A Computer Emergency Response Team (abbreviated “CERT”) is basically a government organization staffed with Cyber Security experts who are responsible for handling untoward incidents involving the theft, corruption or loss of critical data. For example, if a national corporation is subjected to a cyber attack, the country’s CERT would step in for help during (ideally) or after an incident has occurred.
As far as Pakistan is concerned, there is only one federal agency which remotely deals with the aspects of a CERT, the National Response Centre for Cyber Crimes (NR3C). It is subservient to the Federal Investigation Agency (FIA) and boasts expertise in Digital Forensics, Information System Security Audits and Penetration Testing on its official website. A few Assistant Directors at NR3C with whom PakWired held phone discussions acknowledged that they are mainly concerned with minor cases involving identity theft/fraud through computer hacking whereas the core technical responsibilities of a CERT are not probed into as they should.
Cyber Security has never been a priority of any regime in Islamabad since threats from cyberspace aren’t taken too seriously unless they involve embarrassing “whistleblowing” related to political maneuvers. Pakistan’s neighbor India has a fully functional CERT-In (Indian CERT) which recently signed MoUs with three Asian countries for cooperation in tackling cyber threats, namely Malaysia, Singapore and Japan.
Image Source: nh-static.co.uk
When it comes to matters related to Cyber Security, Pakistan is somewhat of an orphan. There is no focal agency to deal with doomsday scenarios in case, say, enemies of the country waged crippling attacks on critical national infrastructure. What will be the state’s response? Will information systems be recovered and the security shield around their networks be improvised? There has been a criminal silence around this issue since long. Another problem is that Pakistan has not made efforts to build a skilled and competent taskforce of cyber security professionals. The result? Very few experts and even fewer policy makers who try advocating for the seriousness associated with cyber threats.
A number of private cyber incident response firms operate in Pakistan but they cater to a specific category of clients and do not have the resources to simultaneously on more than one given case at a time, especially those of strategic national importance. Such measures require greater awareness and the recruitment by the hundreds of Cyber Security professionals who can proactively keep themselves abreast of the latest cyber threats and share advance cyber intelligence with national stakeholders (business, banks, industries, government, etc) for maximum protection against malware, viruses and Trojans.
Ideally, Pakistan should have a CERT headquartered at the Ministry of IT & Telecommunications (MoITT) with zonal offices in all four provincial capitals including Azad Jammu & Kashmir and Gilgit-Baltistan. Having 24×7 protection of national cyberspace by a vigilant CERT will at least help in identifying threats before any serious ramifications occur. Men and women working in day and night shifts alternately can keep watch over a list of defined critical networks while also being available for assistance to ordinary citizens’ individual cases from time to time.
A draft presented before the Senate of Pakistan on April 14, 2014 titled “National Cyber Security Council Act, 2014” called for the establishment of a National CERT under public-private partnership including industry and sector-specific CERTs. However, that draft never saw the light of day because the country’s lawmakers to this day, with the exception of a handful, don’t have basic understanding of cyber threats.
With the ushering of a new year, it is hoped that the Government of Pakistan will do the unthinkable and establish a national CERT to join ranks of underdeveloped countries which have paid full heed to immediate priorities.
Top image via: shutterstock
Leave a Reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
