Author: nielharper

Digital ID Explained: Pros, Cons, and “Should I get the Trident ID card?”

nielharper

PURPOSE

I continue to receive countless questions from various walks of Bajan society about the Trident ID card and the national digital ID program. This is stark evidence that the Government of Barbados HAS NOT done an adequate and effective job of alleviating the concerns of the public. As such, I wanted to clarify once and for all the pros and cons of digital ID systems, and answer the million dollar question I am repeatedly asked, “Should I get the Trident ID card?”

INTRODUCTION

Digital identity (ID) has become the topic of the moment in Barbados, given the government’s poor implementation, failure to address the fears and anxieties of the public, and generally ineffectual communication to the average person on the street as to why they need digital ID and what value it will bring to their lives. The government has set out to provide a single digital identity to all residents/citizens through the collection, storage, and use of their biographic data (e.g., name, address, date of birth, gender, national registration number, etc.) and possibly their biometrics (e.g., fingerprints, iris scans, facial scans, etc.) as the primary means of establishing and verifying their identity. They will achieve this through a legally mandated, centralised national digital ID system.

Governments, international organizations, and multilateral banks (e.g., International Monetary Fund, World Bank, etc.) argue that digital ID systems provide benefits such as more effective and efficient delivery of government services; poverty reduction and welfare programs; financial inclusion through better access to banking and other products/services; minimise corruption; and preservation of national security interests. Multilateral banks are providing significant funding to developing countries to implement digital ID. In some cases, they’re even making the implementation of digital ID systems a ‘condition’ of loan agreements.

Critics maintain that digital ID systems may actually not guarantee more effective access to social and economic benefits, enhance service delivery, or improve governance, while at the same time, they raise serious issues, including worries about how they are developed and managed; social exclusion and discrimination; privacy and data protection; cybersecurity; and major risks for human rights. With regards to human rights, they threaten the right to privacy, freedom of movement, freedom of expression, and other protected rights. Additionally, since they usually involve the creation and maintenance of centralised databases of sensitive personal data, they are also prone to breaches by hackers or abuse/misuse by government institutions. These issues may lead to digital IDs becoming widespread tools for identification, surveillance, persecution, discrimination, and control, especially where identities are linked to biometrics and made mandatory. 

For a more detailed explanation of both sides of the debate, please see below the PROS and CONS related to digital ID systems.

PROS

Easier access to services: digital ID systems can enable more efficient digital transformation across the local economy and increase Barbados’  participation in the global digital economy, especially given that many transactions – local and international – require personal identification. With Barbadians presented with less obstacles to prove their identity, commercial activities (including e-commerce) and government services (including e-government) become more accessible and effective.

Faster and cheaper transactions: the use of digital ID can allow for reductions in costs and response times, resulting in speedier execution, less red tape, and the availability of more responsive and relevant services. The quickness and trust with which a person’s identification can be verified allows for cheaper and more efficient interactions for all involved.

Fraud reduction: digital ID systems can offer several benefits in terms of online security, thus reducing the occurrence of online scams, fraud, and personal data breaches. A number of countries that have implemented digital ID have experienced significant decreases in fraud, saving them tens and even hundreds of millions of dollars.

The graphic below outlines several ways in which digital ID can be used based on the roles played by organizations and individuals (Source: McKinsey).

The four (4) main areas of direct economic value for individuals have been identified as increased access to financial services, improved employment opportunities, greater agricultural productivity, and time savings. The five (5) highest sources of value for institutions – both the private and public sectors – are cost savings, fraud prevention, increased revenues from goods and services, improved employee productivity, and higher tax revenues.

CONS

Privacy and security: digital ID systems process billions of data points of our private information, regularly without our consent or knowledge. This information can include biographic details (NGN, date of birth, gender), biometrics (facial recognition, iris scans, fingerprints), banking and transactional data, and location-based info when digital ID is used for example in public transportation (the government has expressed plans to use the Trident ID for cashless payments on buses). The centralisation of so much data, excessive sharing of personal data without user consent, inability to control your personal data, exposure to cyber attacks and data breaches, and in worst case scenarios – mass surveillance by corporations and governments – are all issues which show the potential negative impact of digital ID.

Discrimination, biases and exclusion: the Barbados Digital Identity Act has a number of clauses which generate concerns about discrimination and exclusion. The Act states in several places that the digital ID will be required for persons to be added to the register of voters, to vote in elections, to access public and private services, and to obtain a driver’s license. There are no provisions in the Act for mandatory accessibility features in the digital ID and related services. As such, persons with disabilities may be excluded (e.g., the Trident ID website currently DOES NOT have several accessibility features for the disabled). Digital ID technologies are also at the end of the day developed by humans, and through poorly designed algorithms and data analytics, can reinforce their biases. Discrimination against key communities such as immigrants, LGBTQ+, homeless, and the disabled, among others have been highlighted in many digital ID related studies globally.

Technical errors: unintended consequences can occur that lead to restricted access to critical services (e.g., failures in authentication at points of service with no redundancy; websites that aren’t user friendly or stable; duplicate or inaccurate records; inability to add essential information; or the lack of reliable technical support, etc.). The government must fully consider availability risks and identify user-centric and privacy-enabling solutions to mitigate them. In African and Asian countries, numerous instances of technical errors were uncovered which presented citizens with major challenges.

Deployment challenges: five key problems exist, which are the lack of funding to maintain secure cyber systems and to hire or retain critical human resources to administer them; unequal access to mobile Internet and smartphones – the technology with the most potential to drive the uptake of digital ID; dependency on a specific technology or vendor; low trust in government; and the difficulty of rolling out in rural areas.

SHOULD YOU GET THE TRIDENT ID CARD?

As I have stated before, my concern is not particularly with the Trident ID card. The card is only one small piece of the overall digital ID ecosystem. My biggest concerns are as follows:

Poor legislation underpinning the digital ID system: Digital ID must be supported by a legal and regulatory framework that supports trust in the system, prevents abuse such as warrantless and disproportionate surveillance, guarantees data privacy and security, prevents discrimination, and maintains provider (government and corporations) accountability. This includes laws for digital ID management along with laws and regulations for e-government, privacy and data protection, computer misuse, data sovereignty/localisation, electronic transactions, limited-purpose ID systems, accreditation of participants, and freedom of information, among others. Unfortunately, a number of these laws are not available in Barbados at this time, and where they are, the language is problematic, enforcement is deeply lacking, or the legislation is outdated.

Government’s atrocious record in terms of protecting IT systems and the personal data privacy of individuals: The Government of Barbados DOES NOT have the resources (people, processes, or technologies) to secure complex IT systems and provide consistent privacy-enabling solutions. If they did, there would not be so many successful cyber-attacks and data breaches of government online systems in recent years (e.g., Queen Elizabeth Hospital, Ministry of Information and Smart Technology, Immigration Department, Barbados Police Service, and many others). Until government invests significantly in building their capacity in these areas, their IT systems and the personal data of Barbadians will be AT RISK.

The communication (or lack of) by government addressing the public angst around their digital ID program: Government has not effectively articulated the benefits of digital ID, its value to the average person on the street (in real and meaningful terms), its potential disadvantages and risks, what they are doing to manage these risks, and what Barbadians can do to protect themselves. Instead they have chosen to evade questions, avoid public discussion with experts involved, and turn their resources towards attacking private citizens who are expressing concerns.

In my 2018 European Union (EU) cybersecurity assessment report to the government, I clearly stated:

Trust in the Internet and in the use of online services is critical to developing a thriving local Internet economy and to participating widely in the global digital economy. Low trust in the Internet, e-government services, and e-commerce services hampers the government, businesses and consumers from fully taking advantage of all the economic benefits the Internet has to offer. Given the high fixed broadband and mobile data penetration rates in Barbados, this is especially concerning.

European Union Consultancy to Develop a Government Cybersecurity Assessment and Strategic Roadmap – Cybersecurity Assessment Report (Authored by Niel Harper)

From 2018 to this present day, they have failed to address the low levels of trust or their lack of expertise in delivering secure and privacy respecting IT solutions, all of which are undoubtedly preventing them from delivering their digital transformation and modernisation agenda.

Ultimately, Barbadians need to decide for themselves if the value of obtaining the Trident ID outweighs the associated risks. I cannot make this decision for anyone. All I can do is educate and build awareness, and try to put some pressure on the government to be more accountable and take greater responsibility for protecting citizens from the negative effects of digital ID, mass personal data processing, cyber attacks and data breaches, human rights violations, online fraud, and other harms resulting from widespread government use of information and communication technologies (ICTs).

ADDITIONAL RESOURCES

FACT CHECK: The Electoral and Boundaries Commission’s Response

Why the Barbados Election Least Data Leak is Problematic – And How It Could Have Been Prevented

Comments on the National Identity Management System Act

Too Many Unanswered Questions: The Barbados National Digital Identification

Creating a good ID system presents risks and challenges, but there are common success factors

What is a digital identity ecosystem?

Understanding the risks of Digital IDs

FACT CHECK: The Electoral & Boundaries Commission’s Response

nielharper

Today, March 1 2023, the Electoral & Boundaries Commission (EBC) published a farcical response to my concerns about the Government of Barbados’ overall handling of the privacy and security of its information systems and the personal data of Barbadians.

My comments were labelled as ‘allegations’ and ‘misinformation’ around the security of the Trident ID card, security of the registration information captured and stored by the Electoral and Boundaries Commission and data breaches regarding the electronic publication of the Register of Electors.

This post is designed to fact check the EBC’s response.

FACT CHECK #1

The EBC referred to me as a ‘social media commentator.’ I can assure you that I am much more than that, but please decide for yourself by reading my bio profile on the World Economic Forum’s website and this Nation News article on me.

FACT CHECK #2

It has been said that I referred to the release of the electoral list as a major data breach. I have at NO time in the past or the present referred to the release of the list as a ‘data breach.’ As a subject matter expert (SME), I am very careful with my words, and have always referred to the EBC’s major mistake as a ‘data leak.’ Simply put, a ‘data leak’ is when sensitive data is unknowingly or accidentally exposed to the public, and a ‘data breach’ is an event caused by a cyberattack. That being said, the definition of ‘personal data breach’ in the Data Protection Act is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.” From all accounts, the publishing of the electoral list to the Internet was accidental and a loss of control which led to unauthorised access to the personal data of Barbadians by persons who did not have a right to know or a right to access this data. Hence, it is technically still a data breach under the law.

FACT CHECK #3

The EBC claims that they are not at fault because they have followed the letter of the law, namely the Representation of the Peoples Act 2007. Laws are not perfect – especially many of the poorly drafted and outdated ones in Barbados – and must be reinterpreted and updated to remain compatible with progressive changes in technology, changing community awareness, changing community values, and changing expectations of the legal system. It must also be said that making a physical list publicly available in libraries across Barbados is fundamentally different in terms of reach and risk to making an online list publicly accessible to everyone on the Internet. The EBC doesn’t seem to understand this quite simple fact, and it’s the role of the Data Protection Commissioner to educate them (which she has unfortunately and repeatedly failed to do).

FACT CHECK #4

The Data Protection Act Part IV sets out requirements for the transfers of personal data outside of Barbados. Section 22 states the following:

Personal data shall not be transferred to a country or territory outside Barbados unless that country or territory provides for

(a) an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of their personal data; and

(b) appropriate safeguards on condition that the rights of the data subject are enforceable and there are available, effective legal remedies for data subjects.

By publishing the full electoral list to the public Internet, the EBC essentially transferred the data of Barbadians to 190+ countries across the world. More than 75 of these countries do not have data protection laws that offer adequate protection for the rights and freedoms of data subjects (citizens of Barbados). This also made the personal data of Barbadians available to what amounts to 4 billion Internet users over which the EBC has no control, including hackers, scammers, fraudsters, and other cyber criminals.

Appropriate safeguards must be provided when processing personal data. One of these safeguards is data minimisation, which means limiting the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose. The EBC could have accomplished their specified purpose by only publishing the names and addresses of individuals. Instead, they published additional unnecessary information such as national registration number, date of birth, and gender. Countries with strong privacy laws, competent election authorities, and knowledgable Data Protection Commissioners have prohibited the publishing of excessive amounts of data in order to protect voters from fraud, harassment, victimisation, and other harms or violations of their rights. The failings of the EBC with regards to data minimisation, lack of data security, and transfers to inadequate jurisdictions opens them up to legal liability, possibly even a class action lawsuit, in the event that individual(s) experience significant harm or violations of their rights due to the EBC’s negligent actions.

FACT CHECK #5

The EBC and the Minister of Information and Smart Technology continue to pat themselves on the back for the security of the new Trident ID card, repeatedly comparing it to the previous laminated card. My biggest concerns are not and have never been about the security of the card itself, but with the security of the personal data of Barbadian citizens in the online systems used to store and present the bio information on the card (especially when you consider the 30+ government systems that have been hacked in recent years). Debit and credit cards have chip and pin security too, but they still get compromised and people’s cards and bank accounts get hacked every day. So help me to understand how the security of the Trident ID card and related IT systems is so perfect?

As someone who has implemented secure, complex systems in the banking, energy, retail, software, telecoms, and other industries across the world, I can tell you there are several activities that need to be performed. I sent the Minister of Information and Smart Technology and the Prime Minister an email asking them to have the Cyber Security Working Group (CSWG) conduct an assessment of the Trident ID card and present the findings to the general public. You can find a copy of the email HERE, which includes the detailed list of activities that are required to secure digital systems and personal data.

I can guarantee the citizens of Barbados that the government HAS NOT securely implemented the Trident ID card solution and associated systems, and that less than 20% of those activities in the list have been done. The Government of Barbados does not have the human, technological, and financial resources to secure basic to highly complex IT systems. If they could not secure the Barbados Police Service, Immigration Department, National Insurance Scheme, Queen Elizabeth Hospital, and many other government systems from hackers (a full list can be found HERE), how have they suddenly developed the capabilities to secure the Trident ID card systems? If they have done such a great job securing the Trident ID systems, then the CSWG can easily review the evidence and provide a public report in 2-3 weeks or less. I will even volunteer to lead them to make sure the job is done correctly.

FACT CHECK #6

The EBC has claimed to have “no reports, no knowledge and certainly no evidence of any theft of the identities of Barbadians. Furthermore, the Commission has no reports, knowledge and/or evidence of the theft of the identities of Barbadians due in any part to the previous publishing the Register of Electors.” They also claim that their “investigations show that there are no such reports before the Anti-fraud Committee of the Bankers Association of Barbados and no such reports before the Central Bank of Barbados.” I am more than certain that none of the above parties track the sale of personal data in Dark Web marketplaces, possess the know how to obtain electronic evidence (e-evidence) of cyber criminal activity from social media platforms and other online services, have access to open source threat intelligence from law enforcement and intelligence agencies, or are privy to advanced fraud intelligence. So how would they know when and where online fraud and cyber crime using the identities of Barbadians are occurring? I would also suggest that the EBC obtain detailed reports on the rise in identity-based fraud in Barbados or targeting Bajans in the last year. I’ll wait…

Will your incident response team fight or freeze when a cyberattack hits?

nielharper

“CISOs train their teams to fight hackers but often overlook the human tendency to freeze up during a crisis. Planning for the psychology of incident response can help prevent a team from seizing up at the wrong moment.”

The tendency for cyber professionals to freeze during incident response – especially those that have never actually experienced a cyber attack – is more prevalent than one would think. This occurs even in organizations that have well-drilled security awareness training, detailed incident playbooks, cyber-attack simulations, and red team exercises.

In this CSO Online article, myself and other security leaders discuss how to best prepare our teams and organisations to overcome the fear and freezing when faced with a real-time cyber-attack.

Recent Tech Company Layoffs – Seeing Through the Dark Clouds

nielharper

My LinkedIn, Twitter, Instagram and other social media feeds has been filled with comments from ex-Google, ex-Meta, ex-Microsoft, ex-Amazon, and other laid off tech employees.

First of all, I see you, I empathise with you, and I respect you immensely! Many of you have invested many years of your lives and made several personal sacrifices to make these companies successful. I acknowledge your hurt and your trauma, and feel your sense of loss.

Now that aside, going forward, don’t be surprised when businesses do business things. These companies ARE NOT your family and they definitely ARE NOT your friends. It’s a transactional business arrangement for them, and you should treat it similarly.

Now here’s what you do with your considerable knowledge and experience going forward… OWN IT!

1) Make sure that you enter into a ‘contract for service’ and never a ‘contract of service.’ Know the difference!

2) Always have multiple sources of income. Invest in an Airbnb revenue property. Seek out paid board roles. Find a gig teaching for extra income. Apply for that fractional/part-time or advisory role. There are a lot of options out there!

3) Always have an exit plan for your current employer, and a backup plan for that exit plan (I am so serious!).

4) There is nothing wrong with prospecting and interviewing for your next gig, even when you’re happy with your current gig, or even if you’ve just started a new gig.

5) In your next contract, if possible negotiate for 3-6 months of severance if you’re laid off.

6) Invest in a diversified skill set that prevents you from being ‘locked in.’ For example, I have qualifications and experience in telecoms engineering, IT management, digital law & policy, telecoms regulation, audit, privacy, cybersecurity, IoT and smart cities, sustainability, and risk management. And I am pimping the hell out of these skills!

7) Network, network, network! #nuffsaid

8) Tag me in your job search posts. I will repost for reach and visibility.

9) Feel free to reach out to me if you want to talk, need some advice on career planning, or just want to vent. I promise that I will listen (authentically) and be judgment free.

10) Breathe and live a little – It’s not the end of the world. And always remember, “These companies ain’t loyal!”

‘Barbadians To Train & Work in Cybersecurity’ – My Recommended Approach

nielharper

I was recently quite critical about the Government of Barbados’ announcement of their participation in a pilot for the Cyber Nations Training Initiative, a programme created in Canada with a mission of training 100,000 people from the Caribbean and African countries as cybersecurity operations analysts, incident responders, and cyber literacy coordinators.

This initiative at face value is highly commendable as it addresses critical national workforce development needs for cybersecurity. Where I believe it goes off the rails is the expectation/objective that a 4-month crash course in cybersecurity will guarantee that the 200 persons trained will obtain remote jobs with Canadian or other foreign businesses making CDN$60k or more per year. This is simply out of touch with the realities of the cybersecurity profession and relevant workforce demands. Moreover, these unrealistic expectations coupled with a requirement that interested parties commit to a BBD$14k (USD$7k) student loan, basically sets individuals up for disappointment and frustration when the government’s promises don’t come to fruition.

All the above being said, I would like to use this blog post to recommend an alternative approach for cyber capacity building to the government. Hopefully, they’re willing to engage and cooperate with myself and across various stakeholder groups to effectively deliver.

STEP 1: PREPARE

  • Identify an executive sponsor in government for cybersecurity workforce development. This person should have authority, be empowered, possess advanced training and a strong understanding of the country’s multi-dimensional cyber workforce needs, and be afforded the necessary human and financial resources to execute.
  • Develop and publish a vision for the national ICT workforce, highlighting cybersecurity as a critical priority area.
  • Encapsulate cyber capacity building and workforce development into a refreshed national cybersecurity strategy.
  • Work with key stakeholder groups to undertake a cybersecurity workforce readiness assessment. Available tools like the Cybersecurity Workforce Planning Capability Maturity Model (CMM) can be used.
  • Engage and involve stakeholder groups such as academia, technical community, civil society, and the private sector (especially critical infrastructure providers). From the government perspective, key ministries with cyber-related and national security activities, law enforcement, military, and the judicial service should participate.

STEP 2: PLAN

  • Perform a cybersecurity workforce risk assessment to better understand risk exposures and risk tolerance, define mitigating actions, and assign owners and due dates.
  • Create an inventory of the existing cybersecurity workforce.
  • Determine existing/future needs and address the gaps. Key functional areas should include:
    • IT audit
    • Security management
    • Governance, risk & compliance (GRC)
    • Security awareness and training
    • Security education (e.g., University of the West Indies, Barbados Community College, and private training centres)
    • Judicial officers trained in handling cyber related cases
    • Cyber law and policy experts (e.g., privacy, cyber diplomacy, ethics & technology, emerging technologies, Internet governance, etc.)
    • Law enforcement and military officers trained in cybercrime prevention and cyber defensive/offensive capabilities
    • Incident response 
    • Threat intelligence
    • Penetration testing
    • Security operations
    • Security architecture
    • Application security
    • Computer forensics
  • Considerations need to be made for staffing the public sector and private sectors, exporting talent, attracting foreign direct investment (FDI), and creating local cyber-focused startups.

STEP 3: BUILD

  • Develop and align positions in a national workforce framework, considering entry-level through advanced positions.
  • Ensure that non-technical traits for cyber professionals are also factored into training and development plans.
  • University of the West Indies (UWI) and Barbados Community College (BCC) should include mandatory cybersecurity courses in all IT and computer science diplomas and degrees. They should also develop undergraduate majors in cybersecurity and postgraduate specialist degrees in cybersecurity. The UWI Faculty of Law should develop postgraduate qualifications focusing on cyber law, Internet governance, and ICT policy.
  • UWI should seek to establish an international cybersecurity research centre and explore twinning with other centres led by world class institutions (e.g., Harvard Berkman Klein Centre, FGV School of Law – Sao Paulo, Stanford University Centre for Internet and Society, Internet Interdisciplinary Institute – Barcelona, Chatham House, Oxford Internet Institute, Strathclyde Center for Internet Law & Policy, etc.).
  • Prevailing cybersecurity requirements should be considered in the redevelopment of all general tertiary education curricula.
  • Foster private public partnerships (PPPs) to offer cybersecurity scholarships and/or fellowships to high potential students and professionals.
  • Collaborate with the Organization of American States (OAS), IDB (Inter-American Development Bank), Caribbean Development Bank (EDB), International Telecommunications Union (ITU), European Commission, and others to finance and deliver a broad range of capacity building trainings across key government agencies.
  • Accede to the Budapest Convention on Cybercrime to become a priority country for cyber capacity building programs, among other important benefits.
  • Train judicial officers (Supreme Court of Barbados) to better oversee computer crime cases and develop local and regional jurisprudence.
  • Commit to a dedicated annual cyber education and training budget for the public sector.

STEP 4: ADVANCE

  • Public and private sector organizations must develop retention plans for critical cyber resources, and particularly to combat brain drain.
  • Create and implement a plan to attract foreign direct investment (FDI) in areas like managed security services, business process outsourcing, and to fund innovative local cybersecurity startups.
  • HR departments in public and private organizations should develop career paths to help cyber talent navigate their careers.
  • Formulate continuous development opportunities for existing cyber talent.

12 steps to building a top-notch vulnerability management program

nielharper

Along with my peer CISOs, I recently added my $0.02 to a CSO Online article on how to get the best results out of an enterprise vulnerability management program.

I particularly wanted to zoom in on key performance indicators (KPIs), given this is an area where many security professionals don’t focus enough of their attention.

“He says organizations could use any of the commonly used key performance indicators—such as percentage of critical vulnerabilities remediated on time and percentage of critical vulnerabilities not remediated on time—to measure current state and track improvement over time.

Other KPIs to use could include percentage of assets inventoried, time to detect, mean time to repair, number of incidents due to vulnerabilities, vulnerability re-open rate and number of exceptions granted.”

What are some of your key focus areas?

Don’t get your wires crossed – The evolution of cyber risk and why more companies are considering captives

nielharper

A captive is a licensed insurance company fully owned and controlled by the insured parties – a type of “self-insurance.”

Captives are essentially an alternative for organizations to retain and finance cyber risk via actuarial-determined premiums to be paid from the parent company to the captive. They’re becoming more popular due to an increasingly tough cyber insurance market.

Many thanks to Captive Insurance Times and to the amazing Rebecca Delaney for featuring me alongside other industry professionals on discussing this important topic.

The feature can be found on pages 18-22, and is now available to read in the latest online issue at this link: https://bit.ly/3KMnX8j

Ransomware has “changed the game” of cyber insurance

nielharper

I recently made a presentation on ransomware and cyber insurance at the Barbados Risk and Insurance Management (BRIM) conference.

Many thanks to the Captive Insurance Times’ reporter Rebecca Delaney for so excellently capturing my session. In the intro section, she wrote:

“Cyber insurance is not an exhaustive replacement for robust security capabilities, warns Niel Harper […] He explained that ransomware is so disruptive because of the extensive network of paid services it has spawned, such as access brokers, malware packing, phishing kits, hosting and infrastructure, anonymity and encryption, and hardware for sale… In addition, distribution networks include social network spam, instant messaging spam, exploit kit development, spam email distribution, and traffic distribution systems.”

The full article can be found at: https://bit.ly/3MMs71t

12 CISO Resolutions for 2022

nielharper

At the beginning of January, my peers and I shared our security and privacy resolutions for 2022 with CSO Online. The full article can be found here on their website.

However, I wanted to further elaborate here on my plans for privacy and security across the enterprise this year.

I have a couple of resolutions for the upcoming year. Firstly, I want to focus more energy and resources on privacy and data. My second resolution is to refine and enhance the control framework around third-party risk management. In third place, but definitely not of lesser importance, is improving my enterprise’s protection against ransomware. The next resolution on my list is continuing to advocate the importance of email security to every business leader I meet; I am specifically referring to Domain-based Message Authentication, Reporting and Conformance (DMARC), DomainKeys Identified Mail (DKIM), and Sender Policy Framework (SPF). Finally, I want to gain more control over ‘shadow IT.’

With regards to privacy and data, it’s not only about responding to growing demands from GDPR and other national and regional privacy regulations. It’s just good practice to get a solid handle on where business-critical data assets reside and how this data moves inside and outside of your organization, ensuring that you have adequate and effective controls to prevent data leakage and privacy rights violations (and of course avoid fines). Over 55% of data breaches are now caused by a third-party, so ensuring that I have an efficient, standardized approach for assessing third party risk will most definitely reduce privacy and security exposures from vendors, services providers and even contractors. Ransomware continues to increase in terms of prevalence and severity, so a strong prevention and response strategy is key to operational, financial, and reputation risk reduction. Email security in some form has been around since the early 2000s, and yet less than 35% of companies have implemented DMARC, DKIM and SPF. The value of these technologies in combating brand impersonation, reputation damage, and phishing attacks can’t be emphasized enough. Shadow IT in basic terms means that you’ve lost control and visibility into your IT environment, and if you can’t account for IT assets, you can’t protect them.

My approach to privacy and data governance is premised on user/cultural awareness, end-to-end risk assessment, detailed records of processing activities, effective incident response, strong security controls, and building capabilities to integrate ‘privacy by design’into the CI/CD. I plan to move away from using spreadsheets and manual processes to manage third-party risks, and instead leverage best-of-breed software tools that analyze, track, and minimize risks arising from supply chain exposures. With ransomware, my objective is to incorporate identity and access governance, multi-factor authentication (MFA), advanced honeypots, endpoint detection and response (EDR), and multi-tiered backups (3-2-1 strategy) into a cohesive ransomware prevention strategy. As it pertains to email security, my focus is less about my own shop (we’re already there) and more about assisting my peers and small to medium enterprises (SMEs) in properly setting up DMARC, DKIM, and SPF. Preventing shadow IT begins with enhancing usability and eliminating risky workarounds by removing the hindrances that foster them (i.e., being more agile in addressing discrete stakeholder requirements in close collaboration with the IT function).

The UK seeks to enforce tougher standards on MSPs

nielharper

The UK government is proposing new regulations to strengthen cyber resilience in the private sector. Their intention is to expand cybersecurity rules for critical infrastructure (CI) operators to include managed service providers (MSPs), more stringent breach notification requirements, and legislation to establish the UK Cyber Security Council as the standards development organization for the cybersecurity profession. This is a welcomed development, but more details about implementation and enforcement are needed.

MSPs are deeply integrated into the supply chains of several businesses, especially those organisations categorised as CI providers. They not only have privileged access to their customer’s infrastructure and applications, but also to the personal data of millions of citizens. A single breach of a MSP can potentially allow threat actors to compromise hundreds, even thousands of organisations. Additionally, the accompanying fallout from personal data leakage would have a serious impact in terms of impersonation, fraud, and other identity-based crimes. Poor risk management practises and weak security controls in MSPs can have dire consequences to national security and the economic prosperity of the UK.

Better cyber incident reporting, especially where mandated by law, has several positive effects. For one, it ensures that regulations keep pace with the evolving threat landscape to better protect consumers by allowing them to respond quicker to leaks of their information. It also provides certain guarantees that law enforcement agencies (LEAs) receive timely information to better model threats, mitigate the risks, prevent or lessen harm from breaches, and take action to reduce the likelihood of future attacks.

At a macro level, the new regulations are focused on strengthening the country’s cyber-resilience in response to growing supply chain and critical infrastructure attacks – this is essentially a public safety matter. It can provide security to UK citizens against the negative impacts of attacks on critical infrastructure providers such as financial services, telecoms, energy, food & agriculture, defence, manufacturing, and others. It also protects businesses in these key industries where the incapacitation or destruction of their assets, networks and systems would have a paralysing effect on the UK’s national security, economic security, national public health or safety, or any combination thereof.

Cybersecurity is a risk management discipline, and improvements in the overall assessment of risks and development of effective risk responses leads to better security posture. For example, ransomware attacks are very much preventable, yet many businesses don’t invest the time or resources to understand their risks/exposures and implement relevant controls such as data recovery processes, isolated backups, encryption at rest, and routine backup testing. I believe these new regulations can most definitely enhance risk management capabilities in MSPs and other CI operators to counteract a broad range of cyber attacks, including ransomware.

It is imperative that companies develop stronger capabilities around risk management. For one, they need to view cyber risks as business risks and recognise that the impacts range from financial (loss of revenue or drop in share price) to operational (business disruption) to reputation (loss of customer and shareholder confidence) and ultimately regulatory (fines or other penalties). Consequently, they will need to embed a risk culture and build risk management capacity across their enterprises, or face punitive regulatory measures.

A shocking percentage of businesses routinely ignore growing cyber threats, thinking that “it won’t happen to them.” And this isn’t just small to medium enterprises (SMEs), but also large businesses across critical sectors. Several of these organisations don’t have a dedicated cybersecurity leader or functional information security department, refuse to invest in much needed controls and capabilities, and regularly hide breaches from staff, customers, and investors. Without specifically calling out any companies, there are more than enough examples of massive breaches at major businesses to validate my points. The price of failing to act is way too high, and the government would be negligent to not introduce these new regulations.