Claudia Sánchez-Bustamante
“Cyber defense often fails if it’s based on concepts from last century’s battles.” That phrase, from the U.S. Army Test and Evaluation Command’s presentation, set the tone for a candid conversation on the efforts that are being undertaken and must be further developed to address the challenges posed by cyber security threats today.
For three days, Armed Forces, Public Security, private industry, and academic information technology and cybersecurity professionals from 18 partner nations in the Americas came together in a United States Southern Command (SOUTHCOM)-sponsored workshop on Command, Control, Communications, Computer Systems (PNC4S), and Cyber Security.
From April 14-16, the workshop provided a forum for dialog among military professionals on information technology, information sharing, and cybersecurity best practices, according to information from SOUTHCOM’s Cyber Defense Division and Joint Cyber Center, the event’s organizers.
“The primary purpose was to bring a variety of perspectives together, develop capabilities, and strengthen regional cooperation and interoperability in the cyber arena,” said the organizers. “And the ultimate goal was to open doors for future collaboration to aid in confronting our common regional security challenges.”
On this occasion, U.S. Northern Command also attended with a delegation from Mexico’s Secretariat of National Defense (SEDENA) and Secretariat of the Navy (SEMAR). In a country with 46 million cybernauts – 43.5 percent of Mexico’s population – their efforts to advance their current cyber security initiatives is paramount, and the representatives were keen on listening to the other countries’ efforts in that respect.
For Brazilian Army Colonel Alan Denilson Lima Costa, Deputy Chief of the Army’s Cyber Defense Center (CD Ciber), which is undertaking a monumental cyber and information security challenge ahead of Brazil’s upcoming role as host of the Summer Olympic Games in 2016, this type of initiative [bringing together partner nation cyber personnel] facilitates open discussions on cyber threats and the tactical aspects surrounding it.
“It’s an excellent initiative for all of us here, but there is still a void in terms of military defense operations in the cyber realm,” he explained. Col. Alan suggested that a practical exercise specifically for cyber defense operations would be a great next step. “Even though Brazil undertakes planning efforts for cyber defense, there needs to be more in terms of doctrine and joint planning efforts,” he said.
A significant aspect of the three-day dialogue was Trinidad and Tobago’s presentation on their efforts in advancing national development on cyber security. Through their Inter-Ministerial Committee (IMC) for Cyber Security, they are the first Caribbean country to have published a national cyber security strategy in 2012.
Trinidad and Tobago Defence Force Major Fareed Ian Mohammed, from the Communications Systems Dominance Directorate, talked about the IMC’s developments for this effort and of the importance of securing their cyber environments given that the energy sector is the country’s primary income earner, accounting for 40 percent of the country’s gross domestic product.
“In addition to developing the national strategy by 2012, from 2013 to 2014, the IMC also developed a National Cybercrime Policy, the country’s Cybersecurity Agency, a Computer Security Incident Response Team, and a national Cyber Security Bill [although it has since lapsed],” he explained.
With respect to the workshop itself, Maj. Mohammed said everything in the cyber realm is new for them, a nation that is developing their national strategy in this respect, but is not immune to hackers and cyber security threats. “It’s important to collaborate with our partners in developing this new domain; there is no room for our old, our traditional ways of thinking to address a new domain like cyber,” he explained. “It’s very important to create partnerships to collaborate jointly.”
Colombia, which has made great strides in developing their national cyber strategy in the last few years, briefed participants on their interagency approach and the responsibilities and areas covered by each of the cyber agencies involved. These include the national-level Joint Cyber Command (CCOC), the cyber defense units of each of the three Military branches, the national Police Cyber Center (CCP), and the colCERT – the country’s cyber emergency response center, which consists of a national-level team responsible for coordinating aspects related to information security.
Among other topics, Colombian Navy Commander José William Hernández Murillo, Chief of Operations of CCOC, briefed on the interagency commission’s composition. The three agencies “provide technical assistance in coordinating incident management, developing operational capabilities, providing cyber intelligence information, and support and guidance related to cyber defense in order to collectively and actively collaborate on incident resolution,” he said.
“We have grown and expanded [the country’s cyber strategy and structure] by building our capabilities in the cyber arena through agreements, trainings, certifications, and increasing the number of trained professional specialists in cyber security,” Cmdr. Hernández told Diálogo .
Mexican Navy Commander Jorge Daniel Berdon Lara, who works with Information Security at SEMAR, explained that having this sort of information sharing exchange with regional counterparts is beneficial. “This workshop has given us the opportunity to build contacts to initiate joint cooperation links with our regional counterparts in the field,” he stated. “This event opens doors and facilitates the exchange of information in this respect. We got different perspectives and a strategic vision on the cyber threats common to us all, especially in Latin America.”
Panel discussions and group presentations allowed the participants to work collaboratively in combining their experiences and lessons learned in the cyber arena with the general audience. Each group was given different categories of security and/or cyber threat examples for which they were tasked to come up with the type of activities that these entail, the actors who perpetrate them, their objectives, and the motivation behind them, whether it be political, social or one from which there is potential economic gain.
As one of the group’s representatives, Col. Alan pointed out that “the objectives behind the frequent hacker activity perceived in Brazil were of a social nature, as a form of protest to cause political destabilization and to discredit the government.”
But other examples of security breaches involved information theft by actors including a range of users, from disgruntled employees, nation states with a particular interest, and hackers to organized crime groups looking to extract personal information through social engineering for economic gain, the need to gain access to technology, or simply sowing fear and chaos.
Command and control systems were also a relevant topic of discussion since all the participating countries deal are facing this challenge as they develop their national cyber security policies and frameworks. Though there may not have been an answer to the common worries in this respect, it was clear to all present that a cyber threat against command and control systems implies a potential threat to the national security of any country, regardless of size, economic standing, or strength.
The conclusion that was reached, however, was that as technology advances, so does the room for threats, so countries, governments, the private industry, and academia have to remain in close touch in order to address concerns jointly, collaboratively, and with the openness to share the knowledge and the lessons learned from each individual experience.
