Guacamaya Case - EMCO: A Cultural Problem

Cybersecurity Compliance As time goes on, we have learned that the Guacamaya Group attack was successful due to basic IT integrity failures, such as not patching servers and applications according to the manufacturer’s recommendations.

The conclusion from experts is unanimous: the attackers did not require high technical sophistication to exploit this vulnerability. This implies that the attack succeeded due to a lack of information security culture—an issue much deeper than just a technical department’s shortcomings.

The principles of an IT security culture are not new; they are systematized in international certifications such as ISO 27001 and SOC 2, and include several fundamental elements:

Everyone in the organization is responsible for protecting information in accordance with company policies. Additionally, those working on day-to-day operations are the first line of defense, as they have the best visibility into potential weaknesses and attacks.

Responsibility goes beyond job titles or positions. Best practices in this area promote the idea that all members of an organization should be able to report security issues without fear of retaliation.

Leadership within the organization. Those in charge of cybersecurity are called to be true leaders—champions of the culture—promoting and communicating it at all times.

This leadership challenge is what our authorities are now facing. The long-term vision must be to establish a unified state policy that coordinates national cybersecurity efforts.