• State of the attack landscape • State of the cybercriminal underground State of Government Response to Cybercrime Member State responses to cybercrime remain uneven. Many governments began taking serious steps to strengthen cybersecurity following the adoption of the 2004 OAS Cybersecurity Strategy. On the whole, political leaders are aware of the dangers that hackers and cybercriminals pose to development and public safety. Political will, however, does not always lead to changes in the status quo. In Latin America, efforts are most often hamstrung by two things— lack of resources dedicated to building cybersecurity capacity and shortage of specialized knowledge and expertise to implement technical policies or capabilities. Latin America still faces budgetary constraints, and spending plans do not often contemplate large expenditures on things like IT security. Funds are more often spent on hard security, although this will likely change as cyber-risks increasingly pose threats to physical and economic well-being and government stability. In any case, it is important to note that despite constrained budgets, countries can still make great strides in cybersecurity. Uruguay, for instance, has developed a robust CSIRT and overall cybersecurity capability with minimal financial resources. Other countries have studied and implemented costeffective awareness-raising programs to educate citizens. The amount of free cybersecurity software to which countries have access is astounding, although countries are not always able capitalize on opportunities. The shortage of specialized knowledge and expertise needed to implement technical initiatives could be attributed to low enrollment in technical-degree programs. The lack of qualified experts in the Americas means that countries are virtually drowning in an unusable sea of open source cybersecurity software and educational materials. Some countries experience this shortage more than others, but the problem can be aided by international cooperation. The OAS will continue to promote networking and facilitate the exchange of best practices and professional knowledge within and between Member States. By ensuring the flow of information, countries can continue to add value to trainings and lessons learned. In the context of the two aforementioned shortcomings, countries are struggling to raise awareness among their citizens and experiencing difficulties to maintain momentum in implementing technical and policy-based solutions to cybersecurity problems. Some governments do not have a central repository for information on cyber incidents. Some do not have the capability to respond to incidents. Even those that have taken certain steps experience problems with sharing information across ministries and departments. This reality was reflected again and again in the OAS government surveys. But countries are moving in the right direction. The aforementioned success stories highlighted just a few initiatives that Member States have adopted. Awareness of cybersecurity issues is increasing every day and governments are striving to improve their policy instruments. Much work still needs to be done, however, to keep pace with those seeking to corrupt critical networks and abuse personal information. PAGE 23 | Latin American and Caribbean Cybersecurity Trends and Government Responses