Brazil reaches towards cybersecurity maturity

Legislative improvements in recent years may stem cybercrime in Latin American country

After years of high-profile cyber-attacks, Brazil has received a glowing report for its cyber security maturity.

The Organization of American States (OAS) and the University of Oxford's cyber security centre consulted with Brazilian government agencies and national Cybersecurity Incident Response Teams to evaluate the nation's preparedness.

And, they found, the country has made great strides in the past three years in terms of the creation of legal frameworks related to cybersecurity, awareness initiatives and standards, organizations and technologies.

“In particular, the country possesses remarkable strength in his handling of cyber incidents and in the existence of a cybersecurity awareness at various levels of government,” says the team.

“Given that Brazil has hosted several international events in recent years, this has allowed the development of cyber crisis management protocols by different response teams. Different government units maintain these action protocols with specific knowledge of their role, and they have been adapted according to different types of attack.”

É muito melhor?

Brazil has been something of a cybercrime hotbed over recent years, particularly known for banking trojans that have affected local as well as foreign banks.

Organizations within the country also took quite a bashing in 2016 when the country hosted the Olympics, and cybercrime generally remains high (see panel). While Brazil currently ranks 70th in the ITU's Global Cybersecurity Index, it's the second-most-affected nation in the world for ransomware attacks.

Indeed, earlier this year, a report from Sophos found that 65% of organizations in the country had been hit by ransomware in the previous 12 months.

Impressively, though, more than a third of attacks were stopped before the data was encrypted, making Brazil the fourth most successful country at foiling attacks.

The country has also experienced more than its fair share of coronavirus pandemic-related scams - perhaps unsurprisingly, given the country's soaring infection rate.

Read more of the latest policy and legislation news

According to Kaspersky, phishing attacks against mobile devices increased 124% during February and March this year as the disease started to take hold, making it the fifth-most attacked in the world.

Meanwhile Security Intelligence reports that nearly 700 new Covid-19-related malicious websites have been created in Brazil this year, many aiming to exploit the country’s pandemic assistance program.

Legislative progress

Earlier this year, Brazil published its first national cyber security strategy, aiming to bring together a number of separate initiatives and policies and to raise awareness of the issues. A Cybersecurity Bill is set to follow.

The OAS report suggests, though, that legislation has not been the problem: it's enforcement and responsiveness that need to improve.

“Despite the ongoing political discussions about these issues, there are still legislative gaps in the implementation process that Brazil should overcome,” reads the report.

“Therefore, the lack of enforcement of cybercrime legislation and lenient punishments tend to encourage cybercriminals.”

Notable cyber attacks in Brazil (panel)

July/August 2016: In the run-up to the Summer Olympics in Rio de Janeiro, hacktivist collective Anonymous Brasil launches a series of distributed denial of service (DDoS) attacks on the websites of state and municipal authorities, including the portal of the State Government of Rio de Janeiro and the official website of the Rio 2016 Olympic Games. Other websites are also targeted, including those of Rio de Janeiro’s military police department, the Institute of Public Security, and several public utilities.October 2016: hackers successfully accessed and changed the DNS registrations of all 36 of Brazilian bank Banrisul’s online domains. Desktop and mobile users were redirected to phishing sites.May 2017: Brazil is hit by the global WannaCry ransomware, affecting the social security authority, the country's largest telecommunications operator, Vivo, the public prosecutor’s office in São Paulo and the energy company Petrobras.October 2018: A massive botnet comprising 100,000 routers is discovered to be hijacking traffic meant for Brazilian banks and redirecting users to phishing pages.April 2020: IBM discovers a new Android application impersonating Brazilian banks and designed to steal users’ login credentials.June 2020: Anonymous hackers access the personal information of President Jair Bolsonaro and other cabinet members and publish it online.

YOU MIGHT ALSO LIKE RSA Conference: Latin American cybercrime ecosystem exposed