Cybersecurity in the Philippines: Laws and Plans

Cybersecurity in the Philippines and Beyond

• Philippine Cybercrime Law: RA 10175 addresses various cybercrimes, including hacking, data interference, system interference, and online libel. RA 10173 (Data Privacy Act) protects personal data.

• Cybersecurity Enforcement Challenges: Limited resources and public awareness are significant challenges in the Philippines.

• National Cybersecurity Plan 2022: This plan aims to secure critical infrastructure and promote cybersecurity awareness.

• Key Agencies: The Cybercrime Investigation and Coordinating Center (CICC) investigates cybercrimes. The National Privacy Commission (NPC) enforces the Data Privacy Act. DICT (Department of Information and Communications Technology) promotes ICT development and cybersecurity, including operating the Cybersecurity Bureau.

NIST CSF (National Institute of Standards and Technology Cybersecurity Framework)

• Purpose: Designed to help organizations of all sizes and sectors (industry, government, academia, nonprofit) manage and reduce cybersecurity risks.

• Components: The CSF covers various components to manage cybersecurity risks. Safeguards are used to manage cybersecurity. Actions are taken regarding cybersecurity incidents. Categories of detected incidents are described. The framework defines desired outcomes. Privacy events resulting from data processing are part of it. Tiers for implementation are defined.

Specific Laws and Regulations

• RA 10627: This law is not about cybersecurity, but it's important to be aware of laws related to cybercrimes.

• RA 10173 (Data Privacy Act): This law protects personal information and defines responsibilities surrounding data processing.

• RA 10175 (Cybercrime Prevention Act ): This law criminalizes various cybercrimes like hacking, data interference, and online libel.

• E-commerce Law: Covers online transactions and digital contracts. Crucially, it needs to change with the times.

Cybersecurity Threats and Definitions

• Terrorist Organizations: Threaten national security and seek infrastructure destruction or harm.

• Malicious Insiders: Abuse privileges for personal gain.

• Malware: Malicious software – different types such as spyware and adware.

• Social Engineering: Tricking users to provide access points for malware.

• Spyware and Adware: Secretly collect user data or display unwanted ads.

• Cybersecurity Threats: Generally malicious acts like stealing data or disrupting computer systems.

• Sources of Cyber Threats: Includes nation states, terrorist organizations, hackers, and malicious insiders.

• Types of Cyber Threats (Examples): Malware, Advanced Persistent Threats (APTs), Crypto-jacking, Phishing, Denial-of-Service (DoS) attacks, Man-in-the-Middle (MitM) attacks, Insider Threats, Zero-Day Exploits, Credential Stuffing, Supply Chain Attacks, Social Engineering, IoT Vulnerabilities, Password Attacks, and Rootkits.

Data Privacy Act

• NPC Responsibilities: The NPC enforces the Data Privacy Act of 2012 (RA 10173). They perform various roles of enforcement, guidance, compliance checks, and public awareness campaigns about the law with respect to personal information.

• Key Responsibilities: The four key responsibilities of data controllers concerning personal information include transparency, security, lawfulness, and just data collection

• Data Subject Rights: Data subjects have several rights concerning their personally identifiable information, including the right to access their data, update it, and request deletion of it. 

E-commerce Law

• E-commerce Regulations: There are various regulations that govern e-commerce activities.

• Compliance Challenges: One significant challenge in e-commerce is adapting to changing regulatory environments.

• Consumer Trust: Building consumer trust through legal compliance is crucial for success in e-commerce.

• Jurisdictional Differences and Disputes: E-commerce compliance can be complicated by jurisdictional conflicts and differences in regulations.

• Data Handling and Privacy: Mishandling customer data leads to issues about data breaches and privacy violations.

DICT (Department of Information and Communications Technology)

• Purpose: To primarily promote ICT development and, specifically, information and communications technology (ICT).

• Mandates: Develop national policies, strategies, and frameworks; lead cybersecurity efforts. Developing and implementing national cybersecurity policies and programs. Promote the security of the country’s information and communications infrastructure.

Cybersecurity Framework Components

• Technical Security: Includes encryption, network security, and secure data transmission.
• Physical Security: Includes access controls, secure storage of sensitive data.
• National Privacy Commission (NPC): The NPC is a regulatory body ensuring data protection rights.
• Data Privacy Act (RA 10173): A comprehensive law on personal data protection in the Philippines.
• Penalties for Non-Compliance: This includes fines and sanctions for non-compliance with cybersecurity guidelines and laws.
• International Collaboration: Partnerships with international institutions and local agencies to enhance cybersecurity measures are often important.
• NPC Vision: The NPC aims to be a model data protection authority.

Cybersecurity Threats

• Malware Malicious Software
• Man-in-the-Middle (MitM) Attacks: Attackers intercept communications between two parties.
• Zero-Day Exploits Vulnerabilities unknown to the software developer, are exploited.
• Advanced Persistent Threats (APTs): Sophisticated and long-lasting attacks, often state-sponsored or carried out by organized crime groups.
• Supply Chain Attacks: Attacks targeting software suppliers.
• Phishing: Attacks using disguised legitimate entities to obtain sensitive information.
• Rootkits: Malware designed to maintain covert access to a computer system.
• Botnets: Networks of compromised computers controlled remotely; often used for malicious activities like DDoS attacks.
• Social Engineering: Tricking people to divulge confidential information.