The persistence of digital vulnerabilities and the need for cyber resilience

The recent cyberattacks on government agencies reveal a disturbing pattern and a malicious intent. Ransomware and hacking incidents, including those involving the Department of Science and Technology, the Philippine National Police, and others, demonstrate a deliberate effort to steal data, disrupt services and cause anxiety among the public.

Since 2022, there has been a significant increase in these types of attacks, which are complemented by the spread of disinformation. The timing of these incidents is suspect since many of these events seem to coincide with developments in the West Philippine Sea and the Balikatan military exercises.

For its part, the government's response to these incidents has been consistent but reactive. At the policy level, the recent approval of the National Cyber Security Plan (2024-2028) signaled a strong commitment to address the country’s digital vulnerabilities.

In general, the NCSP provides a framework for public agencies on how to organize, respond, and sustain cybersecurity efforts. To further emphasize its urgency, President Ferdinand Marcos Jr. signed Executive Order 58 mandating its adoption. The order established the National Cybersecurity Inter-Agency Committee to monitor and coordinate the implementation of the NCSP. 

These actions are commendable and are important steps in the right direction. However, the Philippines is confronted with challenges that have compounded over the years and have created opportunities for criminals and state-sponsored malign actors.

For instance, the country’s fragmented and siloed approach to digitalization means that there is little collaboration and adoption of cyber standards, especially in the public sector.

Due to the need for transactional efficiency as mandated by previous laws and programs, security has become an afterthought and a victim of cost-cutting efforts.

Furthermore, government IT initiatives are often funded through agency-specific annual budgets. This means that agencies often lack the time to develop business cases and functional requirements that are crucial in collaboration and determining vulnerabilities. 

This brings us to the penchant for fast solutions and stop-gap