Bevil Wood­ing

A na­tion's crit­i­cal in­fra­struc­tures in­clude all the as­sets, sys­tems, and func­tions vi­tal to na­tion­al se­cu­ri­ty, eco­nom­ic de­vel­op­ment as well as pub­lic health and safe­ty. Crit­i­cal in­fra­struc­tures en­com­pass ba­sic ne­ces­si­ties such as food, wa­ter, en­er­gy and trans­porta­tion, but al­so bank­ing and fi­nan­cial sys­tems, pub­lic health in­sti­tu­tions, emer­gency ser­vices, postal ser­vices, ship­ping and in­for­ma­tion tech­nol­o­gy and telecom­mu­ni­ca­tions. Sig­nif­i­cant­ly, ALL crit­i­cal na­tion­al in­fra­struc­tures to­day re­ly on com­put­ers and in­for­ma­tion net­works for their ef­fec­tive op­er­a­tion. In­creas­ing­ly, many of the crit­i­cal sys­tems and in­sti­tu­tions are be­ing con­nect­ed to the pub­lic In­ter­net. In­deed, no mod­ern na­tion or busi­ness can tru­ly func­tion with­out in­for­ma­tion tech­nolo­gies. The crit­i­cal in­fra­struc­tures' in­creas­ing re­liance on net­worked sys­tems and the In­ter­net has in­creased the risk of cy­ber-at­tacks that could harm our na­tion's in­fra­struc­tures. Cy­ber­se­cu­ri­ty refers to both the mit­i­ga­tion of and de­fense against at­tacks on in­for­ma­tion tech­nol­o­gy in­fra­struc­ture. Cy­ber­se­cu­ri­ty is a ma­jor con­cern of both the gov­ern­ment, the pri­vate sec­tor.

As busi­ness­es en­gage in glob­al e-com­merce, they need to know how to pro­tect them­selves, their em­ploy­ees, and their cus­tomers against an ar­ray of in­for­ma­tion se­cu­ri­ty risks. En­ter­pris­es want to know that they can safe­ly en­gage in the in­no­v­a­tive de­liv­ery of prod­ucts and ser­vices us­ing com­put­er net­works and In­ter­net-con­nect­ed de­liv­ery chan­nels. As In­ter­net ac­cess im­proves, cy­ber­se­cu­ri­ty is al­so in­creas­ing­ly be­com­ing a point of con­cern in homes. Af­ter all, users of com­put­er sys­tems must be able elec­tron­i­cal­ly cre­ate, ac­cess, process and dis­sem­i­nate in­for­ma­tion se­cure­ly. This re­al­i­ty of our grow­ing de­pen­dence on in­ter­con­nect­ed com­put­er sys­tems makes cy­ber­se­cu­ri­ty a shared re­spon­si­bil­i­ty. Each of us has a role to play in mak­ing com­put­er net­works and sys­tems safer, more se­cure and re­silient. The risks to na­tion­al and eco­nom­ic se­cu­ri­ty as­so­ci­at­ed with the com­pro­mise or fail­ure of a na­tion's cy­ber in­fra­struc­ture as­sets means that their pro­tec­tion re­quires a con­cert­ed pub­lic-pri­vate part­ner­ship. In the re­gion, the Caribbean Telecom­mu­ni­ca­tions Union has placed a fo­cus on cy­ber­se­cu­ri­ty as part of its broad­er In­ter­net gov­er­nance man­date. The or­gan­i­sa­tion is now work­ing close­ly with its mem­ber states, the pri­vate sec­tor and even civ­il so­ci­ety groups to help gov­ern­ments to de­vel­op cy­ber­se­cu­ri­ty plans to pro­tect them­selves, their economies and cit­i­zens.

Re­gion­al gov­ern­ments are slow­ly rec­og­niz­ing that they have to cre­ate an en­abling en­vi­ron­ment for the pro­tec­tion of dig­i­tal as­sets and the pros­e­cu­tion of cy­ber-crime. Be­yond pol­i­cy, coun­tries al­so need the tools to mon­i­tor and eval­u­ate the tech­ni­cal ro­bust­ness and in­tegri­ty of na­tion­al net­works.

Cy­ber se­cu­ri­ty be­yond an­ti-virus

There are many chal­lenges to im­prov­ing cy­ber­se­cu­ri­ty for crit­i­cal in­fra­struc­tures. Ig­no­rance is chief among them. For most or­gan­i­sa­tions, cy­ber­se­cu­ri­ty is large­ly syn­ony­mous with an­ti-virus soft­ware and cor­po­rate fire­walls. These are nec­es­sary el­e­ments of cy­ber­se­cu­ri­ty-much as locks on doors and bur­glar alarm sys­tems are nec­es­sary el­e­ments on phys­i­cal se­cu­ri­ty. How­ev­er, door locks and bur­glar alarms are en­tire­ly in­suf­fi­cient if one is deal­ing with a ter­ror­ist at­tack or for­eign in­va­sion. In the same way, cy­ber­se­cu­ri­ty goes be­yond an­ti-virus and fire­walls, ex­tend­ing to a num­ber of in­fra­struc­tur­al tech­nolo­gies that can be used to bet­ter pro­tect crit­i­cal in­fra­struc­tures from cy­ber at­tacks, in­clud­ing ac­cess con­trol tech­nolo­gies, sys­tem in­tegri­ty tech­nolo­gies, cryp­tog­ra­phy, au­dit and mon­i­tor­ing tools, and con­fig­u­ra­tion man­age­ment and as­sur­ance tech­nolo­gies. Or­gan­i­sa­tions like the Caribbean Net­work Op­er­a­tors Group (CaribNOG) play an im­por­tant role in rais­ing both the aware­ness and tech­ni­cal com­pe­ten­cy of those en­trust­ed with safe­guard­ing our net­works.

CaribNOG is a re­gion­al com­mu­ni­ty of com­put­er net­work ad­min­is­tra­tors and se­cu­ri­ty pro­fes­sion­als "ded­i­cat­ed to ex­chang­ing tech­ni­cal in­for­ma­tion and ex­pe­ri­ences re­lat­ed to the man­age­ment of IP net­works in the Caribbean re­gion." The CaribNOG group is a good ex­am­ple of the large­ly un­known forces that work be­hind the scenes to keep the In­ter­net run­ning in the face of un­pre­dictable, po­ten­tial­ly dev­as­tat­ing threats. For ex­am­ple, on April 1, a ru­moured at­tack on the world's Do­main Name Sys­tem (DNS) servers by a group known as Anony­mous failed to ma­te­ri­al­ize. The threat trig­gered a swift, fast-paced, mul­ti-mil­lion-dol­lar glob­al ef­fort to beef up the Do­main Name Sys­tem.

Among those lead­ing the ef­fort was pack­et clear­ing house, a US-based non-prof­it re­spon­si­ble for de­fend­ing vi­tal pieces of In­ter­net in­fra­struc­ture. The good news is that in­vest­ment in strength­en­ing the glob­al Do­main Name Sys­tem will now reach the Caribbean in the form of new root servers. PCH and the In­ter­net Cor­po­ra­tion of As­signed Names and Num­bers (ICANN) are both now in the process of sched­ul­ing the in­stal­la­tion of root servers in the re­gion, with a pri­or­i­ty on coun­tries that have In­ter­net Ex­change Points. Out of the threat has come tremen­dous ben­e­fit for the re­gion's In­ter­net in­fra­struc­ture. Many en­ter­pris­es still ig­nor­ing per­sis­tent weak­ness­es could learn from the com­bi­na­tion of proac­tive and de­fen­sive strate­gies that avert­ed glob­al cy­ber-dis­as­ter.

Long-term in­vest­ment

In ad­di­tion to the im­me­di­ate need for cy­ber­se­cu­ri­ty strate­gies that ad­dress­es ex­ist­ing cy­ber-threats, there is a need for longer-term re­search that an­tic­i­pates the dra­mat­ic growth in the use of com­put­ing and net­works in the com­ing years. Cy­ber­se­cu­ri­ty re­quires a com­mit­ment to long-term ef­forts, such as the de­vel­op­ment of stan­dards, re­search in­to cy­ber­se­cu­ri­ty vul­ner­a­bil­i­ties and tech­no­log­i­cal so­lu­tions for these prob­lems. It al­so re­quires the trans­la­tion of re­search re­sults in­to rel­e­vant prod­ucts and ser­vices. In this re­gard, the Uni­ver­si­ty of the West In­dies and oth­er re­gion­al ter­tiary in­sti­tu­tions need to step up re­search ef­forts and en­cour­age aca­d­e­m­ic fo­cus and con­tri­bu­tion rel­e­vant to our pe­cu­liar tech­nol­o­gy en­vi­ron­ment. Some of the long-term re­search ar­eas in­clude tools for en­sur­ing pri­va­cy, em­bed­ding fault-tol­er­ance in sys­tems, self-man­ag­ing and self-heal­ing sys­tems, and re-ar­chi­tect­ing the In­ter­net. In light of the glob­al na­ture of cy­ber-crime, and in the ab­sence of a co­her­ent na­tion­al or re­gion­al cy­ber-se­cu­ri­ty frame­work, the busi­ness com­mu­ni­ty needs to take de­ci­sive steps to pro­tect their in­tel­lec­tu­al and eco­nom­ic in­ter­ests. At the same time, gov­ern­ments need to take ur­gent ac­tion to en­sure that cit­i­zens, crit­i­cal in­fra­struc­ture and na­tion­al in­ter­ests are ef­fec­tive­ly pro­tect­ed. Cy­ber­se­cu­ri­ty is im­por­tant. The threats are re­al and dan­gers ever-present. A mul­ti-faceted strate­gic as­sault re­quires a mul­ti-faceted strate­gic de­fense. It is not suf­fi­cient to be afraid or to re­main in ig­no­rance. Gov­ern­ments, busi­ness­es and users need to be in­formed, be alert and most im­por­tant­ly, ac­tive­ly en­gaged in de­fend­ing them­selves and pro­tect­ing their as­sets.

Bevil Wood­ing is an In­ter­net strate­gist with the US-based re­search firm, Pack­et Clear­ing House and the chief knowl­edge of­fi­cer at Con­gress WBN, an in­ter­na­tion­al non-prof­it or­gan­i­sa­tion. Fol­low on Twit­ter:

@bevil­wood­ing, and Face­book: face­book.com/bevil­wood­ing