott told the Busi­ness Guardian that the in­ci­dent in­volv­ing PHP, a pro­gram­ming lan­guage used to pow­er web­sites and on­line ap­pli­ca­tions, demon­strat­ed the need for greater cy­ber­se­cu­ri­ty aware­ness, in­clud­ing among busi­ness­es that may be­lieve their dig­i­tal sys­tems are ad­e­quate­ly pro­tect­ed.

Last week, BBC, CNN and oth­er in­ter­na­tion­al me­dia out­lets re­port­ed that web­sites around the globe went dark af­ter a se­ri­ous vul­ner­a­bil­i­ty was found in a com­put­er lan­guage used to build much of the world wide web.

“The PHP is­sue that hap­pened glob­al­ly, that af­fect­ed close to 75 per cent of the world’s in­ter­net, Word­Press, Face­book, Wikipedia, all of them were af­fect­ed, was not known. So even glob­al­ly, some­thing as fun­da­men­tal as that was not known,” he said.

Wal­cott’s in­ter­view with the Busi­ness Guardian was a fol­low up to the PCDS’s three-day con­fer­ence, “Cy­ber Re­silience, the Busi­ness Ex­pe­ri­ence”, held from Oc­to­ber 21 to 23 at the Trinidad and To­ba­go Cham­ber of In­dus­try and Com­merce in West­moor­ings.

The event at­tract­ed be­tween 80 and 100 par­tic­i­pants dai­ly and fo­cused on prac­ti­cal ways busi­ness­es could strength­en their abil­i­ty to with­stand cy­ber­at­tacks, main­tain op­er­a­tions and re­cov­er from in­ci­dents.

Ac­cord­ing to Wal­cott, a for­mer CEO of ma­jor­i­ty state-owned TSTT, PCDS pro­vides cy­ber­se­cu­ri­ty and dig­i­tal so­lu­tions and rep­re­sents more than 100 brands, with ac­cess to more than 200 in­ter­na­tion­al en­gi­neers. Wal­cott said the com­pa­ny had al­so part­nered with the In­ter-Amer­i­can De­vel­op­ment Bank and the Uni­ver­si­ty of the West In­dies to de­vel­op cy­ber­se­cu­ri­ty lab­o­ra­to­ries, with the aim of build­ing lo­cal and re­gion­al skills and ex­per­tise.

The com­pa­ny plans to hold the con­fer­ence an­nu­al­ly, with Ar­ti­fi­cial In­tel­li­gence among the pos­si­ble themes for next year’s event.

Cy­ber­at­tacks are grow­ing

Wal­cott al­so warned about the grow­ing dan­gers of this trend.

“Cy­ber­at­tacks are at an all-time high and they’re ac­tu­al­ly be­com­ing much more preva­lent.”

He said the grow­ing in­ter­con­nect­ed­ness of the world, while sup­port­ing dig­i­tal trans­for­ma­tion, eco­nom­ic ex­pan­sion and cross-bor­der busi­ness, al­so ex­posed or­gan­i­sa­tions to glob­al cy­ber threats.

Wal­cott ad­vised the busi­ness com­mu­ni­ty that cy­ber­se­cu­ri­ty could no longer be treat­ed as an is­sue con­fined to in­for­ma­tion tech­nol­o­gy de­part­ments, giv­en the in­creas­ing de­pen­dence of busi­ness­es and pub­lic ser­vices on dig­i­tal sys­tems.

“When we say cy­ber­se­cu­ri­ty, these were pro­tect­ing as­sets, which is very im­por­tant. But cy­ber re­silience says, even if I was to sus­tain a sig­nif­i­cant at­tack to­mor­row, a ran­somware at­tack, some type of DDoS at­tack or some oth­er busi­ness email com­pro­mise, etc., can I still func­tion? Can I still op­er­ate, pro­vide cus­tomer ser­vice and re­cov­er?”

He ar­gued that cy­ber in­ci­dents could af­fect busi­ness op­er­a­tions, health­care and gov­ern­ment ser­vices, with con­se­quences ex­tend­ing be­yond the sys­tems di­rect­ly tar­get­ed. As more trans­ac­tions move on­line, or­gan­i­sa­tions face in­creas­ing pres­sure to en­sure that their sys­tems re­main se­cure and that es­sen­tial ser­vices can con­tin­ue dur­ing dis­rup­tions.

Wal­cott said busi­ness­es should be­gin by un­der­stand­ing their ex­po­sure and as­sess­ing the po­ten­tial con­se­quences of an at­tack be­fore de­cid­ing how much risk they were pre­pared to ac­cept.

“What we ask peo­ple to do, first of all, is un­der­stand your busi­ness risk. This is an­oth­er busi­ness risk. Now, you may de­cide to take on the risk, which is fine. That’s a busi­ness de­ci­sion,” he said.

He added that cy­ber­at­tacks have al­ways been preva­lent in T&T and the wider Caribbean, but their ex­tent could be dif­fi­cult to es­tab­lish be­cause or­gan­i­sa­tions gen­er­al­ly did not dis­close in­ci­dents.

“It’s just that there are no man­dates that says that you must dis­close. So, peo­ple gen­er­al­ly don’t. But the fact is that there are more cy­ber­at­tacks hap­pen­ing now than you might think,” he said.

Se­cu­ri­ty is not ex­pen­sive

Wal­cott said busi­ness­es could be­gin im­prov­ing their cy­ber­se­cu­ri­ty through rel­a­tive­ly straight­for­ward mea­sures, chal­leng­ing the per­cep­tion that ef­fec­tive pro­tec­tion nec­es­sar­i­ly re­quired sub­stan­tial fi­nan­cial in­vest­ment.

He point­ed to ba­sic cy­ber hy­giene, in­clud­ing re­li­able back­ups, staff train­ing, aware­ness cam­paigns and cri­sis sim­u­la­tions, as prac­ti­cal start­ing points.

“There are a lot of cy­ber hy­giene things that you can do that are not very cost­ly. So, peo­ple al­ways think about cy­ber­se­cu­ri­ty and cy­ber re­silience as a cost,” he said.

He added, “The truth is, for ex­am­ple, a lot of busi­ness­es have li­cences that have cy­ber­se­cu­ri­ty fea­tures that are not en­abled. And you could find that cy­ber train­ing, aware­ness cam­paigns, cri­sis sim­u­la­tion, table­top ex­er­cis­es, these are all sim­ple things that a busi­ness can do that re­al­ly doesn’t cost you any­thing re­al­ly.”

Wal­cott said re­li­able back­ups could make a sig­nif­i­cant dif­fer­ence in de­ter­min­ing whether an or­gan­i­sa­tion could re­cov­er af­ter an at­tack, while train­ing em­ploy­ees and re­hears­ing re­spons­es to a cri­sis could help busi­ness­es pre­pare be­fore in­ci­dents oc­curred.

Wal­cott al­so said the ob­jec­tive was to help busi­ness lead­ers un­der­stand the chang­ing dig­i­tal en­vi­ron­ment and adopt ap­pro­pri­ate prac­tices.

“It’s not about fear-mon­ger­ing. It’s just about un­der­stand­ing the en­vi­ron­ment that we’re in, and be­ing able to ad­e­quate­ly pre­pare and pre­serve your busi­ness op­er­a­tions, which for the most part, as I said be­fore, could be done ini­tial­ly with some sim­ple hy­giene fac­tors.”

Tech­nol­o­gy for busi­ness ex­ec­u­tives

Cy­ber­se­cu­ri­ty pro­fes­sion­als must learn to trans­late tech­ni­cal risks in­to busi­ness costs if they are to con­vince com­pa­ny ex­ec­u­tives to al­lo­cate re­sources to pro­tect­ing their or­gan­i­sa­tions, ac­cord­ing to Shi­va Bisses­sar, man­ag­ing di­rec­tor of Pina­ka Con­sult­ing Ltd.

Bisses­sar, who spoke at one of the pan­els at the cy­ber­se­cu­ri­ty con­fer­ence, told the Busi­ness Guardian that ex­ec­u­tives need­ed greater aware­ness of cy­ber­se­cu­ri­ty threats be­cause they con­trolled bud­gets and made de­ci­sions about how re­sources were al­lo­cat­ed. How­ev­er, he sug­gest­ed that tech­ni­cal dis­cus­sions could make it dif­fi­cult for busi­ness lead­ers to ap­pre­ci­ate the im­pli­ca­tions of cy­ber risks.

Bisses­sar said the au­di­ence recog­nised the need for more en­gage­ment with busi­ness ex­ec­u­tives.

He said one sug­ges­tion was for cy­ber­se­cu­ri­ty pro­fes­sion­als to take a bot­tom-up ap­proach by com­mu­ni­cat­ing the im­por­tance of cy­ber re­silience to se­nior man­age­ment, rather than wait­ing for ex­ec­u­tives to ini­ti­ate dis­cus­sions.

Bisses­sar said tech­ni­cal pro­fes­sion­als al­so need­ed to adapt how they com­mu­ni­cat­ed with busi­ness lead­ers, fo­cus­ing on the op­er­a­tional and fi­nan­cial con­se­quences of cy­ber in­ci­dents rather than tech­ni­cal de­tails alone.

“You have to adapt the lan­guage of the ses­sion to fa­cil­i­tate the ex­ec­u­tives,” he said.

Bisses­sar added that cy­ber­se­cu­ri­ty spe­cial­ists need­ed to move be­yond tech­ni­cal mea­sure­ments, such as the num­ber of soft­ware patch­es that had to be ap­plied, and ex­plain how vul­ner­a­bil­i­ties could af­fect busi­ness op­er­a­tions and prof­itabil­i­ty.

He said ex­ec­u­tives were more like­ly to un­der­stand the sig­nif­i­cance of an in­ci­dent when its po­ten­tial im­pact was ex­pressed in terms of down­time and the as­so­ci­at­ed fi­nan­cial costs.

“So, you speak to them about down­time, and then you trans­late that down­time in­to what is the cost of that down­time.”

He ar­gued that this abil­i­ty to move be­tween tech­ni­cal and busi­ness per­spec­tives was es­sen­tial for pro­fes­sion­als seek­ing to se­cure the re­sources re­quired to strength­en their or­gan­i­sa­tions’ cy­ber re­silience.

Bisses­sar al­so sug­gest­ed that Ar­ti­fi­cial In­tel­li­gence could help tech­ni­cal pro­fes­sion­als de­vel­op this ca­pac­i­ty, par­tic­u­lar­ly those who need­ed to com­mu­ni­cate com­plex is­sues in lan­guage that non-tech­ni­cal de­ci­sion-mak­ers could un­der­stand.

Draw­ing on his own ex­pe­ri­ence of us­ing AI to bridge gaps in his tech­ni­cal knowl­edge, he said the tech­nol­o­gy could as­sist pro­fes­sion­als in trans­lat­ing cy­ber­se­cu­ri­ty con­cerns in­to prac­ti­cal busi­ness terms.

The ap­proach, he sug­gest­ed, could help or­gan­i­sa­tions im­prove com­mu­ni­ca­tion be­tween tech­ni­cal teams and se­nior man­age­ment, en­sur­ing that de­ci­sions about cy­ber­se­cu­ri­ty re­flect­ed the po­ten­tial con­se­quences for the wider busi­ness.