Chapter 3 Upping the Game on Singapore’s Cybersecurity Featured Topic Featured Topic Digital Defence — Total Defence’s Sixth Pillar Government Bug Bounty Programme / Vulnerability Disclosure Programme As we work towards being a Smart Nation, digital technology will pervade all aspects of how we live, work and play. It will connect us to the world and open up opportunities for us to progress. However, it also makes us increasingly vulnerable to threats from the digital domain. These threats can disrupt our way of life, undermine our social cohesion and affect the psychological resilience of our people. Digital Defence, therefore, becomes more important. Source: Nexus. Digital Defence is about being secure, alert and responsible online so that we can protect and defend ourselves and Singapore from threats from the digital domain. Every individual is the first line of defence against threats from the digital domain. We all can do our part to help strengthen Digital Defence by putting in place policies and systems to strengthen cybersecurity, be vigilant and equipped to respond against fake news and disinformation and strengthen digital readiness among Singaporeans. The Government Bug Bounty Programme (BBP) was launched in December 2018 to: (1) identify blind spots in the cybersecurity defences of Government Internet-accessible applications; and (2) build a shared sense of collective ownership over the cybersecurity of our systems, by involving the local and global community of researchers. The Government BBP focuses on a number of identified systems at a time, and permits conditional exploration by researchers for a short period of about three weeks. The first and second Government BBP garnered participation from close to 700 local and overseas cybersecurity researchers and white hats, and about 60 validated vulnerabilities were remediated. To provide a wider umbrella and supplement the BBP, the Vulnerability Disclosure Programme (VDP) was launched in October 2019 to: (1) provide a channel for the public to report suspected vulnerabilities; and (2) practise coordination and remediation efforts at both ministry and agency levels in a timely and sustainable manner. The VDP covers all Government-owned Internetfacing systems; the difference between the Government BBP and VDP is that there are no bounty pay-outs for vulnerabilities reported, and no authorisation given for any form of exploitation. These collaborations with the cybersecurity community-at-large have helped the Government discover vulnerabilities that would otherwise have been undetected, and strengthen the security posture of the Government’s ICT systems and digital services. CSA encourages organisations and companies that want to go beyond baseline cyber hygiene assurances to consider undertaking bug bounty programmes or establishing a responsible vulnerability reporting policy. These steps could strengthen their cyber defences by proactively discovering and eliminating vulnerabilities, which in turn would reduce their reputational risk in the event of a cyber incident. “Amid the rise in scale of cyber-attacks and complexity of systems deployed online, organisations are finding it a challenge to guarantee perfection in their security programmes through their effort alone. A public Vulnerability Disclosure Programme, which invites and rewards members of the public to report security weaknesses, will be a good complement to existing enterprise effort. As the reward is only disbursed if it is a valid report, this is a low-cost, high-return cyber component that every organisation with Internet-facing digital assets should have.” Mr Steve Lam Cybersecurity Partner, Ernst & Young Advisory Pte. Ltd. 36 SINGAPORE CYBER LANDSCAPE 2019 37