Charmian Aw on Singapore's Cybersecurity Bill

TL;DR

Singapore's proposed cybersecurity bill would establish obligations and response procedures across public and private sectors, with particular importance for operators of critical information infrastructure. Charmian Aw argues that cyber resilience requires broad awareness, cooperation with government agencies, stronger organizational governance, and closer involvement from cybersecurity, risk, and information officers as Singapore pursues its Smart Nation program.

Transcript

Hello, this is Britta Glade. I am senior content manager with RSA Conference, here today on our last day in beautiful Singapore for RSA Conference 2017, Asia Pacific and Japan. I'm joined today by a fabulous speaker that we've had the pleasure of having on our agenda, Charmian Ah, who's a director with Drew & Napier. Thank you so much for joining u... Read More

Key Insights

• Singapore's proposed cybersecurity bill was described as the country's first omnibus cybersecurity law, applying across public and private sectors and providing a legislative framework for combating cyberattacks.
• The public consultation was expected to close on August 3, giving organizations and individuals an opportunity to seek clarification and submit feedback about how the proposed requirements could affect them.
• Cyberattacks affecting Singapore included incidents in which Singpass credentials were stolen or compromised, exposing sensitive access connected to government portals, tax records, and CPF contribution information.
• A cyberattack on a local telecommunications provider caused broadband service to be unavailable for two hours, illustrating that cybersecurity incidents can disrupt services as well as compromise sensitive information.
• The bill was intended to provide clearer procedures for preventing and detecting cyberattacks, responding when incidents occur, and taking remedial measures after an attack.
• Singapore's Smart Nation program depends on cybersecurity because the planned use of smart technologies to improve people's lives also requires systems and services to remain safe and resilient.
• Operators of critical information infrastructure would carry specific legal obligations, particularly within essential service sectors such as healthcare, financial services, water, media, and telecommunications.
• Cyber resilience requires cooperation across the wider ecosystem because investigators may request useful information from anyone relevant to an incident, while organizational leaders must work with industry groups, agencies, and government bodies.

Questions & Answers

Q: What was Singapore's proposed cybersecurity bill intended to do?

Singapore's proposed cybersecurity bill was intended to become the country's first omnibus cybersecurity law and apply to both public and private sectors. It aimed to combat cyberattacks through legislation while giving organizations clearer guidance on prevention, detection, incident response, and remedial action. The bill also defined responsibilities connected to critical information infrastructure and supported broader cooperation with government agencies.

Q: Why was Singapore introducing cybersecurity legislation at that time?

Two policy considerations made the proposed law timely. Singapore had experienced cyberattacks involving compromised identities, stolen Singpass credentials, and disruption to a local telecommunications provider's broadband service. At the same time, Singapore was launching its Smart Nation program and planning greater use of smart technologies. Aw argued that becoming smarter also required the country to remain safe and cyber resilient.

Q: What cybersecurity incidents affecting Singapore were discussed?

Aw discussed incidents in which Singpass credentials were stolen or compromised on two occasions. Singpass was described as sensitive identification used to access government portals, including tax records and CPF contribution information. She also cited an attack that caused a local telecommunications provider's broadband service to go down for two hours, demonstrating the practical impact of cyber incidents.

Q: Who needed to understand Singapore's cybersecurity bill?

Aw said everyone should have basic awareness of the proposed law. Operators of critical information infrastructure would face particular legal obligations, especially in healthcare, financial services, water, media, and telecommunications. However, an investigating agency could also request assistance from anyone able to provide relevant and useful information, making awareness important throughout the broader cybersecurity ecosystem.

Q: What is critical information infrastructure under the proposed bill?

The interview describes critical information infrastructure through the essential service sectors that depend on it, including healthcare, financial services, water, media, and telecommunications. Operators serving these sectors would be subject to specific legal obligations under the proposed bill. The discussion does not provide a more detailed legal definition, but it emphasizes these operators' responsibilities for cybersecurity and resilience.

Q: How would the cybersecurity bill change organizational governance?

The bill would give organizations greater clarity about the measures they should establish to support a cyber-resilient environment. Aw suggested that companies might need to reconsider governance and place more emphasis on cybersecurity responsibilities. Cybersecurity, risk, and information officers would need to collaborate closely within their industries and with relevant associations, agencies, and government bodies to comply with the law.

Q: How does cybersecurity support Singapore's Smart Nation program?

Singapore's Smart Nation program planned to use smart technologies to improve people's lives, but Aw argued that technological advancement must be accompanied by safety. The proposed cybersecurity legislation was therefore presented as an important foundation for the program. It would help establish responsibilities, response procedures, and cooperation needed to make Singapore both technologically capable and cyber resilient.

Q: What actions should organizations take in response to the proposed bill?

Organizations should examine how the proposed requirements could apply to their operations, review their governance arrangements, and identify measures for preventing, detecting, responding to, and remediating cyberattacks. During the consultation period, they could also submit feedback and request clarification from the Cyber Security Agency. Leaders responsible for cybersecurity, risk, and information should prepare to work more closely with industry and government bodies.

Summary & Key Takeaways

• Singapore's proposed cybersecurity bill was presented as the country's first omnibus cybersecurity law covering both public and private sectors. Its public consultation was scheduled to close on August 3. Attendees focused on how the legislation might apply to their organizations and what issues required clarification from the Cyber Security Agency.

• Cyberattacks affecting Singapore provided one policy reason for the bill. Aw cited incidents involving compromised Singpass credentials and a local telecommunications provider whose broadband service went down for two hours. The legislation was intended to clarify how organizations should prevent, detect, respond to, and remediate cybersecurity incidents.

• Singapore's Smart Nation program provided another reason for strengthening cybersecurity legislation. Aw argued that expanded use of smart technologies must be accompanied by safety and cyber resilience. The bill could reshape organizational governance, elevate cybersecurity leadership roles, and require cooperation among businesses, industry associations, government agencies, and other relevant stakeholders.