Fernando Thompson
Chairman
TBSek SA de CV
/
Expert Contributor

How Is Mexico’s Economic Engine Set Up for Cybersecurity?

By Fernando Thompson | Tue, 05/10/2022 - 11:00

Small and medium-sized companies in Mexico are vital economic engines for two reasons: first, they generate about 75 percent of jobs; second, they contribute more than 50 percent of GDP. Hence the urgency that they have a culture of cybersecurity, starting with the owners and decision-makers as well as each employee who uses a computer for any activity within the company. After creating a culture of awareness, they must continue to put together a plan in case digital assets become victims of an incident or disaster, which can be accidental or generated by a resentful employee or a criminal group.

According to cybersecurity experts, it is expected that cybercrime will cost the world US$10.5 billion a year by 2025, which is an exponentially disturbing figure. The sad reality is that out of every 10 crimes committed by cybercriminals, only 0.5 are solved, which makes it a lucrative activity for criminal groups at the level of drug trafficking, arms sales and forced human trafficking.

To spice up the above, it is important to consider that Mexico is, unfortunately, among the leading targets for cyberattacks globally. This is worrying and is due to many root factors, which include the naivety of people who use email and the internet as well as social media networks and applications. There are also bad practices, such as entrusting security to the person who fixes computers and printers and installs the network. Cybersecurity goes far beyond installing a firewall and using antivirus software, in addition to the bad practice of using pirated software within companies, that could still leave all doors and windows open for a cyberattack.

Specifically, Mexico suffered more than 156 billion attempted cyberattacks in 2021 alone and that figure is set to rise in 2022. Government agencies and the vast majority of Mexican companies do not have visibility into what is happening on their network. Many companies do not have a disaster recovery plan, much less a business continuity plan, which makes this country the world’s nirvana for hackers due to the economic importance of the country and the enormous number of people using personal and company-issued devices without a clear understanding of the danger ahead.

According to software security firm Avast, the states of the Mexican republic where home users face the greatest cyber risks are:

1.- Tabasco

2.- Campeche

3.- Yucatan

4.- Sonora

5.- Chiapas

6.- Tampico

The most vulnerable companies and people face the following attacks:

Ransomware, which is the hijacking of information or a device through an intrusion generated by the user himself, either by clicking on a link on a contaminated site, through an SMS text message or through an application such as WhatsApp or an email through what is known as phishing.

Phishingis an old but, unfortunately, very effective technique where the criminal sends messages pretending to be an honorable person or impersonating a bank, telephone company or government agency, seeking to trick the person into sharing sensitive information, access credentials or simply to download malware by clicking on a link without realizing what is happening.

Leakage of sensitive information. Without document classification and management policies for confidential, sensitive, restricted or public documents, there is no way to prevent the loss of data. Unfortunately, the company's employees are the targets of cybercriminals who attempt to extract information from them through social engineering or other, more complex techniques.

Social engineering. Technology has nothing to do with this. Rather, it is about people's intelligence and common sense. Cybercriminals can rummage through the garbage for documents that are thrown away by the company or use social techniques to establish a dialogue with the victim and extract information without the knowledge of the employee himself.

Identity theft. The latter has many connotations and ranges from the simple theft of citizens' personal data to be sold in databases within the DarkNet, to the impersonation of senior executives to deceive employees with financial resources or access to banks to deposit funds in apparently normal accounts for the operation.

Today, only about 10 percent of companies adequately protect their data or are prepared to face an attack, recover after a hack or outright stop attacks before they occur. They normally have trained personnel, procedures, processes and policies focused on the protection of users, data and digital assets, as well as hiring expert cybersecurity companies to advise them and implement solutions as sophisticated as artificial intelligence.

I want to place special emphasis on the myth of cloud computing for the resolution of problems inherent to our topic in question. Indeed, there are networks with technology and applications that will almost immediately help the companies that contract the services but data security is always the responsibility of the company, never the cloud provider, since the latter focuses on guaranteeing high availability of its platforms and sophisticated architectures. The security of the origin of the data invariably belongs to the owner of the information.

Unfortunately, a reality that makes things more difficult is that there is a worldwide deficit of professional personnel trained in cybersecurity, with experience and knowledge. We are talking about a lack of 1.8 million professionals. Specifically in Mexico today, there are 35,000 open computer security positions. Hence the recommendation to hire the services of companies that offer cybersecurity products and services and especially those that serve small and medium-sized businesses.

The list of companies and entities that have been victims of cybercriminals is extensive and includes PEMEX, Condusef, SAT, Banxico, the Ministry of Public Administration, ISSSTE, the National Insurance and Finance Commission, Yo te Presto, Gentera, Universidad Panamericana, Maseca, CI Banco, Banco Base, Clip and Bitso, among thousands of others. Unfortunately, more and more names will join them, while those already on the list could also be hit again, because cybercriminals do not rest and are always on the prowl, taking advantage of vulnerabilities that unfortunately come out by the dozen every hour.

Knowing that 70 percent of Mexican SMEs have difficulty making investments that allow them to improve their cybersecurity, the recommendations to reverse all of the above is the following:

1. Cybersecurity is not a technological problem but a business problem and is directly associated with risk and the prestige of the company.

2. The person who installs the company’s computers, networks and printer is not the one to establish the solutions. It should start from the owners and their awareness. They need to create a program that promotes a computer security culture among employees, formalize simple processes to have backups and secure passwords, and invest in the minimum necessary to guarantee the continuity of the operation, knowing that sooner or later they will be attacked.

3. Servers, the network, computer equipment and devices, such as security cameras, cloud services, systems, applications, the portal and the internet must be protected, whether they work locally or remotely, hybrid or from home.

Finally, after so many years in this field and seeing the dizzying speed at which almost all of this moves, it is clear to me that the short-term future of cybersecurity lies with artificial intelligence, but that is the subject of another article.

Photo by:   Fernando Thompson