CYBERSECURITY AWARENESS IN SRI LANKA: CLOSING THE GAP BETWEEN DIGITAL AMBITION AND OPERATIONAL REALITY

Executive Summary

Sri Lanka is at an important point in its digital development. Government services, financial services, telecommunications, healthcare, education and private-sector organisations are becoming increasingly dependent on digital platforms and interconnected information systems. At the same time, cyber threats are evolving rapidly, creating risks that cannot be addressed through technology alone.

During a recent visit to Sri Lanka, I had the opportunity to meet and speak with a number of information technology and cybersecurity leaders and professionals. These discussions provided useful insight into the country’s cybersecurity environment and, more importantly, highlighted a recurring theme: Sri Lanka does not lack capable technology professionals or an understanding that cybersecurity matters. The greater challenge is translating that understanding into consistent cybersecurity practices across organisations, government departments and the wider community.

These observations should not be interpreted as a comprehensive assessment of Sri Lanka’s cybersecurity maturity. They are practitioner observations arising from discussions and experiences during the visit. Nevertheless, they align with challenges recognised within Sri Lanka’s own digital transformation initiatives. The Information and Communication Technology Agency of Sri Lanka (ICTA), for example, has acknowledged differing levels of digital maturity across government organisations and the need for structured programmes to improve the digital capabilities of public-sector employees.

At the national level, important foundations are already being established. Sri Lanka’s National Cyber Security Strategy 2025–2029, focuses on enhancing regulatory frameworks, improving cybersecurity knowledge, strengthening preparedness and response capability, and increasing national and international cooperation. Sri Lanka CERT provides national incident response and cybersecurity coordination capabilities, while the country has also established legislation including the Computer Crime Act No. 24 of 2007 and the Personal Data Protection Act No. 9 of 2022, subsequently amended in 2025.

The challenge is therefore not starting from zero. It is closing the gap between national cybersecurity ambition and everyday operational cybersecurity practice.

Areas requiring particular attention include basic cyber hygiene, ageing and legacy technology, inconsistent identity and email systems, protection of citizen information, cybersecurity awareness among government employees, organisational accountability for cyber risk, and continued development of cybercrime investigation capabilities within law enforcement.

The most significant improvement may come not from purchasing additional cybersecurity technologies, but from treating cybersecurity as a fundamental component of public administration, organisational governance and digital transformation.

A Country Rapidly Becoming More Digital

Sri Lanka’s digital transformation creates considerable opportunity.

Digital government services can improve access to services, reduce administrative overhead, increase transparency and enable citizens to interact with government more efficiently. Digital payments, cloud services, electronic identity, online public services and interconnected government systems can all contribute to economic development.

Sri Lanka is actively pursuing this direction. Government initiatives include digitalisation of government institutions, cloud infrastructure, digital identity, online payments and broader development of the digital economy. ICTA has also developed programmes intended to increase digital maturity across government and build digital transformation capability within the public service. However, every digital transformation also creates a corresponding increase in cyber risk.

Moving a previously paper-based process online does not simply make the process digital. It introduces identities, passwords, databases, APIs, networks, devices, cloud infrastructure and potentially Internet-facing applications. Each becomes part of the organisation’s attack surface.

As digital dependency increases, cybersecurity therefore becomes much more than an IT department responsibility. It becomes an organisational resilience issue.

A government agency unable to access a critical system following ransomware is facing a service-delivery problem. A compromised citizen database becomes a privacy and public-trust issue. A fraudulent government email account becomes an identity problem. A compromised payment platform becomes an economic problem.

Cybersecurity must consequently develop alongside digital transformation rather than follow it.

The Cybersecurity Awareness Gap

One of the strongest impressions from my discussions in Sri Lanka was that cybersecurity awareness varies significantly depending on the organisation and the people involved.

There are capable cybersecurity and technology professionals operating within the country. Sri Lanka has an established cybersecurity community, Sri Lanka CERT, technology companies, security practitioners, universities and increasingly mature cybersecurity functions within some larger organisations. The challenge occurs when moving beyond specialist technology teams.

Cybersecurity often remains perceived as something that belongs to the IT department. Employees may understand phishing at a basic level but may not necessarily understand why sending information through a personal email account, reusing passwords, sharing accounts, connecting unmanaged devices or bypassing organisational processes can create significant risk.

This is not uniquely a Sri Lankan problem. Organisations around the world struggle with the difference between security awareness and secure behaviour.

An employee may know that passwords should be protected and still reuse one across multiple services. A manager may understand that personal information is sensitive but still send it through an inappropriate channel because that is the fastest way to complete an urgent task.

Effective cybersecurity awareness therefore needs to move beyond annual presentations and compliance exercises.

Employees should understand:

• what information they are responsible for;
• which systems and communication channels they should use;
• how to recognise suspicious activity;
• how to report a potential incident;
• why security controls exist; and
• what practical action to take when approved technology does not meet their operational needs.

Sri Lanka already has government-level guidance recognising the importance of cybersecurity awareness. ICTA’s published Information Security Policy for Government organisations, developed in collaboration with Sri Lanka CERT, states that organisations should conduct information-security training and awareness for employees at least every six months. However, the existence of such policy requirements does not necessarily demonstrate consistent implementation or effectiveness across all government departments.

The opportunity is to turn policy requirements such as these into measurable behavioural outcomes.

When Employees Use Personal Email to Get the Job Done

Perhaps one of the simplest examples of the gap between policy and operational reality is the use of personal email accounts for government business.

During my visit, I observed examples of government employees using personal email services to communicate information associated with their work, including information relating to citizens.

It would be easy to frame this purely as irresponsible employee behaviour. In my view, that would misunderstand the underlying problem.

In many cases, employees are not deliberately attempting to circumvent security. They are attempting to do their jobs.

Some may not have practical access to an official departmental email service. Others may not know whether one is available, may have difficulty accessing it, or may find that approved systems do not adequately support how they need to work.

This is fundamentally a systems and governance problem before it becomes an employee problem.

If the secure method is difficult, unavailable or unclear and an employee must complete a task, people will naturally create workarounds.

From a cybersecurity perspective, however, the consequences can be significant.

Government information transmitted through personal email may fall outside organisational monitoring, retention, access control, incident response and data-loss-prevention mechanisms. When an employee leaves an organisation, information may remain within a personal account. Personal accounts may also have weaker authentication and recovery mechanisms than centrally managed enterprise identities.

The organisation can also lose visibility over where citizen information has travelled.

This issue becomes increasingly important as Sri Lanka implements its personal-data protection regime. The Personal Data Protection Act No. 9 of 2022, amended through the Personal Data Protection (Amendment) Act No. 22 of 2025, establishes a developing regulatory framework around the processing and protection of personal information. The Data Protection Authority has also published specific material concerning application of the PDPA within the public sector.

The solution should not simply be issuing a circular telling employees to stop using personal email.

Government employees need reliable official identities, accessible email and collaboration platforms, appropriate storage systems, clear information handling requirements and practical training explaining how those systems should be used.

Security controls work best when the secure option is also the easiest option.

Legacy Technology Creates Systemic Risk

Another issue facing many organisations is legacy technology.

Older operating systems, unsupported applications, ageing infrastructure and bespoke software can remain operational for many years because replacing them is expensive, complicated or disruptive.

Government environments are particularly susceptible because applications can become deeply embedded into administrative processes.

The cybersecurity problem with legacy technology is not simply that a system is old.

The greater risk is that an organisation may no longer be able to effectively secure it.

Security patches may no longer be available. Software may depend on obsolete technologies. Authentication mechanisms may not support modern controls such as multi-factor authentication. Logging may be insufficient for modern security monitoring. Systems may also have undocumented dependencies that make replacement difficult.

Legacy environments therefore accumulate what could be described as cybersecurity debt.

Just as technical debt increases the cost of maintaining software, cybersecurity debt increases the difficulty of protecting an organisation.

Sri Lanka has already encountered this challenge within government infrastructure. ICTA’s description of the development of the Lanka Government Cloud notes that earlier infrastructure introduced in 2010 (LGC 1.0) faced challenges including outdated technology, expiring hardware and difficulty meeting evolving government requirements, contributing to development of a newer platform.

A national approach to legacy technology should therefore include identification of unsupported systems, risk-based prioritisation, network segmentation, stronger monitoring and funded replacement programmes.

Importantly, legacy-system modernisation should include cybersecurity requirements from the beginning rather than treating security as an additional feature following implementation.

Cyber Hygiene Remains the Foundation

Sophisticated cybersecurity capabilities are important, but national cyber resilience ultimately depends on thousands of organisations consistently performing relatively basic activities well.

These include:

• patching vulnerabilities;
• using multi-factor authentication;
• maintaining supported software;
• restricting administrative privileges;
• backing up important information;
• protecting Internet-facing services;
• monitoring security events;
• managing user accounts;
• conducting phishing awareness;
• and testing incident response.

These controls may not sound innovative, but failure in basic cyber hygiene continues to provide attackers with opportunities.

For smaller Sri Lankan organisations in particular, cybersecurity programmes should avoid becoming unnecessarily complicated.

A business does not necessarily need an expensive Security Operations Centre before it has implemented multi-factor authentication, vulnerability management, secure backups and basic incident-response procedures.

The same principle applies to government departments.

Cyber maturity should be built progressively, beginning with minimum security baselines that every organisation is expected to achieve and then developing more sophisticated capabilities based on risk.

Law Enforcement Must Evolve With Cybercrime

Cybercrime also creates a challenge for traditional law-enforcement models.

A physical crime generally has a location. Cybercrime may involve a victim in Colombo, infrastructure hosted in another country, cryptocurrency transactions across several jurisdictions and an attacker who never enters Sri Lanka.

Investigating these offences requires technical capability in areas including digital forensics, network investigations, cryptocurrency tracing, cloud evidence, malware analysis and preservation of electronic evidence.

Sri Lanka already has an established legal foundation. The Computer Crime Act No. 24 of 2007 criminalises activities including unauthorised computer access, unlawful modification and interference with computer systems and provides mechanisms associated with investigating computer crime. Sri Lanka Police also maintains a Computer Crime Investigation Division.

Recent developments demonstrate that capability building is occurring. In July 2026, for example, the Sri Lanka Police Information Technology Division and Sri Lanka CERT conducted cybercrime and cybersecurity awareness workshops for police officers across multiple regions.

This type of initiative should continue and expand.

Not every police officer needs to become a digital-forensics specialist. However, frontline officers increasingly need enough cyber awareness to recognise a cyber-enabled offence, preserve digital evidence correctly, understand escalation pathways and direct victims towards appropriate specialist capability.

Dedicated cyber investigators require deeper and continuously updated technical training.

Technology changes too quickly for cybercrime capability to be treated as a one-time training exercise.

Moving From Awareness to Cyber Resilience

Sri Lanka already possesses many of the components required to build stronger cyber resilience.

Sri Lanka CERT provides national cybersecurity coordination and incident reporting capabilities, including a national hotline and online incident-reporting channels. Work is also progressing to connect critical government organisations to the National Cyber Security Operations Centre, intended to improve coordinated monitoring and incident response.

The National Cyber Security Strategy 2025–2029 provides additional strategic direction across regulation, knowledge development, preparedness and cooperation.

The priority now should be translating these strategic capabilities into everyday operational improvement.

Several practical actions could make a significant difference.

• Establish a measurable government cybersecurity baseline. Every department should meet minimum requirements covering identity, email, endpoint protection, patching, backups, logging, incident response and protection of personal information.
• Provide every public servant who requires digital communication with an approved government identity and communication platform. Personal email should never become necessary simply because an employee lacks a practical alternative.
• Make cybersecurity awareness role-specific. A finance officer, system administrator, executive, police investigator and customer-service employee face different cyber risks. Their training should reflect those differences.
• Progressively identify and retire legacy technology. Where immediate replacement is impossible, compensating controls such as segmentation, access restrictions and enhanced monitoring should reduce exposure.
• Continue building law-enforcement cyber capability. Cyber awareness should extend beyond specialist cyber units so that cyber-enabled crime can be recognised and appropriately escalated throughout the policing system.
• Treat citizen data as a high-value government asset. Departments should understand what personal information they hold, where it is stored, who can access it and how it is transmitted.
• Exercise incident response rather than simply document it. Government agencies and critical organisations should regularly conduct tabletop exercises, technical simulations and, where appropriate, purple-team exercises to determine whether their people and systems can detect and respond to realistic cyber incidents.
• Measure cybersecurity behaviour rather than training completion. The important question is not how many employees attended cybersecurity training. The important question is whether employees recognise phishing, report incidents quickly, protect information appropriately and use approved systems.

Conclusion

My recent conversations in Sri Lanka left me with the view that the country has both an opportunity and a challenge.

The opportunity comes from rapid digital transformation and the existence of an increasingly mature cybersecurity ecosystem. Sri Lanka has a national cybersecurity strategy, a national CERT, developing data-protection arrangements, government digital-transformation programmes and a community of capable cybersecurity professionals.

The challenge is ensuring that these capabilities reach the everyday operational level.

Cybersecurity resilience is ultimately determined not only by national strategies and sophisticated security technology, but by whether a government employee has a secure email account, whether an organisation patches a vulnerable server, whether an administrator uses multi-factor authentication, whether a police officer recognises digital evidence, whether citizen information is appropriately protected and whether an organisation knows what to do when an incident occurs.

The examples I observed should therefore not be interpreted as criticism of individuals attempting to work within existing systems. In many cases, insecure behaviours are symptoms of broader technology, process and capability gaps.

This distinction matters.

Telling employees to “be more cyber aware” will have limited impact if the technology they are provided does not support secure working practices.

Sri Lanka’s next phase of cybersecurity development should consequently focus on making cybersecurity practical, accessible and embedded into normal operations.

The country’s National Cyber Security Strategy provides an important foundation. The next step is ensuring that cybersecurity becomes part of everyday organisational culture, from senior government leadership and corporate boards through to frontline public servants, businesses and citizens.

Cybersecurity awareness is not ultimately about teaching everyone to become a cybersecurity expert. It is about creating an environment in which people understand the digital risks associated with their decisions, are given secure systems through which to perform their work, know when something has gone wrong and know where to seek help. As Sri Lanka’s economy and public services become increasingly digital, that capability will become an essential component of national resilience.