Chapter 3 Upping the Game on Singapore’s Cybersecurity Pillar Two: Creating a Safer Cyberspace Enhancing IoT Cybersecurity Cyber technology can enable and empower businesses and society, but only if it is safe and trustworthy. A safer cyberspace Distinguished experts from the government, industry, and academia came together at the 4th IIoTSR to galvanise global efforts towards a secure and trusted IoT ecosystem. Source: CSA. is the collective responsibility of the Government, enterprises and everyone in the community. There is a need to constantly raise understanding of cybersecurity issues and promote adoption of good practices among enterprises and the community. National Cybersecurity Awareness Campaign Cybersecurity Labelling Scheme In recent years, consumers have increasingly adopted Internet of Things (IoT) or smart devices, such as Smart TVs, Home Assistants and IP cameras, with numbers expected to reach 75 billion by 2025. Out of the box, these devices typically have inadequate cybersecurity provisions and are often easily compromised, putting their users at risk. CSA launched the third National Cybersecurity Awareness Campaign “Go Safe Online 2019” at Ang Mo Kio Central Stage on 14 September 2019. The campaign focused on the personal consequences of not adopting good cybersecurity practices, and highlighted CSA’s four cyber tips.36 This Campaign has expanded since its inception in 2017. The number of roadshows increased from one to three, so that members of the public have more avenues to learn about cybersecurity through interactive games, and obtain face-to-face advice from cyber champions on site. The first two roadshows 36 37 34 Visitors trying their hand at creating a strong password at the second roadshow of “Go Safe Online 2019” at Our Tampines Hub. Source: CSA. were held in the second half of 2019 at Ang Mo Kio Central Stage and Our Tampines Hub, and they attracted close to 37,000 visitors. This was followed by a campus roadshow at the Institute of Technical Education College West in January 2020, which drew close to 5,000 students and staff. To expand the reach of the campaign, a series of videos with print and online adaptations also made its rounds on social media, with additional publicity in cinemas, banks, clinics, HDB lift doors, buses and MRT stations. Since May 2019, CSA has rolled out 50 runs of a “Go Safe Online” drama skit to secondary schools. The skit was seen by over 32,000 students and teachers, and was well-received for conveying cybersecurity messages in an engaging way. The Cyber Savvy Machine Pop Up37, introduced in November 2018, has toured Singapore’s public libraries, schools and organisations including the Singapore Discovery Centre. In 2019, the machine recorded close to 82,000 attempts. CSA’s four cyber tips that Internet users should adopt to safeguard their digital devices and data include: 1) Use strong passwords and enable Two-Factor Authentication (2FA); 2) Spot signs of phishing; 3) Update software promptly; and 4) Install anti-virus software. The Pop Up comprises a Cyber Savvy vending machine and information panels on the four cybersecurity tips. Participants can test their cybersecurity knowledge through a quiz on the vending machine and win a small gift in the process. SINGAPORE CYBER LANDSCAPE 2019 As part of efforts to better secure Singapore’s cyberspace and raise cyber hygiene levels, CSA launched the Cybersecurity Labelling Scheme (CLS) for network-connected smart devices in early 2020. The scheme, which marks a first in the Asia Pacific region, will comprise different levels of cybersecurity ratings to help consumers make informed choices about the security features of the smart devices they purchase. For a start, CLS will focus on products such as routers and Smart Home Hubs that have a greater impact on consumers. The cybersecurity labels issued under CLS will provide an indication of the security provisions in the registered products. CCCY and the Cybersecurity Standards Roadmap During SICW 2019, CSA and Enterprise Singapore announced the formation of a Coordinating Committee for Cybersecurity (CCCY) under the Singapore Standards Council (SSC), to coordinate and facilitate sharing of cybersecurity information in Singapore, and to formulate a five-year Cybersecurity Standards Roadmap. The Roadmap will cover standards relating to organisations and the IT user community, to help companies and Government agencies mitigate cyber threats, as well as raise cyber hygiene and security assurance. 38 Thought Leadership and Knowledge Sharing During SICW 2019, CSA also hosted the 18th International Common Criteria Conference (ICCC) and the 4th International IoT Security Roundtable (IIoTSR). These events brought together thought leaders and experts from more than 30 countries, ranging from public and private sectors, to discuss and galvanise global efforts in both Common Criteria and IoT security. Singapore has been a Common Criteria Certificate Authorising Nation38 since January 2019. As part of ICCC 2019, CSA also hosted the 4th IIoTSR, which serves as an international platform that brings together industry, government and academia to galvanise global efforts towards a secure IoT ecosystem. During the 4th IIoTSR, Singapore and the Netherlands jointly published the IoT Security Landscape Study to enhance understanding on the IoT landscape, and its cybersecurity risks and challenges. Singapore and the United Kingdom (UK) also signed a Joint Statement to strengthen partnerships in this area. These initiatives underscore the concerns that Singapore and various countries share regarding this hyper-evolving and dynamic domain, as well as CSA’s joint commitment towards a safer and secure IoT environment. Singapore attained the status of a Certificate Authorising Nation in January 2019 under the Common Criteria Recognition Arrangement. Common Criteria (CC) is the de facto standard for cybersecurity standard certification around the world, and CC certificates are mutually recognised across 30 nations. 35