Diego Zuluaga, coordinator of the Industrial Cybersecurity Center (CCI) in Colombia (CCI Coordinators Team), helps put the state of industrial cybersecurity in his country in context, and shares his impressions below.
He describes the level of awareness among industrial organizations in the country as follows:
He adds that the trend over the past year has been exponential growth.
Colombia has several national public bodies working to build an adequate legal framework that ensures the progressive incorporation of industrial cybersecurity into the structures of companies operating nationally (mainly critical infrastructure). The most relevant include:
- Colombian Cyber Emergency Response Group — colCERT
- Joint Cyber Command — CCOC
- Police Cyber Center — CCP
- MINTIC
- Ministry of National Defense
The main national laws and regulations affecting this context in Colombia include:
- CONPES 3701
- Law 1273 of 2009
- Law 1341 of 2009
- Law 1621 of 2013 (legal framework for the functions of intelligence and counterintelligence agencies and the protection of databases)
- Decree 0032 of 2013 (creation of the National Digital and State Information Commission)
Among the industrial cybersecurity measures widely adopted by Colombian organizations to protect industrial automation systems, the following stand out:
- Industrial cybersecurity consulting and advisory services
- Ethical hacking
- Implementation of security management systems
- Internal security audits
- External security audits
- Network and architecture design
- Development of continuity and/or contingency plans
- Industrial firewalls
- SIEM (security information and event management)
- Industrial application control
SWOT analysis for Colombia
The CCI coordinator in Colombia characterizes the country's situation regarding industrial cybersecurity through the following SWOT:
Weaknesses
- Lack of certifications for OT technology, processes, and professionals
- Lack of specific industrial cybersecurity regulation
- Lack of a catalog of industrial cybersecurity solutions and services
- Lack of dedicated CERTs
Strengths
- Momentum from public organizations (Industry, Interior, and Defense)
- Awareness, especially in critical industrial infrastructure
- Frequent events and forums on industrial cybersecurity
Threats
- Slow legislation
- Shortage of local cybersecurity professionals at industrial manufacturers
- Shortage of risk management tools specific to industrial cybersecurity
Opportunities
- Growing demand for cybersecurity for Industry 4.0 and the Internet of Things
Source: www.cci-es.org/maps/colombia