Treat cybersecurity as a national resilience issue

This visual is human-created, AI-aided.

MALAYSIA’S rapid digital transformation is creating economic opportunities, but it is also expanding the country’s exposure to cyber threats.

The growth of e-commerce, digital banking, cloud computing, artificial intelligence and government online services means that more personal, financial and institutional information is stored and transmitted digitally.

The critical question is whether Malaysia’s cybersecurity capabilities are developing at the same pace as its digital economy.

Data centres are an important part of this transformation. Malaysia, particularly Johor and the Klang Valley, has attracted major investments in data centre infrastructure because of its strategic location, connectivity and growing demand for cloud services.

However, these facilities are not merely industrial buildings; they also house valuable data and support essential digital services. A successful cyberattack could disrupt business operations, expose confidential information and undermine public confidence.

Their concentration also creates potential risks involving service disruption, ransomware, espionage and attacks on critical infrastructure.

Malaysia’s geopolitical position adds another dimension. Located along important regional trade and communication routes and situated between major economic powers, Malaysia operates within a strategically significant part of South-East Asia.

Regional tensions, international competition over technology and state-linked cyber operations can increase the country’s exposure to cyber espionage and infrastructure attacks.

This does not mean Malaysia will necessarily become a target in every geopolitical dispute, but its growing economic and technological importance makes cybersecurity a national security concern rather than simply an IT issue.

Malaysia has begun establishing a regulatory framework. The Cyber Security Act 2024 (Act 854), which came into force on Aug 26, 2024, strengthens the protection of National Critical Information Infrastructure (NCII), establishes responsibilities for relevant organisations and introduces licensing requirements for certain cybersecurity service providers.

These are important steps, but legislation alone cannot guarantee security.

Malaysia should now focus on stronger enforcement, compulsory and timely reporting of cyber incidents, regular independent security audits and mandatory penetration testing for organisations managing sensitive data.

Data centre operators and cloud providers should face clear minimum standards covering encryption, access controls, backup systems, disaster recovery and supply-chain security. The government should also strengthen the Personal Data Protection framework, ensuring that organisations are accountable for how personal information is collected, stored, shared and protected.

Comparisons with other countries offer useful lessons. Singapore, through amendments to its Cybersecurity Act and its 2025 guidelines for cloud services and data centres, has extended its regulatory attention to foundational digital infrastructure. This approach recognises that failure at a major cloud provider or data centre can affect numerous businesses and public services simultaneously. Malaysia could consider adopting similarly specific requirements for major infrastructure operators.

Estonia, meanwhile, demonstrates the importance of treating cybersecurity as a national resilience issue. Its approach combines coordinated government response, public awareness, international cooperation and investment in technical expertise.

Estonia’s experience with cyber threats also illustrates how geopolitical tensions can translate into attacks against government and essential services. In 2007, Estonia faced an unprecedented wave of massive cyberattacks against its state and private infrastructure following a political dispute with Russia. The event is widely regarded as the first instance of cyber warfare against a nation.

A country cannot claim to be digitally advanced if it cannot protect the digital infrastructure on which its economy depends. Malaysia’s ambition to become a regional digital hub must therefore be matched by an equally ambitious commitment to cybersecurity, data privacy and national resilience.

R. MURALI RAJARATENAM

Kuala Lumpur