OAS Cybersecurity Symposium ... teams to engage in malicious international activity States should encourage

  • View
    0

  • Download
    0

Embed Size (px)

Text of OAS Cybersecurity Symposium ... teams to engage in malicious international activity States should...

  • Development of Cybersecurity Strategies and Policies

    Orlando Garcés Jorge Bejarano

    OAS Cybersecurity Symposium

    Santiago de Chile, Chile, September 25th, 2019

  • Disclaimer: The opinions expressed in this presentation do not necessarily reflect the views of the General Secretariat of the Organization of American States –OAS– or the governments of its member states.

  • Development of Cybersecurity Strategies and Policies

    Context and trends in Cybersecurity

    Santiago de Chile, Chile, September 25th, 2019

  • Cybersecurity

    Source: WEF

  • • No universal definition

    • The set of resources, policies, security concepts, security safeguards, guidelines, risk

    management methods, actions, research and development, training, best practices, insurance and technologies that can be used looking for availability, integrity, authentication, confidentiality and repudiation, in order to protect the users and assets of the organization in Cyberspace (Colombian national policy, April 2016)

    • The set of policies, controls, procedures, risk management methods and standards

    associated with the protection of society, government, economy and national security in cyberspace and public telecommunication networks (Mexican national policy, 2017)

    • The collection of tools, policies, guidelines, risk management approaches, actions, trainings,

    best practices, assurance and technologies that can be used to protect the availability, integrity and confidentiality of assets in the connected infrastructures pertaining to government private organizations and citizens; these assets include connected computing

    What is Cybersecurity?

  • • No universal definition

    • The use of military capabilities in the face of cyber threats, cyber attacks or hostile acts of a cybernetic nature that affect society, national sovereignty, territorial independence, the constitutional order and national interests (Colombian national policy, April 2016)

    • The entirety of intelligence and military measures leading to the disruption, suppression or

    slowing down of cyber attacks, serving to identify authorship, ensuring the operational readiness of the Armed Forces in all situations, and serving to build capacities and capabilities for subsidiary support of civilian authorities (Swiss national policy, 2018)

    • The means to achieve and execute defensive measures to counter cyber threats and

    mitigate their effects, and thus preserve and restore the security of communication, information or other electronic systems, or the information that is stored, processed or transmitted in these systems (NATO definition April 2019).

    What is Cyberdefense?

  • • Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity (OECD, 2015)

    • Digital security risk management: the set of coordinated actions taken within an organization and/or

    among organizations, to address digital security risk while maximizing opportunities. It is an integral part of decision making and of an overall framework to manage risk to economic and social activities. It relies on a holistic, systematic and flexible set of cyclical processes that is as transparent and as explicit as possible (OECD, 2015)

    • Digital security is the situation of normality and tranquility in the digital environment (cyberspace),

    derived from the realization of the essential purposes of the State through (i) digital security risk management; (ii) the effective implementation of cybersecurity measures; and (iii) the effective use of cyber defense capabilities; that demands the social and political will of the multiple stakeholders and citizens of the country (Colombian national policy, 2016)

    • Digital Security at the national level is the state of confidence in the digital environment resulting

    from the management and application of a set of proactive and reactive measures against the risks that affect the security of people, economic and social prosperity, the national security and national

    What is Digital Security and Digital Security Risk Management?

  • Other definitions

    Vulnerability

    Risk

    Digital Attack

    Digital Incident

    Cyber space

    Incident response

  • What is Cybercrime?

    Source: OAS

  • The attacker, motives and their targets

    Source: OAS

  • Sources of Information - Global

  • NETWORK ATTACK SPAM MALICIOUS MAIL

    Source: KASPERSKY, percentage of attacked devices during the last month (june 2019)

    Cyber attacks in Latin America and the Caribbean - LAC-

  • Sources of Information – Regional ENISA

    Source: ENISA

  • Sources of Information – Regional OAS

    https://www.oas.org/es/sms/cicte/sectorbancarioe ng.pdf

    https://www.oas.org/documents/spa/press/Estudio- Seguridad-Digital-Colombia.pdf

    https://publications.iadb.org/publications/spani sh/document/Ciberseguridad-

    %C2%BFEstamos-preparados-en- Am%C3%A9rica-Latina-y-el-Caribe.pdf

    https://www.oas.org/en/sms/cicte/Documents/rep orts/The-State-of-Cybersecurity-in-the-Mexican-

    Financial-system.pdf

    STATE OF MATURITY AT REGIONAL LEVEL

    SECTORIAL AT REGIONAL LEVEL

    SECTORIAL AT THE NATIONAL LEVEL

    AT THE NATIONAL LEVEL

    https://www.oas.org/es/sms/cicte/sectorbancarioeng.pdf https://www.oas.org/es/sms/cicte/sectorbancarioeng.pdf https://www.oas.org/documents/spa/press/Estudio-Seguridad-Digital-Colombia.pdf https://www.oas.org/documents/spa/press/Estudio-Seguridad-Digital-Colombia.pdf https://www.oas.org/en/sms/cicte/Documents/reports/The-State-of-Cybersecurity-in-the-Mexican-Financial-system.pdf https://www.oas.org/en/sms/cicte/Documents/reports/The-State-of-Cybersecurity-in-the-Mexican-Financial-system.pdf https://www.oas.org/en/sms/cicte/Documents/reports/The-State-of-Cybersecurity-in-the-Mexican-Financial-system.pdf

  • Sources of Information – Regional OAS – Mexican Financial System

    7%

    10%

    10%

    12%

    12%

    14%

    14%

    16%

    17%

    18%

    18%

    18%

    19%

    20%

    23%

    30%

    30%

    33%

    15%

    6%

    13%

    25%

    20%

    24%

    24%

    19%

    6%

    32%

    14%

    33%

    19%

    25%

    13%

    18%

    18%

    7%

    78%

    77%

    70%

    52%

    56%

    55%

    62%

    39%

    78%

    34%

    57%

    41%

    43%

    43%

    51%

    36%

    39%

    60%

    0% 25% 50% 75% 100%

    Loss or theft of equipment or devices

    Internal fraud

    Loss or theft of data

    Violation of clean desk policies (Clear Desk)

    Backdoor (code developed to enable subsequent access)

    Zero day attack

    Internal sabotage

    Social engineering

    Man-in-the-middle

    Phishing, Vishing or Smishing

    DNS Spoofing

    Pharming

    Malicious code or Malware

    SQL Injection

    Attack of denial of service (DoS / DDoS)

    Brute force attack

    XSS or XFS

    Defacement

    Daily Weekly Monthly Quarterly Source: OAS

  • Sources of Information – Regional OAS – Mexican Financial System

    Large Medium Small Total Commercial Banks 2,30% 3,05% 1,88% 2,38%

    Development Banking Institutions 1,63% 2,50% 2,00% Brokerage houses 2,57% 2,57%

    Cooperatives (SOCAP) 2,26% 1,65% 1,90% Popular Financial Societies (SOFIPO) 3,33% 5,00% 4,00%

    Credit Unions 1,82% 1,82% Fintech Institutions 2,65% 2,65%

    Mexican Financial System 2,30% 2,51% 2,04% 2,18%

    Anual Budget Anual Cost

    Large Medium Small Total 1,00% 1,39% 1,80% 1,42%

    1,00% 1,00% 1,00% 2,50% 2,50% 2,00% 1,13% 1,56% 1,00% 1,00% 1,70% 1,70% 2,63% 2,63%

    1,00% 1,54% 1,73% 1,59%

    Large Medium Small Total Commercial Banks 6.325 1.492 759 2.060

    Development Banking Institutions 4.843 4.613 4.740 Brokerage houses 167 167

    Cooperatives (SOCAP) 39 38 38 Popular Financial Societies (SOFIPO) 84 7 43

    Credit Unions 249 245 Fintech Institutions 1.544 1.544

    Mexican Financial System 5.422 854 411 655

    Large Medium Small Total 2.750 680 725 1.075

    2.980 1.845 2.476 162 162 35 26 28 0 1 1 233 229 1.530 1.530

    2.357 635 318 447

    As % of EBITDA of the immediately preceding year

    Estimation by financial entity / institution (US$ 000)

    Source: OAS

  • Sources of Information – National OAS – Colombian organizations

    Source: OAS

    Ataques basados en web, 0.2041

    DoS, 0.0802

    Malware, 0.2497

    Phishing, 0.1721

    Ransomware, 0.1322

    Otros, 0.1617

    Type Increase in frequency

    Decrease in frequency

    It has remained at

    similar levels Malware 33% 26% 42% Phishing 31% 34% 36% Ransomware 27% 32% 42% DoS 20% 28% 52% Web based attacks 20% 30% 50% Others 21% 24% 56%

    DIGITAL INCIDENTS FREQUENCY OF INCIDENTS