Public agencies must rethink cybersecurity, says GovTech CEO

Singapore

THE way public agencies look at cybersecurity needs to change, said Kok Ping Soon, the chief executive of GovTech, the agency tasked with public sector digital transformation.

Current practices hinge on a castle-and-moat concept, meaning that system "parameters" are watched and guarded against external attacks. But what is needed in today's world is a "zero trust" framework.

"That means that depending on the device that you use, the connectivity that you have, the operating system of yours, and at what time you log in, I will grant you access differently. You need that level of sophistication. Then I'll be securing not just based on systems, but room by room, asset by asset," said Mr Kok.

While the government is taking steps towards this framework, it requires sophistication in defining access at a granular level.

"We are exploring technology that can allow us to define security at that level, to be more software-defined to move towards zero trust. But there's also increasing need to increase the civil servant's sensitivity to data," Mr Kok added.

A high-level committee convened by Prime Minister Lee Hsien Loong has found that public sector agencies have varying levels of training in data protection and inconsistent practices in managing data access.

The findings were released to the public last month. The committee will submit its recommendations by Nov 30.

Mr Kok also said that GovTech is looking into consolidating security monitoring across various agencies. Today, many agencies are monitoring their networks differently.

"We need to . . . pull together all these monitoring (activities) within one government security operations centre managed by us. I don't just want to monitor the perimeter; I want to monitor down to the application level, which means that I need to start to bake in some of these security codes into the way applications are being written."

READ MORE: For GovTech, it's about engineering technology for the people