As attacks become more targeted and coordinated, director of the Jamaica Cyber Incident Response Team (JaCIRT) Lieutenant Colonel Godphey Sterling has warned of some new cybersecurity vulnerabilities expected to become more visible in 2025.

The vulnerabilities, which includes secure socket shell (ssh), network time protocol (NTP) and GPRS Tunnelling Protocol (GTP), he said, are among a slew of others on which his organisation will continue to place heavy focus next year.

“Emerging, in the latter part of the year, these new vulnerabilities will necessitate a shift in focus from the division; however, the CIRT division will continue to expand its public education and awareness activities nationwide in 2025 as we work to secure Jamaica’s cyber network,” he told the Jamaica Observer.

Vulnerabilities, which are weaknesses in an IT system, are often exploited by attackers to gain unauthorised access or to deliver a successful attack. Occurring through flaws, features or user error, attackers are able to exploit systems by combining one or more of these to achieve their end goal. Outside of the latter ones identified, other popular vulnerabilities include SQL injection, cross site script (XSS), broken access control, security misconfigurations, weak passwords and authentication issues, customer premises equipment wide area network management protocol (CWMP) as well as insider threats.

Despite an over 70 per cent drop in the number of attempted cyberattacks seen this year, the JaCIRT head said that as a country we are not yet out the woods and as such, stressed the need for there to be increased vigilance especially during this busy holiday period when persons are often distracted by all the festivities.

Underscoring the work of JaCIRT, which was established to improve the country’s cybersecurity framework, Sterling said the body continues to provide the necessary sensitisation and support as it seeks to fulfil its mandate. Through sustained public education and awareness efforts, the division, he said, has been very instrumental in realising significant reduction in the levels of CWMP vulnerability.

“What we have really done in this season is to ramp up our messaging, normally we would do our 12 days of advice or tips leading into Christmas but what we have done this year is to literally double that. At the moment we’re not only doing stills and silent videos, but also voice and narrated ones aimed at targeting those people we see as being most vulnerable,” he noted.

The JaCIRT head said that as the number of recorded cyberattacks continue to trend down backed by an encouraging level of reduced vulnerability, the need to have greater vigilance becomes paramount.

“As we await the final numbers for the year, we encourage Jamaicans to remain vigilant and continue to mitigate common vulnerabilities in order to minimise the impact of exploitation. We’re expecting to see more successful and targeted attacks in the new year but we’re also hoping that we will see the continued improvement in the levels of awareness which will continue to drive the number of vulnerabilities down. As we continue to work with our stakeholders, we’re hoping that this will become the norm and that the resilience in the sector will also become common place so that we’re able to have a more cyber secure experience all year round,” Sterling also said to the Business Observer.

Director of cybersecurity at Symptai Consulting Rory Ebanks, also stressing the need for persons to exercise heightened vigilance, particularly in this Yuletide season, said that amid increasing social engineering and other Wi-Fi-based attacks, every ounce of caution is necessary.

“In light of the growing targeted attacks, my recommendation is for persons to become more aware as they tighten the monitoring of all their accounts and transactions. It is also important for them to enable the necessary authentication and two step verifications as they also try to protect themselves physically. As hackers continue to get more creative, the projection is, however, for the number of attempted attacks to increase especially with the use of artificial intelligence, and as such, vigilance is key,” he said.