How ITU helps Vanuatu to limit cyber risks

The nearest post office for residents in Burumba, Vanuatu is about 60km away – three islands away. So, many of the residents are turning to online communication tools to keep in touch with friends and maintain business on Vanuatu’s 83 islands.

“I’ve been in one of the most remote provinces in Vanuatu and to my amazement, people are using smartphones,” Kensley Joses, Operations Manager at CERT Vanuatu, told ITU.

Information and communication technologies (ICTs) are a vital resource for communications in Vanuatu – especially in the most remote areas of the archipelago. The widespread availability of mobile broadband is driving the popularity of online services like social media and email for communications among the rural and remote islands.

This is expected to grow with the launch of a new subsea cable that will provide a more reliable network to the country by the end of the year.

But as connectivity grows, so does the potential for cybercrime.

“Right now people are using the internet, but the awareness on the threats that are online is fairly [limited],” Joses said.

“No-one or no organization is actually immune to a cyber-threat: cases appear everywhere,” says Jeffrey Garae, Cybersecurity Advisor, CERT Vanuatu.

The challenges of cybersecurity

Though Vanuatu has not had many major national cyber-attacks to date, the main threats facing the country are similar to those in developed nations.

“I would say around 70-80 percent of the attacks coming in are phishing related. We also see online scams, a few extortion cases and also a couple of website defacements – and of course, malware attacks and injections, or intrusions as well,” Garae said.

But similarly to other less-developed countries, Vanuatu faces two major challenges for developing cybersecurity capabilities, namely the lack of human resources and capacity building.

“This is something common in the Pacific,” Joses said. “We have a small population. Few people are in the field of cybersecurity. This is also a new thing to us Pacific islands, and capacity building is something that we are struggling with.”

Protecting Vanuatu from online danger

In July 2019, Vanuatu’s four-person CERT team received Cyber Incident Response Team (CIRT) training from ITU. It provided Vanuatu’s computer emergency response team with the necessary tools to assess and respond to different types of cybersecurity incidents.

“Cyber response training is no longer optional for countries wanting to benefit fully from ICTs,” says Marco Obiso, Head of the ICT Applications and Cybersecurity Division at ITU. “ITU is proud to deliver this training to our Member States to ensure the safe continued growth of connectivity in the country.”

The training included ‘over the table’ exercises and helping the country develop a reactive cybersecurity network that facilitates knowledge and information sharing during an incident.

“I think the key [takeaway] from that training is the establishment of the network and the contracts in this different organizations for us to work effectively when incidents are reported to us or the organizations,” Garae said.

The CERT team focuses on cybersecurity awareness programmes for different constituents across the country, including businesses, education institutions and local communities.

“Cybersecurity is not just one man’s job,” Joses said. “If we can inform everyone [through] the awareness programme (…) we can probably minimize the cyber threats or cyberattacks in Vanuatu.”

“Security, at times, comes down to educating the user on the best practices in the right way or guidelines on how to use the internet and be safe,” Garae said.

Learn more about ITU’s CIRT training programme here.

The CIRT training programme is just one of the cybersecurity tools and programmes that ITU provides for our members. Read more about our various cybersecurity initiatives here.

PHOTO: Maximillian Jacobson-Gonzalez/ITU