A lack of management commitment and a shortage of cybersecurity specialists are hindering improvements in cybersecurity across Latvia, according to Dana Ludviga, Information Systems Security Analyst and Head of International Cooperation at CERT.LV.
Commenting on the factors preventing improvements in Latvia’s cybersecurity, Ludviga identified management’s lack of interest and the shortage of qualified cybersecurity professionals as two major obstacles.These factors are often decisive. Even if an organisation employs a skilled and knowledgeable specialist who can accomplish a great deal, without management support and an appropriate organisational framework, that employee cannot ensure everything necessary to protect the entire information technology (IT) infrastructure, regardless of their qualifications.Effective cooperation is therefore essential. Ludviga encouraged managers to have open discussions with their IT employees about the current situation and necessary improvements in an informal setting, such as over lunch.
Although financial constraints may prevent organisations from addressing every problem and requirement immediately, it is important to identify the most pressing issues and establish priorities, Ludviga stressed. She noted that such conversations should take place now rather than during an actual cybersecurity incident, as is often the case. It is equally important to invest not only in the knowledge of IT specialists but also in the cybersecurity awareness of all other employees, ensuring they understand how to respond to incidents, are not afraid to report them and do not simply wait for problems to resolve themselves.
Ludviga emphasised that cybersecurity is not a project that can be completed and then set aside for several years under the assumption that everything necessary has been done. Nevertheless, this approach remains common among some institutional leaders. The shortage of skilled cybersecurity experts is a serious problem not only in Latvia but worldwide, Ludviga said. Moreover, the public sector sometimes struggles to compete with large companies in terms of salaries. However, one possible solution is to invest in improving the knowledge and skills of existing employees.
Rather than waiting for a new generation of specialists to emerge, organisations can send their current staff to training programmes and courses, focusing on the specific skills their organisation requires,
as cybersecurity needs may differ from one organisation to another, Ludviga explained. She recalled that two years ago, when CERT.LV organised cybersecurity meetings specifically for organisational leaders, many managers failed to attend or, at best, sent representatives to listen to the information and pass it on. The situation has now changed. Ludviga suggested that this shift may have been influenced by the CSDD cybersecurity incident, growing public interest and the increasing intensity of cyberattacks. She emphasised that managers now attend meetings, listen to the information presented and ask questions.
Although some companies have always paid considerable attention to cybersecurity, the majority previously displayed a dismissive attitude, believing that other priorities were more important. According to Ludviga, organisations are now significantly more receptive to cybersecurity initiatives.
Discussing the need to improve the regulatory framework, Ludviga said substantial work had already been completed in this area. The National Cybersecurity Law and other regulations clearly define the distribution of responsibilities. Therefore, the main priority now is to begin complying with the adopted requirements rather than resisting them. This particularly applies to compliance with the Cabinet of Ministers’ regulations on minimum cybersecurity requirements. The case involving PHP vulnerabilities clearly demonstrated that the time available to implement necessary updates is becoming increasingly short, making compliance with these requirements particularly important, Ludviga said.
Commenting on the preparedness of government institutions for different types of cyberattacks, Ludviga noted that the situation varies between institutions but is generally not poor.
CERT.LV is always open to cooperation and offers various security solutions free of charge to all entities covered by the National Cybersecurity Law. The institution does not dictate how organisations should operate but can highlight both good and less successful practices and recommend solutions to problems that organisations themselves may not yet have identified. CERT.LV has access to broader information about cyber threats and their various forms, enabling it to help organisations strengthen their IT infrastructure with the necessary security measures, Ludviga explained. She added that the greatest problems usually arise in organisations with numerous areas of responsibility and multiple external service providers, where it ultimately becomes unclear who is responsible for what. In this respect, establishing the position of cybersecurity manager is particularly important, as such a specialist can help clarify responsibilities and oversee cybersecurity matters.
Meanwhile, Ludviga believes that the cybersecurity skills of the general public are improving, as substantial resources are being invested in education and public awareness campaigns. However, cybercriminals are also learning and developing their capabilities, and they are doing so slightly faster. Ludviga stressed that a large proportion of cyberattacks still rely on social engineering. Therefore, technical knowledge alone is not enough. People’s well-being and their ability to critically assess the information they receive are equally important. Excessive workloads and fatigue can weaken people’s vigilance, creating opportunities that attackers can exploit.