Brazil needs a national cybersecurity policy – 12/07/2023 – Market

Every year, there are more than 100 billion cyberattacks in Brazil, which cause damage to the national economy estimated at between R$200 billion and R$600 billion.

In addition to the financial impact, episodes such as the WannaCry ransomware, the shutdown of the Colonial Pipeline and the “blackout” at Conecte SUS illustrate that the absence of a National Cybersecurity Policy and a National Cybersecurity Agency are unacceptable.

It’s easy to imagine “cyberapocalyptic” scenarios, but our daily lives are enough to understand the importance of this topic and, above all, take action.

To adopt and implement such policies, the culture of responding to problems only after the “milk has spilled” must be overcome. This is because policies such as cybersecurity, when focusing on prevention and resilience, do not always make headlines, at the same time that they bring costs of building state and private capacity.

The proposals presented by the GSI last May are an attempt to break with this pattern. This brief text offers elements on the need to debate such drafts and adopt, as quickly as possible, a robust national cybersecurity policy, accompanied by the implementation of an active National Cybersecurity Agency.

A ticking time bomb

The recent Brazilian digitalization, boosted by the Covid-19 pandemic, led us to reach second position worldwide in terms of digitalization of public services, with more than 4,200 services digitally accessible. This advance, however, becomes a growing vulnerability.

Without a Brazilian cybersecurity system, such a number of digital public services were developed without a uniform and effective strategy for identifying, preventing and mitigating the risks of cyberattacks or other cybersecurity incidents.

Therefore, Brazil’s progressive digitalization was not structured in a safe and sustainable way, and, worse, it created a vast attack surface, exponentially multiplying the potential targets susceptible to cyberoffenses.

The lack of comprehensive cyber hygiene strategies in public bodies is particularly notable, as simple measures such as carrying out periodic backups, using strong passwords and two-step authentication would be extremely effective in preventing and considerably reducing cyber attacks.

Brazil’s delay could be an opportunity

When looking at international experiences, Brazil’s backwardness is evident. The European Union created the European Cybersecurity Agency in 2004. China established the Cyberspace Administration of China in 2014.

At the end of 2023, and without a clear horizon of when measures will be taken, Brazil is still discussing the need for such an essential agency. However, this delay makes it possible to learn from the mistakes and successes of other countries.

This year there were advances in the debate about the National Cybersecurity Policy (PNCiber), although restricted and limited to a niche of interested parties. At least among the main experts and public and private actors involved in the topic, the importance of PNCiber is undeniable.

It is time to have a national policy that is actually implemented and that is capable of providing some coherence and organicity to the extensive normative patchwork that tries to regulate Brazilian cybersecurity.

A necessary multisectoral dimension

To establish a Brazilian cybersecurity system with efficient, active and democratic governance, it is essential to adopt a multisectoral approach.

In this sense, the National Cybersecurity Agency should, firstly, integrate, coordinate and cooperate with the wide number of actors and interested parties that already work in different dimensions of cybersecurity in the country, through a multisectoral council that includes public and private actors, capable of continuously providing the agency with input and feedback on the different dimensions of cybersecurity, whether technical, legal, economic or social in nature.

It should even advise on which strategies, policies and technologies would be the most efficient to deal with different cyber threats.

Secondly, ANciber would need to create coordination between the different government bodies and regulatory agencies that have already adopted sectoral regulation on essential elements of cybersecurity – such as the security of personal data, banking information, telecommunications infrastructure, etc. – but which are currently operating in an uncoordinated manner and without massive adherence to the Federal Cyber ​​Incident Management Network.

Thirdly, ANciber would also need to have powers to create a cooperative and effective dialogue with different levels of government and powers, including the Legislative Branch, the Judiciary Branch, the Audit Courts, Public Ministries, encompassing regulators and public organizations at the state and municipal.

For these purposes, it seems essential to us that a National Cybersecurity Network is established, favoring communication and the exchange of good practices between the aforementioned entities, and also with research centers, actors who are already on the front line of cybersecurity and who should be considered as one of the greatest Brazilian assets to guarantee cybersecurity.

People-centric cybersecurity

Despite the delay, Brazil has a huge opportunity to innovate and become an international reference in cybersecurity.

Although several national police and international documents declare the need for an individual-centered approach, no text to date has explicitly defined cybersecurity in this sense.

Bringing the protection of individuals under the cybersecurity umbrella would be a welcome innovation. Such an approach would be the most appropriate to highlight the need to invest massively in the digital education and training of the population.

Only by understanding cyber risks will Brazilian society be digitally sovereign and, therefore, capable of benefiting to the maximum from technology.