New tool to help firms strengthen IT security

Singapore — Against the backdrop of recent cyberattacks in Singapore and the world, and as small and medium enterprises (SMEs) are increasingly targeted by cybercriminals, the Government yesterday announced a new initiative to help firms protect themselves against the growing menace.

The Infocomm Development Authority (IDA) wants to promote the adoption of infocomm security measures among companies, especially SMEs. For a start, it will begin a trial of the Infocomm Security Starter Kit for firms via a free online portal.

The tool, which will be launched by the end of next month, will assess IT security plans of businesses and make recommendations based on their budgets and gaps in cybersecurity. It is a joint venture between the IDA, Singapore Business Federation (SBF) and SME Infocomm Resource Centre (SIRC).

Mr S Iswaran, Minister in the Prime Minister’s Office, who announced this at the National Security Conference yesterday, urged businesses to treat cybersecurity as a top management focus, instead of leaving it to only the IT department.

“Enterprises need to acknowledge the significant risk that cyberattacks pose to their business operations. What’s more, cyberattacks are increasingly targeting SMEs, stealing data, spreading misinformation,” he said, referring to a Verizon report this year that put attacks on retail transactions using credit cards as the main area of breach.

SMEs were found to be the most frequent targets because of their perceived vulnerability to such attacks.

Mr Iswaran also quoted an SBF survey that found that although 30 per cent of local firms have been cyberattack victims, companies are generally ill-prepared. A separate IDA survey last year found that only 21 per cent of respondents had intrusion-detection systems to prevent data leakage.

“This underscores the vulnerability of businesses to cyberattacks,” he said, calling to attention the K Box and M1 incidents recently. Personal details of more than 300,000 members of karaoke chain K Box were leaked by hackers, while an M1 customer discovered a security loophole on its site and used it to access details of other customers.

The Government, said Mr Iswaran, would support businesses to enhance their cybersecurity awareness and systems. On the new tool, he said it could help companies improve their cyber-incident preparation, mitigation, response and recovery plans.

The portal will require firms to answer 27 questions, after which it will suggest a list of IT security products and services. They can also consult the SIRC after the online assessment.

Industry associations welcomed the service, saying cybersecurity is now crucial. However, they added that certain aspects of the portal needed to be improved on.

Mr Michael Phoon, executive director of the Singapore Shipping Association, said: “There are no common standards. Every vendor is touting its own products. Will the recommendations be made according to a certain standard? While big companies have money to spend on (security) systems, SMEs have budget constraints and we don’t want to over-invest in systems that are corporate grade.”

“It also doesn’t show where a company stands among its peers in terms of IT security. It is important to know, so if I am behind, then I better start investing in systems,” he added.

Regardless, Mr Phoon thinks the industry will start taking cybersecurity seriously, making reference to the K Box incident.

“With personal data stolen through even harmless activities such as KTV, how would anyone imagine not investing in systems?” he asked.