The Global Shield: Collaborative Cyber Resilience for global e-Commerce and logistics

Mayssam Sabra argues that e-commerce is not just an online purchase interface but a deeply interconnected global logistics system. Because the system is digitally linked across many actors, a cyberattack on one component can cascade across the network, which means security must be organised collectively rather than by isolated organisations acting alone.

She explains that what looks like a simple online purchase actually triggers a large engine of logistics involving airplanes, trucks, warehouses and post offices working together to deliver parcels . She then states that because this network is digital and interconnected, an attack on one part of the chain can cause the whole ecosystem to collapse, and therefore no country, post office, organisation or business can protect itself alone and the network must be shielded together .

Mayssam Sabra presents UPU-WCO cooperation as an existing mechanism for managing cross-border postal security risks. Her point is that this coordination covers both strategic and operational issues, showing that cyber resilience in postal flows is tied to broader customs and security cooperation.

In response to an audience question, she says the UPU and the World Customs Organization work together through a contact committee that covers security topics generally . She specifies that these discussions include illicit goods, trafficking, physical security issues and cybersecurity, and that the two bodies meet regularly to address these issues at both policy and operational levels .

André Pharand argues that the logistics and postal sector is structurally vulnerable because shipments move through many interconnected organisations and technical systems. This interdependence means a single cyber incident can produce major downstream disruption, particularly in a sector where fast delivery is expected.

He notes that cross-border goods can touch an origin post, customs agency, destination post and airline, all of which are tied together by interconnected systems that can create vulnerabilities . He adds that logistics companies are frequent targets, alongside healthcare, because of the impact attacks can create, giving the example of a carrier being unable to deliver for two or three days when customers expect next-day delivery .

André Pharand says the UPU survey provides a solid evidence base across member countries, but the results show uneven and only moderate uptake of basic cyber hygiene. He highlights that some operators have not only failed to implement measures but have not even considered cybersecurity yet.

He reports that the survey was sent to 192 UPU members, received 152 responses and achieved a 76% response rate, which he describes as a solid dataset with good regional participation . He then says adoption across the eight cyber hygiene measures is roughly around 50% when combining implementation and development, and notes that some posts have discontinued, rejected or never even considered cybersecurity .

He argues that the sector’s main weakness is not basic recognition of cyber risks but the ability to respond and recover when incidents occur. In his view, these weak areas are strongly tied to institutional capacity, staffing and resources, not just technical tools.

When discussing the regional analysis, he says the biggest struggles appear in risk management, incident response and crisis management . He explicitly links these shortcomings to teams and resources more than to purely technical aspects , and later summarises that response and recovery are the real weak spots .

André Pharand argues that postal operators are under growing operational pressure because cyber responsibilities are increasing without matching financial support. This creates a structural capacity squeeze that makes it difficult for operators to keep pace with the threat environment.

He says respondents ranked workload growth very highly, showing that most believe cybersecurity demands are increasing . He contrasts this with budget trends, stating that budgets are not keeping up, highlighting a particularly large gap in Latin America and noting that eight operators saw workload rise even after their cybersecurity budgets were cut completely .

He contends that one important institutional gap is weak connection between postal operators and national cyber response bodies. Without those relationships, operators are less able to benefit from national-level coordination, intelligence and emergency support.

He states that only about 35% of postal operators have any link with an affiliated national incident response team . He describes this as a lack of alignment, interconnectivity and integration, even though postal operators are often linked to government ownership or oversight .

André Pharand argues that the central challenge is implementation capacity rather than simple awareness of cyber risks. Operators, especially those with fewer resources, need money, training and expert support to turn awareness into effective resilience.

He says operators’ open comments focused heavily on capability and funding, with requests for more training, funding, guidance and access to subject matter experts . He concludes explicitly that capacity, not awareness, is the gap, and says even strong scores on hygiene factors do not make organisations immune to attack .

He argues that the postal network is highly uneven in cyber maturity, with some operators well resourced and others barely equipped to address cybersecurity. This disparity matters because the network’s resilience depends on the preparedness of all participants, not just the strongest ones.

He notes earlier that operators range from very large organisations such as USPS to very small posts like Curacao Post, with different operating contexts but similar challenges . In his concluding remarks, he says some operators have their own IT departments and consultants while others barely have IT support, some are not even thinking about cybersecurity yet, and in some cases the responsible IT function is elsewhere in government .

André Pharand argues that limited support should be directed first to the operators with the weakest preparedness. He presents this as both a fairness and efficiency measure, because these posts are the ones actively asking for help and are likely to gain the most from intervention.

In listing recommendations, he says the UPU should prioritise the least prepared posts because they are the ones asking for support and they will benefit the most from it . This recommendation follows his broader survey findings showing uneven maturity and resource shortages across operators .

He proposes a practical support package for member countries that combines finance, training and operational recovery tools. The idea is not just to harden systems before attacks, but also to improve operators’ ability to recover quickly when incidents happen.

He recommends setting up and providing funding to posts that require support, while recognising that not all operators need it . He also calls for training, shared experts, a SWAT-team-style support model, and recovery assistance through a playbook and timely centralised support from the UPU .

Massimiliano Aschi argues that cybercrime has evolved into a highly organised industrial ecosystem with specialised roles and coordinated operations. He stresses that AI is amplifying this threat by speeding up attack development, improving targeting and enabling less-skilled actors to launch sophisticated attacks.

He says cyberattacks are sustained by an industrial-scale criminal supply chain run by structured organisations with distributed roles, capabilities and profits, enabling continuous scanning of the public internet and both targeted and large-scale campaigns . He then explains that malicious use of AI helps identify weaknesses in software, devices and networks, generate tailored attack tools, reduce the need for advanced expertise and allow attacks to occur at unprecedented speed and frequency .

He argues that resilience must be understood systemically because postal, logistics and digital service actors now create value through interdependent chains. This means fragmented protection is no longer adequate, and trusted coordination across the ecosystem is essential to reduce systemic vulnerability.

He states that collaboration within and across sectors is no longer optional because hybrid physical-digital services are increasingly interconnected and value creation depends on complex stakeholder, supplier and service-provider chains that must be regarded as a single ecosystem . He adds that without trusted mechanisms of coordination, organisations will continue operating in isolation and remain exposed to severe systemic vulnerabilities .

Massimiliano Aschi presents Post-ISAC as a mechanism for translating information-sharing into operational defence. Its value lies in bringing together operators with varying capacities under a trusted coordinating structure so they can exchange actionable intelligence and strengthen each other’s security posture.

He says Post-ISAC is an international community spanning all five continents and a wide range of cyber maturity levels, response capabilities and resource levels, allowing very different needs and realities to be addressed under recognised coordination . He also says operators can share threats, incidents and best practices, building a collective body of intelligence and knowledge that no single operator could create alone .

He argues that the practical value of shared intelligence is that local incidents can become network-wide warnings. This allows the system to anticipate threats earlier and adapt before the same attack pattern spreads elsewhere.

He explicitly states that an attack detected in one country can become an early warning for all, strengthening anticipatory response capabilities across the network . He further explains that global exchange can produce local benefits and that the territorial reach of postal operators creates the potential for an international network of sensors that can relay timely information about fraud patterns, technology abuse and attack waves .

He argues that cooperation is not only strategically desirable but economically efficient. Shared initiatives can spread the cost of services and training across participants, making advanced preparedness and response more accessible to countries and operators with fewer resources.

In answering the question on CERT cooperation, he says the scale and reach of the postal ecosystem can maximise the impact of investments in preparedness and threat response, and that training and awareness initiatives can generate substantial returns . He adds that while access to services may be costly for many countries, these costs can be reduced significantly through economies of scale, and that participation in initiatives like Post-ISAC can be a game changer .

Massimiliano Aschi argues that many operators still defend themselves in isolation, which leaves the wider ecosystem fragmented and exposed. He calls for participatory security arrangements that create a shared protective barrier across the network.

He says participation in initiatives such as Post-ISAC could shift cyber defence from an isolated, island-based model to a more collaborative and participatory approach . He adds that this would help break the isolation in which many operators still act and foster an ecosystem-wide protective barrier that mitigates shared cyber risk .

He argues that cross-border shipment security is becoming more data-driven, with risk evaluation increasingly based on information exchanged across networks. However, he also cautions that this approach is still at an early stage and has not yet fully matured into a highly effective system.

Speaking from the European context, he says risk evaluation is increasingly being approached through data exchange and that international network data flows are becoming especially relevant for assessing shipment risks . He adds that this can make customs controls smarter, but he believes the approach is still only beginning and is not yet mature enough to produce fully significant results .

Tracy Hackshaw argues that postal delivery and e-commerce remain grounded in physical goods movement, but this physical movement is now dependent on digital infrastructure. As a result, a break in the digital chain can trigger wider disruption well beyond the postal operator itself.

He asks the audience to think first about a physical parcel and notes that universal postal service depends on delivering to everyone . He then says that in the digitally connected world, a disruption in one part of the chain can create ripple effects across connected systems such as supply chains, payment systems, transit and transport systems .

Tracy Hackshaw presents Work Proposal 309 as a framework for sector-wide cyber resilience. Its purpose is to ensure that every country and operator can achieve at least a minimum acceptable level of security rather than leaving resilience to a few advanced players.

He identifies Work Proposal 309 as the proposal on cyber resilience for the postal sector . He says the goal is to establish a minimum security baseline for the sector and to get everyone at least to a stable or 'good' level, with the current data serving as a starting baseline for further recommendations .

He argues that the UPU strategy is meant to be progressive rather than all-or-nothing, helping less advanced operators improve incrementally. At the same time, it is intended to distribute resources more fairly so that countries with weaker capacity can access training and awareness support.

He says the system offers a standardised roadmap to move countries from an earlier stage to at least a more stable level and eventually further along in their development . He also states that embedding this thinking into the UPU work plan is meant to enable equitable allocation of capacity-development, training and sensitisation resources for operators, the wider sector and customers .

Tracy Hackshaw argues that trust in digital systems is a precondition for digital commerce. Where that trust is weak, consumers and markets fall back on cash and physical processes, limiting participation in the digital economy.

He says that if people do not trust the digital infrastructure in their country, they do not trust the digital economy or trade to happen . He links this to many least developed economies where cash remains dominant because trust in digital systems is not there, and says the aim is to use global cyber standards to certify countries as safe partners in the global supply chain .

He argues for a universalist approach to cyber resilience in the postal sector. Because the whole network depends on all participants, basic cyber protection should be available to every country as a shared standard rather than a premium capability for well-funded operators.

He says the UPU wants the next several years of work to ensure digital inclusion and build a global framework in which cyber resilience is not a luxury for the well-resourced but a standard utility for all . He reinforces the point by stating that the global network is only as secure as its most vulnerable operator and that resilience must be strengthened at every step of the chain .

Tracy Hackshaw explains Post-ISAC as a practical operational channel for secure peer-to-peer support. Its function is not only to distribute threat information but also to allow operators to exchange lessons from incidents and obtain assistance during attacks.

He gives a practical example of an attack on a post in Asia and says the ISAC allows that post to share the information causing the threat securely and confidentially with other participants so they can prepare for a widespread or future attack . He adds that the ISAC also helps organisations learn what others did to survive attacks and seek help while they are currently under attack .

He argues that the .post top-level domain is a security and trust mechanism, not merely a branding choice. Because access is restricted to verified entities, it helps reduce spoofing and gives users a more trustworthy digital identifier for postal services.

He says many attacks come through the domain name system and that .post functions as a trusted mark backed by a UN system agency . He explains that ordinary domains can be easily purchased and spoofed, especially where letters such as A, I, L and O can be visually manipulated, whereas only verified and authenticated entities can access .post, with no individual registrations allowed .

Tracy Hackshaw presents Secure.post as the public-service layer of the UPU cyber resilience effort. It is designed to make practical security tools and educational resources directly available, including to people beyond postal operators themselves.

He says Secure.post has been officially launched and will provide a public-facing environment with information and tools . He gives examples including a live link-checking tool, upcoming password generators, training information from partners, email and website testing, and access to best practices and standards for both individuals and organisations .

He argues that UPU initiatives must be connected to national cyber institutions rather than operating in parallel. By linking with national authorities, CERTs and sector-specific structures, the postal sector can build layered resilience that works domestically and internationally.

He says the UPU roadmap includes working with national cybersecurity authorities and that this is measured as a KPI rather than left as an informal aspiration . He adds that these authorities are generally linked to national CERTs and C-CERTs, and ideally to sectoral CERTs as well, with the goal of creating another chain of resilience within countries while also connecting globally and working with other ISACs .

Tracy Hackshaw argues that international partnerships are necessary because the UPU’s own resources are limited. Cooperation with established response communities like FIRST allows the UPU to extend its reach and improve effectiveness through shared expertise and networks.

He states that the UPU is finalising a partnership with FIRST, the Forum of Incident Response and Security Teams, and is working through the final details of a cooperation agreement . He says the intention is to optimise UPU resources by working with FIRST teams around the world because the UPU cannot do this by itself and must cooperate to help everyone .

He argues that cyber resilience in the postal sector is not only a back-end institutional issue but also a public-facing consumer protection issue. Because attackers exploit people’s urgency about package delivery, educating customers becomes a core defensive measure.

He says many attacks in the sector take the form of messages or emails claiming a parcel is late or urgent, which prompts users to click malicious links because they want their package . He concludes that educating customers about where and how these attacks happen is vitally important .

Tracy Hackshaw argues that postal operators often lack visibility into the abuse of their own brands in scams. This creates a reactive rather than proactive security posture, since operators may only discover spoofing after customers notify them.

He says that many posts do not even know customers are receiving scam messages unless those customers tell them . He adds that this means operators may be unaware that their URLs or email addresses are being spoofed or abused, which is a gap the UPU wants to address partly through customer education .

The audience contributions show that people often think of e-commerce in terms of visible consumer-facing platforms rather than the infrastructure behind them. This helps illustrate the gap between public perception and the much broader digital and logistics ecosystem discussed by the panel.

When asked what first comes to mind with e-commerce, audience members answered 'Amazon' and 'Platform, platform' . These examples support the moderator’s point that users tend to focus on websites and marketplaces rather than the interconnected systems underneath them .

Audience interventions brought attention to a concrete trust issue: whether domain names themselves can be spoofed and how security controls address that risk. This shows that naming, verification and user trust are seen as practical operational concerns, not just abstract policy matters.

One audience participant asked directly how the panel deals with the fact that there is an 'O' in the word 'post' and similarly an 'I' in 'first', raising the problem of visually similar characters and spoofing in domain names . The question itself illustrates participant concern about the reliability of secure naming and verification mechanisms in practice .

The audience highlighted two operational areas where resilience depends on wider coordination: cooperation with CERTs and information-sharing for cross-border customs risk assessment. These questions show that participants saw institutional connectivity and data exchange as practical levers for improving sector security.

One participant asked what the major challenge and opportunity were for helping CERTs strengthen prevention and cooperation with corporate and supply-chain partners . Another asked how UPU cooperation with the World Customs Organization could improve risk assessment and data-sharing for cross-border postal shipments in the context of growing e-commerce .