Cybercrime and Cybersecurity in the Global South

Concepts, Strategies and Frameworks for Greater Resilience

Charlette Donalds, Corlane Barclay, Kweku-Muata Osei-Bryson

• Editorial: Routledge
• Año: 2022
• ISBN:
  9781000562873
• Edición: 1
• Categoría: Commerce
• Categoría: Gouvernement et monde des affaires

The Global South is recognized as one of the fastest growing regions in terms of Internet population as well as the region that accounts for the majority of Internet users. However, It cannot be overlooked that with increasing connectivity to and dependence on Internet-based platforms and services, so too is the potential increased for information and cybersecurity threats and attacks. Further, it has long been established that micro, small, and medium enterprises (MSMEs) play a key role in national economies, serving as important drivers of economic growth in Global South economies. Yet, little is known about information security, cybersecurity and cybercrime issues and strategies contextualized to these developing economies and MSMEs.

Cybercrime and Cybersecurity in the Global South: Concepts, Strategies and Frameworks for Greater Resilience examines the prevalence, nature, trends and impacts of cyber-related incidents on Global South economies. It further explores cybersecurity challenges, potential threats, and risks likely faced by MSMEs and governments of the Global South. A major thrust of this book is to offer tools, techniques, and legislative frameworks that can improve the information, data, and cybersecurity posture of Global South governments and MSMEs. It also provides evidence-based best practices and strategies relevant to the business community and general Information Communication Technology (ICT) users in combating and preventing cyber-related incidents. Also examined in this book are case studies and experiences of the Global South economies that can be used to enhance students' learning experience. Another important feature of this book is that it outlines a research agenda to advance the scholarship of information and cybersecurity in the Global South.

Features:

• Cybercrime in the Caribbean Privacy and security management

• 
  
  

• Cybersecurity compliance behaviour

• 
  
  

• Developing solutions for managing cybersecurity risks

• 
  
  

• Designing an effective cybersecurity programme in the organization for improved resilience

• 
  
  

• The cybersecurity capability maturity model for sustainable security advantage

• 
  
  

• Cyber hygiene practices for MSMEs

• 
  
  

• A cybercrime classification ontology

• 
  
  

Chapter 1 Cybersecurity and the Global South: Solution-Oriented Reflections

DOI: 10.1201/9781003028710-1

1.1 Introductory Discussion

The Global South is not only recognized as one of the fastest-growing regions in terms of Internet population but also as the region that accounts for the majority of Internet users. For instance, it was reported that one region of the Global South, Latin America and the Caribbean (LAC), had the fastest-growing Internet population in the world with 147 million Internet users in 2013, and which continues to grow each year (Organization of American States, 2014). By 2016, the International Telecommunication Union (ITU) reported that Global South economies accounted for the vast majority of Internet users, with 2.5 billion users compared to 1 billion in developed countries (International Telecommunication Union, 2016a). This accelerated and continued growth can be attributed to the momentous increase in mobile subscriptions and robust growth in mobile-broadband penetration (International Telecommunication Union, 2016b, 2018b). While the Internet has enabled the Global South, through the use of Information Communication Technologies (ICTs), to grow their economies, improve livelihoods, share ideas and culture, improve government and social services, collaborate in education, sciences and the arts and to do business (International Telecommunication Union, 2018a; Organization of American States, 2016), it cannot be overlooked that with increasing connectivity to and dependence on Internet-based platforms and services, so too is the increased potential for cybersecurity (CS) threats, attacks and vulnerabilities. Reports in the trade press and the academic literature (albeit minimal) demonstrate these risks or threats and the impact on governments, organizations and citizens. For instance, of the 12 countries that experienced the highest percentage increases in cyberattacks in 2009 compared to 2005, 11 were from the Global South, e.g. Columbia 749%, Indonesia 675% and Zimbabwe 361% (Kim et al., 2012). Further, during a single six-month period, January–June 2016, electronic fraud alone costs the Jamaican economy some $500 million (Williams, 2016); the website of the government of St Vincent and the Grenadines was hacked in 2015 by individuals claiming to be local Islamic State group supporters; also in 2015, a mass ransomware attack on tax authorities blocked users from accessing their systems while demands for money were made; and in 2014 hackers stole US$150 million from Bank of Nova Scotia Jamaica (CARICOM Caribbean Community, 2016). At a meeting in St Lucia, Caribbean countries formally recognized that they are not adequately prepared to counteract cybercrimes and signed off on a regional Cyber Action Plan (Kentish, 2016). According to the regional plan, “preventing and combating cybercrime requires the development of strategies, legislation, criminal justice and ICT (Information and communications technology) expertise, awareness raising, and international cooperation, and involves political, private sector, and civil society leadership at the highest level” (Kentish, 2016). Even though cyber-related incidents associated with the Global South are a critical problem that warrants attention from all levels of government, organizations, individuals and scholars alike, very little research specifically focused on organizations and users in the Global South has been undertaken to further our understanding of this phenomenon. This book contributes to filling this void.

While organizations in the Global South continue to adopt ICTs to deliver services and conduct business, there remains little research about information security, CS and cybercrime issues and strategies contextualized to these developing economies. Moreover, there is even less research about security-related concerns for micro, small and medium enterprises (MSMEs) of the Global South. According to the Organization for Economic Co-operation and Development (OECD), MSMEs play a key role in national economies around the world, generating employment and contributing to innovation (The Organization for Economic Co-operation and Development, 2017). Even more pointedly, MSMEs are known to be essential to the poorest countries in the world; they serve as an important driver of economic growth that accounts for the majority of all businesses (International Monetary Fund, 2015). For instance, in the Caribbean region, the MSME sector accounts for more than 50% of private enterprises and contributes more than 50% to gross domestic product and employment as well as contributing to social development (Caribbean Development Bank, 2016). Likewise, according to researchers, African MSMEs are important to the global economy because their presence and success create “…a growing middle class with disposable income, in tandem with market opportunities for new investors” (de Sousa dos Santos, 2015).

Despite these significant contributions, MSMEs remain largely unsupported and continue to face several major constraints including inadequate access to financial resources for investment and working capital; gaps in training in business skills; high cost of infrastructure services; inadequate physical infrastructure support (for example, warehousing, factory and commercial space, industrial parks, etc.); low levels of technology usage to improve productivity; and lack of competitiveness (Caribbean Development Bank, 2016). In addition to these challenges, MSMEs in the Global South, as well as the Global North, face additional dangers from information and CS threats. Recent CS statistics show that cyberattacks on small businesses increased from 61% to 67% in 2018 over 2017 and that small businesses increasingly face the same CS risks as larger companies (Ponemon Institute, 2018). In another recent industry report, 43% of data breaches in 2018 involved small business victims (Verizon, 2019).

These cited statistics demonstrate that CS threats are just as likely for MSMEs in the Global South as those in the Global North. Arguably, these dangers are more deleterious for the Global South and even more so for Global South MSMEs since they tend to be lean, i.e. they tend to have limited access to trained IT professionals with the capacity to detect, respond to and recover from cyber incidents and limited resources to acquire and implement CS mechanisms. This claim is supported by industry statistics; according to the Ponemon Institute (2018), only 28% of small businesses rate their ability to mitigate threats, vulnerabilities and attacks as highly effective. However, the need for MSMEs in the Global South to be aware of and understand the consequences of CS cannot be understated. Furthermore, how MSMEs in the Global South can improve their cyber and information security posture is not only critical for business success and continuity but also critical for the Global South’s economic development. This book seeks to address these gaps by focusing on CS challenges, potential threats and risks likely faced by MSMEs. This book also seeks to explore and design legislative frameworks and a cybercrime classification scheme appropriate for the Global South economies, among other things. Importantly, this book also explores cyber-related best practices appropriate for Global South MSMEs adoption with the aim for them to improve their cyber and information security posture. Further, this book seeks to sensitize practitioners, public and private institutions about information and CS-related challenges faced by Global South economies generally and Global South MSMEs specifically, so that stakeholders can work collaboratively to create context-specific solutions to address these challenges and improve current practices.

1.2 Contributions to the Conversation

The contributions of this book are organized into three parts: Assessing the Situation, Understanding User Security Compliance Behaviour and Developing Solutions for Managing Cybersecurity Risks.

1.2.1 Part I – Assessing the Situation

A survey of the environment shows that countries particularly the developing economies, alternatively referred to in the Global South, remain vulnerable to CS risks. For instance, a recent research report (IDB/OAS, 2020) reveals that the Latin American and Caribbean (LAC) region is not sufficiently prepared to handle the escalating CS risks. In other words, these countries are not cyber resilient. In order to adequately develop a feasible and effective path to becoming cyber resilient, it is important to know where you are. In this section, we present a few chapters that offer contributions to our understanding of the situation. It should be noted that we are not claiming that these chapters offer a comprehensive assessment of the situation but rather offer contributions beyond what has been presented by other researchers.

In order to adequately address a given problem, it is important to know where you are and where you need to go. Global indices (e.g. Global Cyber-Security Index, Human Development Index), though neither perfect in design nor implementation, offer the opportunity for a given country to assess its current situation and to plan for improvements. The recently presented Global Cybersecurity Index (GCI) for 2020 indicates that while many countries are making progress in their commitments to responding to CS risks and challenges, many of the countries classified as developing economies, but for few exceptions, are at the lower spectrum of the global ranking. Given the usefulness of benchmarking, Chapter 2 focuses on understanding in the context of the GCI, the ways the group of countries of the Global South differs from the remaining group of countries. We conduct data analysis using the 2020 GCI data and identified that the significant differentiators are the Technical and Capacity Development pillars of the GCI.

The increased Internet penetration creates an environment that foments the risks of escalating threats and cybercrimes such as sexual exploitation of vulnerable groups, ransomware, phishing and lottery scams. In Chapter 3, we examine the cybercrime landscape in the Caribbean, in particular the CARICOM member and associate countries, within the context of cybercrime laws and enforcement. The research underscores that while significant advances have been made in the promulgation of new and revised cybercrime laws in many of these countries, issues such as responsiveness of these laws, harmonization and regional cooperation in the investigation and prosecution of cybercrimes remain as important policy challenges in the region.

It is now acknowledged that the data protection landscape has been radically transformed since the passing of the European Union’s General Data Protection Regulation (GDPR). Many countries (e.g. Jamaica, Barbados, Brazil and several states in the US) have since developed laws that are closely similar to the GDPR. In Chapter 4, we examine some of the notable fines imposed within the first year of the coming into operation of the GDPR. Our findings highlight breaches of obligations of key provisions relating to data protection principles, such as the lawfulness of processing of personal data and consent, the rights of the data subjects and security of processing, in particular. This emphasizes the importance of bolstering processing operations underpinned by privacy by design principles to reduce the risk of fines, reduced customer trust and financial viability. These findings also have implications for organizations in their prioritization of the technical and organizational safeguards during their GDPR and other data protection compliance programmes.

1.2.2 Part II – Understanding User Cybersecurity Compliance Behaviour

The CS decision problem is a complex one that involves multiple dimensions. Thus not surprisingly, the Global Security Index (ITU, 2020) involves the Legal, Technical, Organizational, Capacity Development and Cooperation dimensions. User behaviour has also been previously identified as a critical dimension because users have been recognized as key threats to achieving adequate CS because they often fail to adhere to CS best practices. According to researchers, users are often considered the weakest link in the chain of system security (e.g. Barrett-Maitland, et al., 2016; Warkentin and Willison, 2009). Therefore, in this section, we present chapters that focus on offering contributions to the understanding of how to improve cybersecurity compliance behaviour.

In addition to implementing technological tools, entities have adopted CS policies (CSPs) to address the rising number of employee-related CS incidents. If, however, employees do not understand the importance of or are unwilling to comply with CSPs, CS efforts may be in vain. In Chapter 5, we present an investigation of employees’ actual CS compliance behaviour via an integrated CS compliance model that includes the constructs: CS awareness (CSAW), CS policy awareness (CSPA), CS training (CSTR) and top management support (TMSP). Our results suggest that (a) CSAW and CSPA are significant factors contributing to employees’ actual CS compliance behaviour; (b) the support and involvement of top management have a significant impact on CSPA; and (c) CSTR influences both CSAW and CSPA.

Recent information and CS research have focused on improving individuals’ security compl...

Índice

• Cover Page
• Half Title Page
• Title Page
• Copyright Page
• Dedication
• Contents
• Preface
• Authors
• Chapter 1 Cybersecurity and the Global South Solution-Oriented Reflections
• Part I Assessing the Situation
• Part II Understanding User Cybersecurity Compliance Behaviour
• Part III Developing Solutions for Managing Cybersecurity Risks
• Index