Next year's cyber security bill an important piece of essential legislation

SINGAPORE has taken several steps to strengthen cyber security, both in terms of operational readiness as well as legislation, these past few years. Operationally, the setting-up of the Cyber Security Agency (CSA) as the apex body to formulate national cyber strategy is the most important step. And in legislation, the Personal Data Protection Act (PDPA) ensures the privacy of personal data in Singapore. Also, the Computer Misuse and Cybersecurity Act helps to check local cyber crime.

The nature of cyber attacks is changing constantly, so the response mechanism needs to evolve along with it. For example, statistics show Singaporeans have lost as much as S$15 million to various scams to date this year. This is just the number reported to the authorities, so the actual figure could be much higher. Some of this money represents victims' lifetime savings. Another new form of attack is ransomware; attackers take over a computer (and, in some cases, company servers) and encrypt all the data. The computer is released only on payment of "ransom money", usually in an online transaction. To date, there have officially been 19 cases reported in Singapore. Again, experts feel the actual number is much higher because many victims choose to pay up or remain silent; the experts point to the global incidence rate of ransomware, which is much higher. It is well known that Singaporean companies have had their security systems compromised. Research by data storage technology vendor EMC showed that 28 per cent of local organisations have lost data in the last year as the result of a security breach, and that the average cost of data loss for these organisations amounted to more than US$1.3 million.

Another major area of concern is cyber attacks on critical infrastructure. Much of today's infrastructure (like power plants) is digitally controlled and hence susceptible to attack. While good cyber defence is a must, there's an added dimension to this: the government needs to know as soon as possible of such attacks to ensure that similar incidents do not occur. Sharing information is an important cyber security tool as it ensures that all possible resources are brought in to tackle a cyber attack in order to neutralise it.