- 1 hour ago
- #considerthis
Prime Minister Anwar Ibrahim has warned that Malaysia could be a target of cybersecurity threats, following recent cyberattacks in other countries that have disrupted critical infrastructure. The Government says it is strengthening national cybersecurity and preparedness, but just how vulnerable is our country, and does our preparedness match the risks? On this episode of #ConsiderThis Melisa Idris speaks with CF Fong, Managing Director of the cybersecurity consultancy, LGMS Berhad and Professor Dr Selvakumar Manickam, Director of USM’s Cybersecurity Research Centre (CYRES).
Category
🗞
NewsTranscript
00:10Hi, welcome back to Consider This. I'm Melissa Idris. Let's continue our discussion about
00:15Prime Minister Anwar's recent order to boost Malaysia's cyber security readiness.
00:20This amid cyber attack fears and rising geopolitical threats.
00:25Joining me now to discuss this further, I have C.F. Fong, who is the Managing Director of the Cyber
00:30Security Consultancy, LGMS Berhad.
00:34Thank you so much for joining me on the show, Fong. I appreciate your time.
00:38Can we start with the basics? When they say there's fears of rising cyber attacks, explain to us what that
00:45means.
00:45What is a cyber attack? What does it look like for an ordinary citizen?
00:50And what kinds of cyber attacks do you think Malaysia should be realistically most concerned about?
00:55Well, thank you, Melissa. So as the name implies, cyber attacks means the attacks coming from the cyberspace, meaning coming
01:01from the internet.
01:03Now, how does it impact an organization or even a country?
01:07Is that cyber attacks just like any other military attacks, right?
01:11Cyber attacks can bring in disruptions, can bring in damages to businesses or even countries.
01:16Just imagine this. If you have a country with different kind of industries, financial industries, logistics and everything, others that
01:25is connected to the internet.
01:26And then this is the situation where now we are facing because as long as we have our businesses connected
01:33to the internet, we are susceptible to cyber attacks.
01:35So what the news, what the PM was mentioning is about the national level of cyber attacks is actually is
01:43nothing new.
01:44Many organizations or many countries are now also going through the cyber warfare.
01:48And it's just that sometimes some of these cyber attacks were not mentioned by the media or not reported by
01:53the media.
01:54Hence, we also have an impression that these kind of attacks are very far away from our daily lives.
01:58It may not be relevant to us, but by the time it becomes relevant to us, that's where the impact,
02:03that's where we can feel the impact.
02:06All right. Well, OK, so let's take a look at what's happening around the world.
02:09Based on what you're observing, Fong, what are the most important lessons that we can draw from what's happening with
02:16these incidences?
02:17I'm looking at the recent fridge hacking in Europe, something that feels so benign but has such an impact on
02:25so many people.
02:26What do you think we should be learning from these incidences, particularly around protecting our own critical infrastructure?
02:34Yeah, I think there should be a paradigm shift today because today, you see, conventionally, a lot of the time,
02:40we always think that hackers will only be attracted to financial institutions, attacking sectors which can pay, namely, you know,
02:48insurance, financial sectors.
02:49But today, hackers are operating at a totally different level.
02:54Hackers do not care what industry they're hacking as long as the industry can bring them benefits, can bring them
02:59monetary gains.
03:00So that's why we need to have a paradigm shift today. Hackers do not pick and choose their target industries
03:05anymore.
03:06It's not like, you know, we are not a bank, therefore, we are not susceptible to attack. It's no longer
03:10true.
03:10So many businesses today still operating with the mindset that, okay, we are not a bank. We do not have
03:15personal data. We do not do business online.
03:18We have nothing for the hackers to steal. But a matter of fact is that hackers are not interested to
03:23steal, but hackers are interested to cause disruptions.
03:26And then from the disruptions, they will demand ransom. They will ask for whatever benefits they want to gain.
03:31It's just that today, many businesses are connected online and we are no exception with any other businesses anymore.
03:39There's no differentiation anymore. That's why this is the first thing I would say. All organizations need to have a
03:46paradigm shift.
03:47The example you pointed out is the fridge because we have never thought of hackers would be hacking in the
03:52fridge.
03:52And when we experience the impact, therefore, we know that, hey, you know, a lot of our systems are actually
03:58connected online. Our fridge are connected online.
04:00But the question is, do we need to have our fridge connected online in the first place? So that's why
04:06it triggers a lot more questions.
04:08So from this incident, we can learn that, you see, many organizations today are still not prepared.
04:13We do not have the precautions, you know, against the hackers yet.
04:19Right. Well, so cybersecurity analysts like yourself have always been talking about the need to boost resilience and readiness, right?
04:28This warning from the Prime Minister, this order to make our national cybersecurity more resilient.
04:35Do you think that will be the wake up call that we need and not just among government, but as
04:41you say, among businesses and ordinary citizens?
04:43Because we've been facing the cybersecurity threats for a while now.
04:47Whether or not we have been taking these threats seriously is another question.
04:51Yes, that's true. But what the Prime Minister did was it's a good call.
04:55But nevertheless, I think Malaysian, we still need to be more aggressive and proactive.
05:01Despite the call from the Prime Minister, I believe that many organizations today are still unprepared or they're not ready
05:07to tackle with cyber attacks.
05:09You see, the biggest questions we have to ask ourselves today is it's not about when the hackers are going
05:15to hack us.
05:15Hackers are definitely hacking us all the time. And because now with AI, with software, many of these cyber attacks
05:21are done automatically and autonomously by machines.
05:24The questions now we need to ask ourselves is that are we ready to detect?
05:28Do we have the capability to detect and response in time in case the cyber attacks is happening onto our
05:35organizations?
05:36So this is a question that all businesses need to ask themselves.
05:41Are we able to respond in time?
05:44And this actually is the one that forced the resilience of a business.
05:49Because today, business is no longer about using IT.
05:52We are now depending on IT, on the business survival.
05:56So that's why we need to make sure that whatever we're depending on are accountable.
06:00Okay. Then can I ask you, Fong, what your advice is to Malaysians who think,
06:05well, my business is too small to be impacted. I don't have the capacity to be cyber resilient.
06:11Or I'm not even on the radar of hackers. I'm too small to even be part of, to be noticeable.
06:18So what do you, what do you say to the people who say they don't need to be worried about
06:24this?
06:25Yeah, this is an excellent question. In fact, a lot of these questions come from SME,
06:28who always have shared the same opinion that their business is too small,
06:32they will not be attractive to hackers. But my question is, the other one,
06:35my question is to SME's owner is that, you see, although you may not be a heavy user of technologies,
06:41but the thing is today, in your day-to-day business, you're still bound to use computers,
06:45still bound to use software, like you use spreadsheets, electronic spreadsheets, PDF documents,
06:51and all that. So what happens if any of these documents get encrypted and got stolen or erased
06:56by hackers? Will that cause any business disruptions to you? If the answer is yes,
07:00then cybersecurity is very much relevant to you. Unless you're not using any computers at all,
07:05and not using any software, spreadsheet documents, then you're using paper and pen, then that's fine.
07:11Right? But today, it's inevitable. Everyone should pay attention to cyber attacks,
07:16should pay attention to their own business defense, and always have a preventive mindset that,
07:23you know, get ourselves prepared. As simple as just having backup is good enough. You know,
07:28for SME owners, always backup and always update your software and make sure you have antivirus.
07:35So these are three things that doesn't cost a lot, but it helps a lot in terms of prevention.
07:40Okay, that's prevention, but what happens after? So what is your advice in the event of a cyber
07:47attack and the disruption, the fallout after that? What do you advise your clients?
07:54Well, there's no one fixed answer to solve all that thing, but for organizations which are well
08:00prepared before, so the kind of impact they're going to go through is much lighter compared to
08:04organizations who have not done any prevention countermeasures. So for example, organizations
08:09who are well prepared, like they have been doing scheduled backups, they have been doing proper
08:12training drills, and when disaster happens, at least they can recover much faster compared to
08:18those organizations who have not done any preventive countermeasures before. So I think there's no
08:22fixed answer for an organization what to do in terms of when a disaster strikes. But the more
08:27important thing is that think of the prevention first, you know, before the disaster strike. Hopefully,
08:32there's no impact from a disaster, but always focus on prevention first.
08:36Thanks so much for speaking with us. That was CFO Managing Director of the Cyber Security Consultancy,
08:42LGMS Berhad. Let's speak now to Professor Dr. Selva Kumar Manikam, who is the Director of USM's
08:49Cyber Security Research Centre, better known by its acronym, CIRIS. Prof. Selva, thank you so much for
08:55joining me on the line. So what do you make of Prime Minister Anwar Ibrahim's warning that Malaysia could
09:02be a potential target of cyber attacks and other security threats? How should we, as the public,
09:09understand this assessment? Okay, thank you for having me. Well, I think the Prime Minister's warning
09:17should be viewed as, you know, as a timely reminder that cyber security is an integral part of national
09:23security. It is no longer something that the enforcement agency or those running cyber services
09:34that should be concerned. It is now something that the host of community, that the people of the country
09:40should be concerned about. And, you know, we must understand that Malaysia is not isolated from
09:47global geopolitical developments, right? I think we are all aware of that. And I mean, I always say
09:52this, there are two things that is trans-boundary. One is the haze and the other pretty much the cyber
09:59threat, which you have no control over the border, right? It does not respect geographical boundaries,
10:04right? Of course, you know, a country does not necessarily have to be directly involved in an
10:09international conflict. But we need to be prepared as and when that happens in the future. We are not
10:16a sitting duck. And that is very, very important moving forward. And as public, what public has to be,
10:24what are the messages that you take from what the Prime Minister has said is that we should not panic,
10:29and we should not also be complacent that, you know, it's not everyday person's problem. It's not my problem.
10:38It shouldn't be government's problem. No, it is something that all of us should be part of,
10:43and we need to be more aware of what they are. Well, so governments around the world are saying
10:48cyber attacks is not a question of when, a question of if, but rather a question of when. So when
10:54we
10:54think about how prepared Malaysia is for a potential attack, how vulnerable or how prepared are our critical
11:04services, infrastructure services, in the event of a major digital disruption?
11:09Okay. I think Malaysia is one of the few countries that has been more, which I would consider more
11:19prepared compared to many other countries. We have introduced Malaysian Cyber Security Act,
11:24FIFO, which is very specific to the national critical infrastructure. And, you know, there is a lot of
11:31establishment and coordination among national cybersecurity capabilities to specifically NACSA,
11:37National Cyber Security Agency, which is very, very important. But the problem that we may see is that
11:45the security posture of different organization is not the same. Larger corporations will have a stronger
11:54security posture while the SMEs may have, may not have the financial might to be able to implement
12:01that the security, cybersecurity mechanism and so on, and putting them at risk at different juncture of
12:09the country. Okay. Right. So, Professor, I'm curious to know, from a national level perspective,
12:15right, what, when the, when the Prime Minister calls for boosting cybersecurity, cyber resilience,
12:21what does that look like in practice? We talked to a previous analyst about how prevention is better
12:28than recovery. But when you talk about cyber resilience, what does that mean? What does that
12:34look like in practice? Okay. Prevention is definitely better than cure. I don't know if you look from the
12:42medical perspective. But I always say this, that, you know, in the real world, the side, the criminal is
12:48like, you know, one step ahead of the authority. And in the cyberspace, the cyber criminal is actually,
12:54they're actually a couple of steps ahead of the authority. And now we live in the world of AI,
12:59AI powered cyber criminals are pretty much way ahead of the authority. We are catching, playing,
13:05catching up game until today. And it's the cab is getting is widening. And, and, and there's so much
13:12we can do when it comes to securing our infrastructure, and our critical systems in the country. So,
13:18looking at that, the next step is how do we be resilient? That means that we do our best,
13:25if I can give an analogy is that if I can have the fantastic alarm system cameras and all in
13:32my house,
13:32right? But if a criminal wants to break into my house, they can always break in this, there's always
13:38work around to get in, it's just the motor effort you want to put. Resilience is that once the
13:43break-in has happened, how do you ensure that you continue to survive? For example, I may have a panic
13:49room, or I may have in the West, you probably have a gun to shoot down the criminal. So this
13:54is how you
13:55be resilient moving forward when security mechanisms fails. But as I mentioned earlier,
14:01in Malaysia, different organisations have different security, and because of that, also different
14:08cyber resilience posture. And this creates gaps within the supply chain. When third-party supply
14:16supplier fails, it can propagate to more comprehensive environment.
14:24Are we aware of the gaps? Have the gaps been identified and mapped? Are we aware of where the
14:30vulnerabilities are and looking to address those gaps?
14:34This is what we call zero-day vulnerability. That means internet has been around for more than 40
14:40years, and we are still discovering vulnerability until today, right? So it is, I always say that cyber
14:48security is a journey without destination, right? We are not reached destination. I don't think it
14:54will be able to reach that anytime soon. And we, as I mentioned, we are reactive. And until we are
15:01reactive,
15:03it's going to be more damaging, right? The damage cost will be higher than being proactive, preventive,
15:10and so on. That is the goal, but we are not there. Until that happens, we have to be, do
15:18the best we
15:18can, meaning to educate the people, the users and so on. So you mean there will always be gaps and
15:24vulnerabilities that we cannot fully be aware of. So when we think about national cyber security
15:31resilience, Prof Selva, how do we measure whether the public investments, the public money that's gone into
15:37investing into national cyber resilience, whether that is actually going to work on day zero of a
15:45cyber attack? Well, at the end of the day, nobody can guarantee that any system or infrastructure is
15:53100% secure. Even I, if I'm looking into building a secure system, I cannot with confidence say that my
16:00system is fully secure. What I can say is that I've done the due diligence, I've complied to all the
16:07standards internationally, nationally, and so on. And this is where we can see that the investment
16:14being put in and coming up, studying the posture of the national security from a cyber security
16:20perspective, cyber resilience, data privacy, and organizations like MCMC and Nexa are really putting
16:27effort. But as I mentioned that there's so much you can do. And when an attack happens or a bridge
16:36happens, it's not because they did not do their job. It's because we did the best we can, but it
16:42is
16:42an issue of always catching up. And until the day we are able to catch up and go beyond, we
16:50will still
16:50have to deal with all these issues. Prof Selva, thank you so much for speaking with me today. Professor Dr.
16:56Selva Kumar Manikam from USM's CYRES, a Cyber Security Research Center, wrapping up this episode of
17:03I'm Melissa Idris, signing off for the evening. Thank you so much for watching and good night.