‘Urgent threat’ to critical infrastructure, warns cybersecurity expert

arbados is facing an urgent need to strengthen its cybersecurity measures to protect critical national infrastructure, following recent data breaches at major institutions, according to cybersecurity expert Dr Curtis Charles.

The Dean and Director of Academic Affairs at the University of the West Indies Five Islands Campus in Antigua has warned that regional governments and organisations are lagging in implementing the robust defences necessary to safeguard national systems.

Dr Charles, who heads UWI’s Generative AI for Good Research Cluster, spoke exclusively to Barbados TODAY in response to recent data breaches at the Barbados Revenue Authority (BRA), Queen Elizabeth Hospital (QEH), and Barbados Public Workers Cooperative Credit Union Limited (BPWCCUL). He stressed that the Caribbean remains significantly behind other regions in cybersecurity preparedness, leaving critical infrastructure vulnerable to a range of threats.

He stressed that critical infrastructure in the Caribbean such as the electricity grid, road system, telecommunications system, water systems and others, have unfortunately not been created from the ground up with cybersecurity in mind, which places regional countries in a precarious position.

“When I came to the Caribbean four years ago and looked around, there was not that national security concern, because in the US cyber attacks are considered a national security threat.

“We are very much open as Caribbean nations because what happened is that most of our critical infrastructure in the Caribbean has been created before cyber threats were around. So we don’t know what malware might be in there, we don’t know because when it was built, we did not know to fortify it against threats. Many of the systems might be open, but we don’t know what,” explained the founding executive director of the Centre for Defence and Homeland Security (CDHS), a research-enabled agency that prepares individuals to address national security issues in the United States including cyber security threats and emergency management.

He stressed the importance of not only protecting government institutions but all entities who do business with them, as breaches in any part of the “supply chain” can lead to negative consequences.

“Everything that is connected to a network is susceptible to be hacked. Now the adversary is not stupid; they are not going to go for the government, but they may go for a vendor who is doing business for the government or agency, but who does not have the money to fortify their system, the adversary would them attach to them and then attack [larger] systems from the [outside].

“That means that your supply chain management and logistics need to be fortified. You need to do a survey of everybody that does business with you, [check] if those people are fortified as well, and if they are not, that could be a condition of doing business with them or not doing business with them,” DrCharles said.

The Trinidadian, who holds prestigious degrees from institutions such as Massachusetts Institute of Technology (MIT), Howard University, Morgan State University, and Northwestern University, along with professional certifications from Harvard and MIT in education management, big data analytics, performance assessment, and AI and data science, expressed concern over the situation.

He noted that the data breaches in Barbados and across the region have essentially opened a Pandora’s Box. These breaches may signal to international hacking groups that the region’s vulnerable infrastructure is ripe for further attacks.

Dr Charles said: “The train has left the station. It is the urgency of now. What has happened in Barbados has shown adversaries everywhere that if they can hack a sophisticated country like Barbados, they might try Trinidad, Antigua, or other islands. A single ransomware attack could cripple a country that depends on tourism.”

He added: “We don’t have five years or five months to address this. Governments must make cybersecurity a priority right now.”

In response to the growing threat, UWI has started investing in the development of cybersecurity programmes, including a master’s degree in collaboration with the University of Maryland, Baltimore County (UMBC) to equip the region with the skills needed to protect its digital infrastructure.

“But we have no other cybersecurity programmes anywhere,” Dr Charles said. “In order to protect the region in the future, we need to be on the ball as well to make sure we are developing academic programmes that are urgent [for us] and cybersecurity is one of those.”