Strengthening the country's cyber-security necessarily involves running a migration program [1] to open source platforms. We will be speaking with Miguel Gutiérrez Rodríguez, General Director of Informatics of the Ministry of Communications of Cuba about the actions that are being undertaken to achieve this objective.

OPS: You have acknowledged that there has been little progress regarding the migration to open source platforms in the last few years. What leads you to think that it could all change from this moment on?

MGR: You see, we are talking about a very complex subject, taking into account the lack of cyber-security awareness among directors, specialists and the population in general; insufficient perception of risks; the tendency to reject changes; the lack of a repository of national applications in free software that covers the existing needs; technological obsolescence, the diversity of devices (printers, bar-code readers, scanners) of a part of the country's computing means, among other problems.

These changes will not be achieved overnight, but we intend that in three years the organs and agencies of the Central Administration of the State, and the infrastructure of strategic entities, migrate to a nationally produced open source operating system that meets the quality and security standards required by the entities. This will allow us to create the conditions for further progress in the business system and the rest of the organizations.
 

The Decree-Law on the Informatization of Cuban Society and the ICT Security Decree, which will be shortly approved, as well as a specific regulation for this process, which is being drafted, establish the general guidelines for it.

The challenge is significant if we take into account that the General Customs Office of the Republic began its migration process in 1999 and concluded it fundamentally in 2010, but I believe we can achieve it with the help of everyone and the leadership of the top officials in each place.

OPS: What actions must be immediately undertaken in order to advance towards achieving this objective?

MGR: Right now, we are studying with the developers how to increase the production of programs and computer applications compatible with open source operating systems that support the implementation of the migration process to platforms of the same type. It becomes essential to have a repository with these applications.

We also have to ensure the training of the personnel once these applications have been created, as well as their sustainability and evolution, and provide technical advisory too.

In practical terms, we have to exploit some applications that are already used in various entities and promote their use. It is necessary to materialize the process of education or training of personnel on the development, implementation, administration, and deployment of technical support and on the use of the NOVA operating system, the OpenOffice office suite, Firefox Browser, and Thunderbird mail client, or similar, among others.

I would like to use this opportunity to inform that this migration will be carried out in an orderly and progressive manner and where it is essential, it will coexist with the proprietary systems, provided that they satisfy the security requirements and informatization needs of each entity.

OPS: In this process, it is important to bear in mind the experiences of the General Customs Office of the Republic, to avoid or minimize the inconveniences and difficulties that they already went through. What are the most important aspects of the migration process at this institution that, as you said, lasted about 11 years?

MGR: Since 1999, the Customs Office has been migrating to operating systems, office automation and development tools on open source platforms. Currently, 100% of their workstations use the Ubuntu operating system, which guarantees relatively high security and technological independence. They started with Ubuntu version 6 and they are now using version 16.
 

We will now have the advantage of having legal standards to support this program, as opposed to 1999.  Moreover, I am sure that, after a while, some of them will have to be re-adapted to the current situation.
 

Directors and specialists of the Customs Office consider that a crucial factor was the participation of the top management of this organization, particularly the Brigadier General Pedro Ramón Pupo Pérez, who successfully led this complex cultural and technological transformation from the beginning. Systematic personnel training was an essential element when assimilating changes. They also organized a migration for servers sorted by services and on desktops they used free variants depending on their technical conditions. In order to move from Windows to Linux, they used virtualization technology.

They are currently working on strengthening the technological infrastructure to maintain the vitality of the systems and achieve their integration, in such a way as to ensure the necessary balance between the provision of the services they offer and security.

It should be pointed out that there are other entities that have advanced in this process with the help of universities. Most of the Organizations of the Central Administration of the State (OACE) use free software on the operating systems for network management.

Since 2005, the Customs Office has a strategic alliance with the University of Computer Science (UCI) that has allowed the development in open source of several projects such as the Integral Management System of Customs, which is linked through electronic exchange of data with foreign trade operators, shipping lines, airlines, port and airport operators, warehouses and border authorities; Customs Single Window that allows external users involved in foreign trade to carry out formalities before Customs and at the same time receive a response; Gateway for the exchange of Customs-Immigration information; Advanced Information on passengers, crew and cargo in accordance with international standards and mobile applications for different customs services.

They have hired several services from the company Segurmatica S.A., such as the PC license for Kaspersky antivirus software, servers and virtualization infrastructure, and the Segurmática Antivirus version for mobile devices; as well as advisory services concerning websites and vulnerability management.

It should also be mentioned that they have implemented a group of technical and organizational measures that have a significant impact on security and that, together with the aforementioned, minimize the risks for the occurrence of cyber-security incidents.

1] The organized replacement of the operating system and all proprietary applications used in computers by open source ones; whose previous evaluations have demonstrated stability, security, interoperability, as well as their feasibility of being audited.