Serious Cyber Attacks In Singapore Reflect Poor Cyber Security

Cyber company breaches are becoming very common yet cyber security is not as good as it should be. A recent report by a cyber security firm Carbon Black, showed that as many as 96 per cent of organisations in Singapore have had at least one breach in the past 12 months due to external cyber-attacks.

Carbon Black’s second edition of the Singapore Threat Report, released on this month, also showed that close to half of the companies affected by data breaches incurred financial losses, while around eight in 10 saw their reputation taking a hit.

The report was based on a survey of more than 250 chief information officers, chief technology officers and chief information security officers (CIOs, CTOs and CISOs) working across a range of sectors here. They are from the financial, healthcare, government, retail, manufacturing, food and beverage (F&B), utilities, professional services, and media and entertainment sectors.

  • Of the organisations surveyed, 96 per cent said that they had suffered one or more breaches in the past 12 months due to external cyber-attacks. This percentage has not changed since the previous survey results were released in January this year. 
  • Of those that had experienced a cyber-attack, 48 per cent said that there was “negative financial impact” while 83 per cent reported damage to their reputation.
  • Furthermore, 93 per cent of these organisations reported an increase in cyber-attacks in the past year, marginally more than 92 per cent of the respondents in the previous survey. Predominantly, these were government organisations and authorities, as well as F&B businesses.

In terms of the sophistication of the attacks, just over nine in 10 of respondents said that the threats they were experiencing had grown in complexity.

This was most prevalent in the financial services sector, with 93 per cent of the firms reporting that cyber-attacks have become more sophisticated.

Challenges and Concerns

A key challenge reported by businesses is that while they would like bigger teams to combat cyber-attacks, 67 per cent of them said that recruiting and training cyber security personnel has become more difficult in the last 12 months. Nearly half (44 per cent) of financial services companies reported that recruitment challenges have become a lot more severe, while almost two-thirds of government organisations and local authorities reported a little more difficulty in recruiting.

Carbon Black’s report added that 98 per cent of CIOs and CISOs surveyed are concerned about how digital transformation projects and the roll-out of the 5G network would affect cyber security. Some were concerned that these changes would see more effective and destructive methods of cyber-crime happening (55 per cent), while others (54 per cent) thought that it would give more opportunities for cyber criminals to attack their organisations.

The top three types of cyber-attacks encountered by organisations in the past 12 months were:

1. Ransomware (15 per cent). Ransomware, used commonly by hackers to steal data, remained the most frequently used technique. In the previous survey, 28 per cent of the attacks were from ransomware. Hackers generally cut off access to the IT system and steal data until a ransom is paid before the attacker will unlock access. 

Carbon Black said that ransomware has been reported as the primary cause of successful breaches in 29 per cent of Singapore organisations, compared with 26 per cent in its January report.

The companies most affected by ransomware attacks were those in travel and transport (75 per cent) as well as financial services (49 per cent).

2. Fileless attacks (13 per cent). This is a malicious attack that does not require the hacker to install a software in the user’s device. Instead, it makes use of applications that are already installed which are thought to be safe.
 
3. Malware (13 per cent). This form of attack requires the installation of malicious software, which can be done through physical USB drives, computer viruses, worms, Trojan horses or spyware.

Reasons for Cyber Attacks

Carbon Black’s security strategist, Mr Tristan Morris, said that geopolitical tensions and money are two reasons why Singapore businesses are witnessing an increase in cyber-attack volumes and sophistication. “Geopolitical tension continue to play out in cyber space with nation states like Russia, China, North Korea and Iran looking to exert their influence over the world,” Mr Morris said.

Cyber-crime syndicates and run-of-the-mill hackers are also getting their hands on advanced hacking tools in an effort to steal data and other intellectual property for sale on the dark web. When it comes to the levels of sophistication, he said that attackers are “evolving” alongside security technology in an effort to remain undetected.

Mr Tom Kellermann, Carbon Black’s cyber security officer, offered another reason, saying that a large number of banks from around the world are located in Singapore and, globally, the finance industry continues to be a main target for attacks.

Investment in Cyber Security

The report stated that 99 per cent of the respondents plan to increase the cyber-defence budget for their respective companies in the coming year. This is a slight increase of 2 per cent since the January survey. Just under half of the respondents (40 per cent) said that they will increase spending in this area by 21 to 30 per cent. Only 2 per cent of the respondents said that they plan to increase budgets by more than 50 per cent.

Threat Hunting as a Defence

Carbon Black said that threat hunting, a technique where cybersecurity professionals actively seek out threats, has proved to be an effective method for companies in Singapore to uncover malicious cyber-attack activity. During the survey, 95 per cent of the respondents said that it had strengthened their defences to some degree, with 40.5 per cent reporting a “significant protective effect”.

The report also noted that 91 per cent of the respondents found evidence of malicious activity by threat hunting, while 49 per cent said that they found “significant evidence”The top three sectors that saw evidence of malicious cyber-attack activity were travel and transport (75 per cent), F&B (73 per cent) and professional services (61 per cent).

Singapore Today

You Might Also Read: 

Cyber Security Does Not Follow From Cyber Awareness:

Singapore Upgrades Cybersecurity:

 

« Warning For Pilots To Counter Airborne Hacking
AI Security Tool Thinks Much Faster Than Humans »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Intland Software

Intland Software

Intland offer an integrated Application Lifecycle Management platform that offers all-round Requirements, Development, and Testing & Quality Assurance functionality.

Dual Layer IT Solutions

Dual Layer IT Solutions

Dual Layer offer a full range of IT Services and Solutions for businesses from IT infrastructure design to cloud/hosted solutions, cybersecurity, disaster recovery and IT training.

IFE Digital Systems

IFE Digital Systems

IFE Digital Systems conducts research, development and consultancy in risk, safety and security related to digital systems in critical infrastructure.

Ensconce Data Technology (EDT)

Ensconce Data Technology (EDT)

EDT’s focus is on providing solutions to properly sanitize Solid State Drives (SSD) and Magnetic Drives (HDD) before they are disposed or redeployed.

Altipeak Security

Altipeak Security

Altipeak Security provide Safewalk - a flexible and robust authentication platform through which we offer improved security to SMBs, corporates, banks, insurance companies, healthcare and more.

Jerusalem Venture Partners (JVP)

Jerusalem Venture Partners (JVP)

JVP’s Center of Excellence in Be’er Sheva aims to identify, nurture and build the next wave of cyber security and big data companies to emerge out of Israel.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

Ergo

Ergo

Ergo is a world-class IT Partner of choice, leveraging the latest technology available in cloud, mobility, big data, analytics, and social media.

NuID

NuID

NuID is a pioneer in trustless authentication and decentralized digital identity.

IT Band Systems

IT Band Systems

IT Band Systems is an international provider of IT products and services including web server monitoring and web security consulting.

Global Resources

Global Resources

Global Resources' planning and management capabilities support city, regional, and national utility and infrastructure management, and information systems and cyber security service delivery.

AML Global Solutions (AMLGS)

AML Global Solutions (AMLGS)

AMLGS delivers Financial Crime prevention training programmes and consultancy services encompassing Anti-Money Laundering (AML), Counter Terrorism Financing (CTF), Bribery & Corruption and Fraud.

link22

link22

link22 offers a high level of expertise within IT security and system solutions. We help public and private actors with highly secure IT-solutions.

Eunetic

Eunetic

Eunetic IT security solutions - we secure your websites, emails, domains and data.

Lumifi

Lumifi

Lumifi provide end-to-end cybersecurity resilience solutions with a specialty in managed detection and response (MDR) services.

NetScout

NetScout

NetScout offers a powerful combination of service assurance, cybersecurity, and business intelligence solutions for today’s most demanding service provider, enterprise and government networks.