S'pore vulnerabilities are no different from those of other nation: Commissioner of Cybersecurity

Straits Times

5 days ago

Find out what's new on ST website and app.
Singapore's Cyber Security Agency's chief executive David Koh warned that in this realm, Singapore's vulnerabilities are no different from those of any other nation.
SINGAPORE – Cyber threat levels have heightened amid geopolitical rivalries, with some states trying to coerce countries such as Singapore into taking or refraining from certain actions.
Singapore's Cyber Security Agency's chief executive David Koh warned that in this realm, Singapore's vulnerabilities are no different from those of any other nation.
'Train systems can be disrupted, power plants, water systems. It will move to a new dimension, where you will encounter real world harms that will affect all of us,' he said.
Mr Koh, who is also the country's first Commissioner of Cybersecurity, holds legal authority to investigate cyber threats and incidents, ensuring the continuity of essential services during cyber attacks.
'W hen we first started, the majority of threats were straightforward – web face defacements, DDoS (Distributed Denial of Service) attacks. They were a bit more like digital graffiti,' said t he former defence specialist in the armed forces, who has been CSA's chief executive from its founding 10 years ago. July 18 marks its 10th anniversary.
These threats have grown in complexities as the economy grew more interconnected through the use of digital services. That meant the agency had to extend its umbrella, working with the private sector, to cover the man on the street.
For instance, in 2024, the agency partnered Google to launch Google Play Protect, which blocks malicious apps once detected. Google has since introduced the feature to countries such as Brazil, India, South Africa, Philippines, Thailand and Hong Kong.
Top stories
Swipe. Select. Stay informed.
World Trump diagnosed with vein condition causing leg swelling: White House
World Trump was diagnosed with chronic venous insufficiency. What is it?
Singapore 5 foreigners charged over scheme to deliberately get arrested in S'pore to sell sex drugs here
Asia Appointment of Malaysia's new chief justice eases controversy over vacant top judge seats for now
Singapore Driverless bus in Sentosa gets green light to run without safety officer in first for S'pore
Singapore SPCA appoints Walter Leong as new executive director
World US strikes destroyed only one of three Iranian nuclear sites, says new report
Business Granddaughter of late Indonesian tycoon pays $25 million for Singapore bungalow
Mr Koh said that such a partnership would have been unimaginable 10 years ago.
Today, besides chairing the United Nations' Open-ended Working Group on cybersecurity, Singapore is also passing on its knowledge to Asean neighbors and countries such as Japan , which is in the process of passing cybersecurity laws .
'It is in Singapore's interest to support the international rules-based system, not just physical trade, but goods and services are increasingly also being transacted digitally,' he said.
Countries justifiably want control of their national security, and have different tolerance levels for personal data sharing, he said, noting that interoperability can still be achieved.
Singapore, Britain, Germany and Australia also co-lead the International Counter Ransomware Initiative.
Singapore businesses, despite CSA advice to refuse ransomware demands, routinely cave in, according to surveys. High-profile cases in 2024 included law firm Shook Lin & Bok, the Jumbo Group and Mustafa.
Recent polls by global security services firms Bitdefender and Sophos found that firms here are more likely than their global peers to keep silent on security breaches, pay up and less likely to negotiate amounts.
But there are no plans to legislate ransomware reporting, which is now voluntary. 'Cybersecurity, ultimately, is a risk management issue. It is not possible for us to mandate a standard of cybersecurity for everybody. It's not a one-size-fits-all,' he said.
Instead, the CSA hopes to raise reporting by working with the Singapore Business Federation to offer help to victims.
With 70 per cent of companies that support the country's essential services coming from the private sector, the CSA has over the years, evolved to assist businesses on security issues and working on training and professional standards.
From about 70 employees when it was started, the outfit has since grown to a headcount of around 500.
Singapore was one of the first countries to establish a cybersecurity agency and one of the first to have a Cybersecurity Act, which was enacted in 2018. The US, Britain, France, Australia were other leaders in the domain then.
The agency's sphere now includes scams, national threats, cyber security certifications and data security, which it works on with other government agencies, businesses and institutes of education and training.
Singapore's cyber maturity ranks well compared with many countries, but the issue is how it compares with a determined attacker, he said, urging Singaporeans to play a part.
'The weakest link can be the company that doesn't patch its software, uses weak passwords, or the supplier in the supply chain who makes a mistake, who doesn't take cybersecurity seriously. It could be the employee who clicks on the phishing email, or the individual customer who comes in and has unsafe practices.'
Sometimes, extra security comes with friction.
'You need to recognise that this is a trade-off between convenience and security. Sometimes, it also translates into a little bit more cost. We must be willing to pay this cost.'