Chapter 3 Keeping Our Cyberspace Safe and Trustworthy Together CYBERSECURITY FOR A SMART NATION Official opening of the CREST examination facility at the Singapore Institute of Technology on 28 July 2016 CSA strongly advocates the security-bydesign approach, which means designing and building in security from the outset, and throughout every phase of the software and hardware development lifecycle. This approach involves a rigorous process that includes (i) threat-risk assessments, (ii) optimising system design by balancing the trade-offs among security, usability and cost, and (iii) penetration testing. This approach will also underpin the design and development of Singapore’s Smart Nation. While a Smart Nation creates new opportunities for work and leisure, it inadvertently expands the attack surface as well with the greater connectivity between devices, and among us. The cyberattack in the United States in October 2016, carried out through compromised IoT devices, exemplifies such a threat. 42 In April 2016, the CREST Singapore Chapter was established by CSA in collaboration with the Association of Information Security Professionals (AISP), IMDA, GovTech, the Association of Banks in Singapore and the Monetary Authority of Singapore. This is also the first CREST Chapter in Asia. CSA has directed that from June 2017, all penetration testing professionals and service providers who provide penetration testing services for CII need to be certified and accredited through CREST or equivalent certifying bodies. R&D work in cybersecurity will also be another critical front to push in the Smart Nation journey. Together with the National Research Foundation (NRF) and the other stakeholder agencies, CSA is driving Singapore’s cybersecurity R&D effort through the S$190m National Cybersecurity R&D programme, which aims at improving the trustworthiness of cyber infrastructure, raising the barrier for attackers, and developing threat-based solutions. LOOKING AHEAD The Singapore Cyber Landscape 2016 has given an initial glimpse of the nation’s cyber health. We believe it is but the tip of the iceberg. We hope it will spur greater involvement of all stakeholders – Government agencies, Singapore’s cyber industry, professionals and students, academia and researchers, and providers of essential services – to come up with new ways to better defend ourselves against ever-evolving cyber threats. Cybersecurity is a team effort. Everyone has a part to play, and everyone has to play their part. At the national level, CSA will continue to spearhead initiatives and engage stakeholders to enhance Singapore’s cybersecurity posture. At the organisational and individual levels, efforts must be made too to raise awareness, capabilities and resilience to counter the cyber threats that Singapore will continue to face. If we work together as a team, we can make Singapore a safe and trustworthy Smart Nation. 43