PETALING JAYA: As the digital world continues to evolve, organisations in Malaysia face an ever-shifting landscape of cybersecurity threats.
Among the prime targets in the crosshairs of cyber attackers, two sectors stood out – financial services and telecommunications.
Shedding some light on the cybersecurity challenges for organisations operating in the country, Ensign InfoSecurity Malaysia (Ensign security operation centre) director Jeremy Moke told StarBiz the reasons behind cyber attacks on the financial services sector is its substantial assets and the treasure trove of sensitive financial data it safeguards.
He said such attacks on financial institutions have the potential to inflict financial losses, including fund theft, fraudulent transactions and the dreaded ransomware extortion.
The compromise of customer data not only jeopardises trust but can also lead to regulatory fines for security breaches, he said.
“Simultaneously, the telecommunications sector, which is critical to providing communication services, is also vulnerable to cyber attacks. This domain’s cyber attacks have the potential to disrupt critical services such as voice calls, messaging and Internet access.
“This disruption has an impact on businesses and individuals that rely on these services on a daily basis.
“Attacks against essential infrastructure components in the telecommunications industry, such as data centres, network equipment, and communication towers, can result in service disruptions and infrastructure repair costs.
“These ramifications are seen across a variety of industries, including emergency services, healthcare, transportation and financial transactions,” Moke added.
Ensign InfoSecurity, which is one of Asia’s largest cyber security firms, was formed as a result of a joint venture between Singapore’s Temasek Holdings Ltd and the city-state’s multinational telecommunications conglomerate StarHub Ltd.
He said the aftermath of the Russian-Ukraine crisis in 2022 had a profound impact on cybersecurity, particularly in the realm of ransomware attacks.
Moke noted that cyber supply chain attacks have consistently ranked among the top cybersecurity threats since the SolarWinds supply chain attack and the Log4j vulnerability incidents in recent years.
The SolarWinds attack is a global hack, as threat actors turned the Orion software into a weapon gaining access to several government systems and thousands of private systems around the world.
Log4j is used by developers to keep track of what happens in their software applications or online services.
The lack of transparency in the cybersecurity supply chain remained a concern, with libraries used for software development, subcontractors, and hardware components often concealed from consumers.
This obscurity allows threat actors to infiltrate victims’ environments by exploiting intricate and interdependent trusted relationships, he said.
He said although the rise of artificial intelligence (AI) applications, such as US-based OpenAI’s ChatGPT and DALL-E, promises increased productivity and diverse content generation, the same techniques can be employed by threat actors to rapidly create malware and synthetic content, such as fictitious facial representations and voice signatures.
Moke underscored the crucial role and the importance that regulators should play in the realm of cybersecurity.
“Regulators should establish clear and enforceable standards that organisations must adhere to, covering essential topics such as data security, access controls, incident response, and employee training.
“Regulations should further mandate organisations to promptly report cyber incidents, fostering coordinated responses and mitigating the impact of attacks on a larger scale.
“Collaboration is encouraged among industries, government agencies, and cybersecurity experts, resulting in a more robust and comprehensive cyber defence,” he said.
In addition, Moke called for the implementation of regular cybersecurity training and awareness programmes to educate employees about potential dangers and empower them to recognise and prevent suspicious activity.
Organisations should also assess the cybersecurity posture of third-party vendors or service providers connected to their systems, integrating security criteria into contracts to ensure compliance with required standards, he said.
While many cybersecurity firms specialise in specific aspects of cybersecurity, organisations can opt for comprehensive cybersecurity solutions that encompass all facets of digital security.
“This holistic approach provides clients with a range of capabilities, including cyber risk identification, prevention, detection, response and recovery.
“Such an approach avoids security silosand offers a single point of accountability, allowing solutions and services to evolve in sync with clients’ evolving cybersecurity needs,” he added.
