As hackers take aim at Singapore, what's next for CSOs?

data security / padlock / binary code / digital display
Gremlin / Getty Images

Within the space of 24 months, the hacking underworld has placed Singapore at the forefront of heightened cyber activity, evident through the ‘most serious breach of personal data’ at SingHealth.

Yet the Ministry of Health attack was not in isolation, with Sephora, AXA Insurance, Uber and Red Cross joining an expanding high-profile list of targeted public and private sector organisations.

Aided by the economic instability of Covid-19 – as well as a sharp rise in remote working – cyber criminals are once again taking aim at a nation now viewed as a hotbed for hackers, with Prime Minister Lee Hsien Loong also under threat. In fact, according to a recent report from hacker-powered security platform HackerOne, 30% of businesses globally have seen an increase in attacks on their IT systems as a result of the pandemic. This is according to C-Level IT and Security execs at global businesses, almost two thirds (64%) of which believe their organisation is more likely to experience a data breach due to Covid-19.

Industry experts gathered recently at a virtual roundtable to discuss how they are shifting their security strategies and priorities. “Potential cyber security gaps are emerging which allows remote access and data exchange outside of existing defence perimeters,” observed Chin Kiat Chim, global CISO of Dyson. “This represents a perfect opportunity for cyber criminals or state-sponsored agencies to launch targeted attacks.”

According to Chin Kiat, current city-state priorities are centred around organisations becoming ‘Covid-safe’, protecting employees and company assets to ensure business continuity during the challenging months ahead. Should the situation worsen however, embracing ‘Covid-resilience’ takes priority.

“Going back to ‘business as usual’ is not sufficient, the new way of working post-Covid requires a more agile, resilient and adventurous approach to regain momentum and strive for success,” added Singapore-based Chin Kiat. “How can cyber security professionals secure and enable an organisation in this new paradigm, together with an aggressive risk-taking approach to capture back market share and consumer confidence?

“Covid-19 is a big wake-up call and is starting to force organisations to drive new ways of doing business, away from the traditional approach. This change will continue to drive further digital and cyber transformation.”

Taking the cyber conversation further, Tiong Kee Yong – vice president of IT at BW Group – acknowledged that with work-from-home activities “here to stay” in Singapore, new levels of protection are required to ensure endpoint, Internet and network resilience.

“Phishing scams continue to represent quick entry points meaning that constant cyber awareness is necessary, while mitigating against the downside of ‘burn-out’ users,” Kee Yong outlined.

“We are focusing on enhancing our data loss protection capabilities as we continue to allow more access over the Internet to employees working from home, with artificial intelligence and machine learning required to detect increased levels of malware.”

Speaking in his dual role as CIO of BH Global and CEO of cyber start-up Athena Dynamics, Ken Soh acknowledged that a shift in approach is required for technology leaders to mitigate against future attacks.

“We have been educated around challenges in people, process and technology but this may not be adequate anymore,” he cautioned. “A new dimension to this framework named ‘situation’ is immediately pertinent.

“This is probably one of the most valuable learning points today due to Covid-19. We’re seeing more situational related attacks such as phishing via fake World Health Organisation and fake government emails, plus attack vectors taking advantage of home-based vulnerabilities.

“Such situational related elements call for new, blended considerations in people, process and technology with situation.”

Creating cyber best practice

In the wake of continued stay-at-home orders – hampered by rising threat levels – one aspect of change has become “abundantly clear” for all organisations in Singapore, according to Marten Mickos, CEO of HackerOne.

“We’re all technology companies now,” he outlined. “Amplified by increased demand for digital services, continuous integration and continuous delivery have become best practices for development and IT operations teams.

“Development teams are constantly implementing, integrating and validating small changes to their code. They work to continuously deliver applications to various infrastructure environments, automatically pushing code changes as they arise.”

Additionally, Mickos said more teams now develop apps in-house, creating a need to ensure a feedback loop is established before such applications are put into production.

“To accommodate this fast-paced method, companies cut corners in their security,” he observed. “For example, applying firewall rules at the server level rather than the network level so that DevOps does not need to make manual changes to firewall rules to push new code.

“But when vulnerable code is released to production, it creates substantial risk for the organisation. Automated security tools systematically overlook bugs that might be present in novel code.”

In the absence of a common security taxonomy across engineering and development teams, Mickos acknowledged that organisations today are struggling to scale security. Instead, “they need a security strategy that will grow and adapt at the pace of innovation.”

To combat rising security concerns across Singapore, Mickos outlined how bug bounty programs enable organisations to assume a “proactive security stance”, delivered in an efficient and cost-effective manner.

“The good news is there is a movement happening – hundreds of thousands of hackers around the globe are hacking companies – not to steal information but to secure vulnerabilities,” Mickos stated. “This human-scale security is what actually works.”

Currently, government organisations such as the Singapore Ministry of Defence and large corporations like Hyatt, Zomato, Toyota and Alibaba Security Response Center are running nearly 2,000 custom programs on HackerOne. As a result, hackers have helped to find over 170,000 vulnerabilities and earned more than $100 million in bug bounties on HackerOne in the process.

“The community of hackers signed up to hack for good has grown to three quarters of a million individuals, supporting internal security teams at a time when Asia Pacific is facing a massive skills shortage of 2.6 million cyber security professionals,” Mickos added.

“Simply put, the only way to level the playing field in cyber security is to meet cyber criminals on the battlefield with the hackers, the good guys.”


Copyright © 2020 IDG Communications, Inc.