Where Do We Need To Get Better In Cybersecurity In Trinidad And Tobago?

Where Do We Need to Get Better in Cybersecurity in Trinidad and Tobago?

Cybersecurity is often treated as something that only matters to large corporations, banks, governments and technology companies. But as more businesses, schools and individuals move their information and daily operations online, cybersecurity has become everyone’s responsibility.

In this episode of the MakeITSimpleTT Podcast, we sit down with cybersecurity consultant Nathaniel to discuss a straightforward but important question: where do we need to get better when it comes to cybersecurity in Trinidad and Tobago?

The conversation covers everything from vulnerable websites and data leaks to phishing awareness, cybersecurity education, legislation, responsible vulnerability disclosure and the need to develop more cybersecurity talent locally.

Nathaniel also shares his experience working in cybersecurity in Jamaica, participating in a Capture the Flag competition, identifying vulnerabilities in local websites and helping get serious security issues addressed.

Why Do We Need to Get Better at Cybersecurity?

The podcast begins with a simple observation: businesses are eager to build websites, use CRMs, create online systems and adopt new technology, but security is not always given the same level of attention.

Nathaniel points to examples of systems where basic security practices may be overlooked, including administrative accounts that are not properly secured and databases that could potentially expose sensitive information.

The bigger issue is that cybersecurity cannot simply be treated as an optional extra.

When an organization depends on digital systems, a security weakness can affect its customers, employees, finances and reputation.

The challenge is therefore not just building technology.

It is building technology securely.

Cybersecurity Legislation and Accountability

One of the major issues discussed during the podcast is the role of legislation.

Nathaniel explains that his experience working in Jamaica exposed him to situations where organizations affected by cyber attacks had specific procedures to follow, including reporting requirements and potential consequences.

The discussion contrasts this with the situation in Trinidad and Tobago, where the podcast participants argue that organizations have historically faced less pressure to follow comparable cybersecurity procedures.

This matters because regulation can influence how seriously organizations treat cybersecurity.

When businesses know that they may have reporting obligations and consequences following a security incident, cybersecurity can become part of normal business planning rather than something addressed only after an attack.

The podcast therefore raises an important question for Trinidad and Tobago:

Should cybersecurity accountability become a more established part of doing business digitally?

Responsible Vulnerability Disclosure Can Make a Difference

One of the most encouraging parts of the conversation is Nathaniel’s experience with responsible vulnerability disclosure.

After participating in an Organization of American States and TTC-related Capture the Flag competition, he connected with other participants and helped establish a community where they could discuss cybersecurity.

The group began examining local websites and identifying vulnerabilities.

Rather than exploiting those weaknesses for personal gain, they documented the issues and submitted vulnerability disclosure information through the appropriate channels.

Nathaniel explains that some of the vulnerabilities they discovered were subsequently addressed after being reported to TTC.

That demonstrates an important principle in cybersecurity:

Finding a vulnerability is only part of the job. Responsible disclosure can help turn that discovery into a security improvement.

What Is an API Leak?

One example discussed in the podcast involved an API exposing sensitive information.

For people who are not developers, an API can be thought of as a way for different parts of a software system to communicate.

For example, a website may need customer information stored in a database. The website can communicate with the database through an API.

The problem occurs when that API is poorly configured or does not properly restrict what information someone can request.

Nathaniel describes a situation where an API was exposing records containing information such as:

– Names
– Addresses
– Files
– Pictures
– Other sensitive information

This is why APIs need proper authentication, authorization and access controls.

An API should not simply provide whatever information exists in a database because someone asks for it.

The Danger of Copying the Same Website Across Multiple Businesses

Another interesting cybersecurity lesson from the episode involves organizations using similar websites for multiple businesses.

Nathaniel explains that after identifying a vulnerability on one website, he noticed that several other websites appeared to use essentially the same implementation.

By comparing and testing the sites, he discovered that the same vulnerability existed across multiple websites.

This highlights an important security principle:

One vulnerability can become many vulnerabilities when the same technology is repeatedly deployed without fixing the underlying problem.

Instead of treating each website as a completely separate issue, developers and organizations should look at the systems, plugins, templates and infrastructure being reused.

Fixing the root cause can potentially protect multiple systems at once.

Cybersecurity Is Not Just About Hackers

When people hear the word cybersecurity, they often imagine penetration testers, hackers, Kali Linux and complicated technical tools.

But a large part of cybersecurity is much simpler.

It involves people.

The podcast turns toward phishing, scams and everyday online behavior, particularly the way people respond to suspicious emails and messages.

Nathaniel argues that organizations need proactive cybersecurity and phishing training so employees can recognize suspicious activity before something goes wrong.

This is especially important because an attacker does not always need to break through a sophisticated technical security system.

Sometimes, they simply need someone to click the wrong link.

Why Phishing Awareness Matters

Phishing attacks are designed to manipulate people into taking an action.

That action could involve:

– Clicking a malicious link
– Opening a dangerous attachment
– Entering login information
– Sending money
– Sharing confidential information
– Installing malicious software

The podcast points out that people sometimes see an offer that appears too good to be true and still click on it.

The example used during the conversation is the familiar promise of free gaming currency.

The lesson is simple:

Stop and think before clicking.

Cybersecurity awareness is therefore not only a technical subject. It is also about understanding how people make decisions.

Cybersecurity Education Should Start in Schools

One of the strongest ideas discussed in the episode is the importance of introducing cybersecurity awareness earlier.

Computer science may already be part of education, but the speakers argue that cybersecurity awareness should receive more attention.

Students should learn not only how computers and software work, but also how to protect themselves while using them.

That includes understanding concepts such as:

– Strong passwords
– Multi-factor authentication
– Phishing
– Online scams
– Privacy
– Safe browsing
– Social engineering
– Protecting personal information
– Recognizing suspicious messages

The goal should not simply be to tell students, “Don’t click that.”

It should be to help them understand why the message is suspicious in the first place.

Nathaniel describes cybersecurity awareness as being partly psychological rather than purely technical.

Two-Factor Authentication Is Part of Basic Digital Hygiene

Two-factor authentication, commonly called 2FA or multi-factor authentication, is another topic discussed in the episode.

Some users find it annoying to enter an additional verification code when logging into an account.

However, that additional step can provide another layer of protection if a password has been compromised.

As more services require additional authentication, users are becoming increasingly familiar with the process.

The broader lesson is that cybersecurity should become part of basic digital hygiene, much like locking your doors or protecting your physical belongings.

You do not wait until something is stolen before deciding that security matters.

The same mindset should apply online.

Businesses Need to Take Cybersecurity Seriously

The responsibility does not only fall on individuals.

Businesses that rely heavily on digital systems also need to invest in cybersecurity awareness.

That can include regular staff training, phishing simulations, secure authentication, software updates, backups, access controls and incident-response planning.

Nathaniel specifically emphasizes proactive cybersecurity and phishing training for digital organizations.

This is particularly relevant to small and medium-sized businesses.

A company does not have to be a large corporation to become a target.

If a business stores customer information, accepts online payments, operates a website or uses cloud services, cybersecurity should already be part of its planning.

Trinidad and Tobago Needs More Cybersecurity Talent

The conversation also explores the local cybersecurity talent pool.

Nathaniel describes participating in a Capture the Flag competition and finishing first among 58 teams.

The competition exposed participants to challenges involving things such as hidden information in files, corrupted documents, APIs and web vulnerabilities.

Interestingly, Nathaniel also comments that the local talent pool appeared smaller than he expected.

That presents both a challenge and an opportunity.

If Trinidad and Tobago wants to strengthen its cybersecurity capabilities, there needs to be a pathway for people to discover the field, develop practical skills and eventually enter the profession.

Hack The Box: A Practical Way to Learn Cybersecurity

Toward the end of the podcast, the conversation turns to Hack The Box.

Nathaniel strongly recommends it as a starting point for people who want to learn cybersecurity.

The platform provides practical environments where learners can work through cybersecurity challenges rather than simply reading theoretical material.

Nathaniel describes the experience as closely connected to the type of work he performs as a cybersecurity consultant.

For someone interested in cybersecurity, practical learning can be extremely valuable.

Instead of only memorizing definitions, learners can develop problem-solving skills by working through realistic scenarios in controlled environments.

Of course, cybersecurity practice should always be performed in authorized environments.

Building a Cybersecurity Community

Nathaniel also discusses plans to develop a dedicated cybersecurity community and website.

The goal is to provide more hands-on technical training, cybersecurity education and phishing awareness for businesses.

Rather than simply giving people an online certificate, the idea is to help people develop skills they can actually use.

That approach could be valuable for Trinidad and Tobago because cybersecurity requires both technical knowledge and practical experience.

A stronger community can also help people learn from one another, discover career opportunities and expose more young people to the field.

Cybersecurity Can Be a Career Path

For students considering technology careers, cybersecurity is another area worth exploring.

The podcast highlights how someone can move from a different technical background into cybersecurity and eventually work professionally in the field.

It also emphasizes the importance of continuous learning.

Cybersecurity is constantly changing. New technologies create new vulnerabilities, while attackers continually develop new techniques.

That means cybersecurity professionals have to keep learning long after they leave school.

Nathaniel encourages students to consider cybersecurity as a field with room for growth.

Where Do We Need to Get Better?

So, where exactly do we need to improve?

The discussion points to several areas.

1. Cybersecurity Awareness

People need to understand common threats such as phishing, scams and social engineering.

2. Business Security

Organizations need to make cybersecurity part of their normal operations rather than waiting until something goes wrong.

3. Education

Cybersecurity awareness should be introduced earlier, including in schools.

4. Responsible Disclosure

There should be clear ways for security researchers to report vulnerabilities and for organizations to respond.

5. Legislation and Accountability

The country needs effective frameworks for handling cybersecurity incidents and protecting digital systems.

6. Practical Training

People interested in cybersecurity need opportunities to develop real technical skills.

7. Local Talent Development

Trinidad and Tobago needs to continue developing cybersecurity professionals who can work locally and internationally.

Cybersecurity Is Everyone's Responsibility

Perhaps the biggest takeaway from the podcast is that cybersecurity cannot be left entirely to IT departments.

A company can have a talented IT team and still be compromised because an employee clicked a malicious link.

A developer can build a beautiful website that still contains a serious security vulnerability.

A student can understand computers but still fall for a convincing phishing message.

Cybersecurity works best when everyone plays a part.

For businesses, that means building security into technology from the beginning.

For developers, it means considering security while building and deploying systems.

For schools, it means teaching students how to navigate the digital world safely.

And for individuals, it means developing better digital habits.

Final Thoughts

The question “Where do we need to get better?” is bigger than cybersecurity alone.

It is really a question about how Trinidad and Tobago approaches technology.

As more services move online, the country needs people who can build, manage and secure those systems.

The podcast shows that there are already people in Trinidad and Tobago developing serious cybersecurity skills, participating in competitions, identifying vulnerabilities and looking for ways to help organizations improve.

The next step is making cybersecurity awareness and practical education more widespread.

Technology gives us enormous opportunities.

But the more dependent we become on technology, the more important it becomes to understand how to protect it.

Cybersecurity is not just about stopping hackers. It is about building a safer digital environment for everyone.

Cybersecurity legislation and accountability
Responsible vulnerability disclosure
API security and data leaks
Website vulnerabilities
Cybersecurity awareness for businesses
Digital hygiene and two-factor authentication
Cybersecurity education in schools
Trinidad and Tobago's cybersecurity talent pool
Practical cybersecurity training
Hack The Box
Building a stronger cybersecurity community
Cybersecurity as a career