PETALING JAYA: The Malaysian Anti-Corruption Commission (MACC) should adopt a cybersecurity strategy that assumes attackers will eventually breach its systems, while ensuring they cannot move freely or manipulate sensitive information, say cybersecurity experts.
Cybersecurity expert Datuk Dr Amirudin Abdul Wahab said a successful attack that altered or destroyed evidence could undermine an investigation, even if details of the breach were never made public.
“A cyberattack on an institution such as MACC is not just an IT problem. It can become an integrity and national security issue because its systems contain sensitive investigation information, intelligence, evidence and details about witnesses or suspects.
“The real concern is whether an attack could compromise the integrity, confidentiality or availability of information on which investigations and enforcement decisions depend,” said Amirudin, a former CyberSecurity Malaysia chief executive officer.
He said MACC must assess three areas: whether attackers could penetrate or disrupt its systems, manipulate evidence or records, and undermine public confidence in the integrity of investigations.
Cybersecurity should therefore be embedded in the agency’s governance, with accountability extending beyond its IT department to senior management, investigators, legal officers and the organisation’s leadership, he added.
Amirudin said firewalls, encryption and multi-factor authentication were essential but insufficient, as sophisticated attacks increasingly targeted user identities, devices, applications, privileged accounts, supply chains and human behaviour.
He recommended a layered defence incorporating zero-trust architecture, privileged access management, endpoint detection and response, network segmentation, data loss prevention, secure offline backups and a security operations centre.
“Never automatically trust a user, device or connection simply because it is inside the network. Administrator and investigator privileges must also be tightly controlled, with time-limited access where appropriate,” he said.
He also urged MACC to strengthen authentication, verify devices, conduct regular security testing and improve incident response, while protecting digital evidence through documented chain of custody, cryptographic hashing, tamper-evident audit logs and secure storage.
Monitoring privileged users, separating duties and using automated anomaly detection would help identify suspicious activities, including unusual file access or unauthorised changes to evidence, he added.
Every piece of digital evidence should be traceable, with clear records of who acquired it, when and where it was stored, who accessed it and whether it had been altered.
“For a law enforcement institution, cybersecurity is ultimately about preserving trust. If a cyberattack compromises information, evidence or investigative processes, it becomes an attack on institutional integrity itself.”
Amirudin was responding to reports that MACC detects and blocks between 80,000 and 90,000 cyberattack attempts daily.
Cybersecurity consultant Fong Choong Fook said MACC must recognise that cyberattacks were increasingly carried out by automated software and machines, requiring equally rapid responses.
“With AI (artificial intelligence) automation, many attacks are generated by AI. This should be expected. Attacks in the cyber world are continuous, and government agencies must remain on high alert.
“With hackers making full use of the latest technology, the question is whether our agencies are fully trained to respond,” he said.
