Chapter 2 Cyber Threats in Focus: Actors Targeting Singapore INSIDER THREATS FROM CSA’S SURVEY CONDUCTED IN AUGUST 2016, MANY SINGAPOREANS WERE FOUND TO BE UNAWARE OF PROPER CYBERSECURITY PRACTICES Insider threats pose a significant threat to organisations. Insiders – unintentionally or intentionally malicious – can weaken the best cyber defences. From IBM’s 2016 Cyber Security Intelligence Index, insiders were found to be responsible for 60 per cent of cyber-attacks5. Insiders are a potent source of threat and a significant concern as they can unintentionally or intentionally leak data or compromise systems, and it takes more than technology to prevent insider threats. Processes for instance, need to be in place to ensure access to the organisation’s data, especially sensitive ones, is strictly controlled. Many Singaporeans were found to be unaware of proper cybersecurity practices based on a Public Awareness Survey conducted by CSA6. Consequently, this may make them potential “insider threats”. They may inadvertently cause their office network to be compromised when they use an infected thumb drive that opens a “backdoor” for the attacker to enter the system. Using weak passwords that can be easily guessed, like “ABC123” or “password”, would allow the attacker to enter otherwise confidential areas of the organisation’s network. There are also malicious insiders who could abuse their existing access to sensitive data and intellectual property for unlawful purposes. Malicious insiders could be disgruntled former employees who leave deliberate backdoors to exfiltrate data after they leave the organisation. They are a particularly dangerous group of threat actors because they know the network well and can find ways to disrupt or degrade critical services without raising suspicion. CASE STUDY Ransomware downloaded via personal e-mail infects office network In March 2016, an employee from the Healthcare sector used her workplace computer to access her personal e-mail account. She opened what appeared to be a Microsoft Office document but was in fact a malicious file, that downloaded a ransomware into the workplace computer. As the computer was connected to the rest of the organisation, the infection quickly spread to other machines on the network. The infection forced the organisation to reformat all the affected computers and restore data from backups. This incident highlights the need to heighten cyber awareness among employees, and always be ready to kick-in business continuity plans. “Reviewing a year of Serious data breaches, major attacks, and new vulnerabilities,” IBM X-Force Research 2016 Cyber Security Intelligence Index, p.11. 5 Tiffany Fumiko Tay, “6 in 10 connect to unprotected Wi-Fi networks: Cyber Security Agency, The Straits Times, 16 February, 2017, http://www.straitstimes.com/singapore/6-in-10connect-to-unprotected-wi-fi-networks-cyber-security-agency 6 28 29