National Cybersecurity Profile Brazil

Cyber Security

Brazil is the largest country in South America, and one of the world's major emerging economies. Yet, it is still a developing country that has struggled to find stable, reliable government. There are corruption issues that can potential derail any attempt at a coherent national cybersecurity strategy. Brazil has generally been without war, internal or external, for generations, and is not a participant in a major military bloc.

Brazil received a **1/2 star rating from the SDA. The country gains points for having a national cybersecurity strategy. Brazil participates in CERT communities and has its own national CERT. They set up an Information Security Department within the federal government in 2006, adding cybersecurity to this in 2010. There are many weaknesses cited in the SDA report that render Brazil's rating lower, however.

One issue identified is a lack of legislation regarding cybersecurity. The Brazilian government has an attitude that the country is unlikely to be a target of attack and this unfortunately has been used as an excuse for its poor legislative framework, and for the somewhat limited resources that have been put into cybersecurity. What resources do flow into cybersecurity are often subject to police corruption -- funds are used inefficiently as a result of this rampant corruption. The lack of laws has allowed banking Trojan horses to proliferate, to the detriment of consumer confidence, for example. Furthermore, the report cites poor performance by private enterprise in Brazil with respect to cybersecurity, mirroring the generally underdeveloped infrastructure across the region. Even as the region's largest economy, Brazil tends more to benchmark its infrastructure against its neighbors, rather than the leaders in the field.

Recent developments have challenged Brazil with respect to cybersecurity. In 2014, cyberattacks grew by 197% in the country, and there was a 40% increase in online banking fraud. Awareness among members of the public with respect to cybercrime remains low, however (Muggah & Thompson, 2015). Reports indicate that the country's leadership is not responding quickly to the growth in cybercrime targeting Brazilians, and that law enforcement remains a problem. Without adequate police or legal framework, Brazil may well continue to see its cybersecurity situation deteriorate. For consumers, one of the biggest concerns is that there is no law that requires companies to report data breaches (Anscombe, 2015). Thus, breaches occur, the public does not find out, and more damage is done. Companies are also not held accountable for such incidents when there is no reporting, and many Brazilians are simply unaware of the risks and therefore might not be as careful as they otherwise would be with respect to maintaining basic cybersecurity. Cybersecurity laws enacted in 2014 did not address this issue, only covering some of the basics, and remain difficult to enforce because of the country's infrastructure and corruption problems (ITU.int, 2014).