CHAPTER 3 SINGAPORE’S CYBERSECURITY STRATEGY – DEVELOPMENTS IN 2018 PILLAR ONE: BUILDING A RESILIENT INFRASTRUCTURE FEATURED TOPIC Participants from the maritime sector being briefed at the opening address for Exercise CyberArk in July 2018. Source: CSA. MEASURING MATURITY OF CII SECTORS CONDUCTING CYBERSECURITY EXERCISES FOR CII SECTORS As part of efforts to build a resilient infrastructure, CSA launched its CII Protection Programme. Under the programme, the Readiness Maturity Index (RMI) Framework evaluates the cybersecurity maturity of CII sectors delivering essential services, and allows Sector Leads to build cyber capabilities and resilience against evolving cyber threats. Since its formation, CSA has been conducting sector-specific Exercise CyberArk (XCA) to ensure readiness of all CII sectors in defending against increasingly sophisticated cyber-threats. In 2018, over 300 participants from the Media, Aviation, and Maritime sectors took part in XCA on separate occasions to review, exercise and validate their cyber defence capabilities and incident response plans. The 4-month planning and development cycle for each run of the exercise culminated in a 2-day Table-Top Exercise (TTX), where participants were The maturity of a CII sector is measured based on respective CII owners’ attributes in the RMI Framework. As of 2018, all 11 CII sectors have attained a maturity level of “measurable”, which means that they have demonstrated governance, management oversight, formalised policies, assigned responsibilities, and training of people, with consistent and measurable outcomes. CSA will continue to develop appropriate cybersecurity metrics beyond the RMI framework. put through a series of scenarios that gradually built up towards a cybercrisis. Simulated media conferences were then conducted to validate the sectors’ crisis communication processes. Besides the sector-specific XCA, CSA also conducts a national-level, multisectoral exercise – Exercise Cyber Star (XCS) – to validate the National Cyber Crisis Management System. Two runs of XCS have been conducted to date, with the third one planned for 2019. CYBERSECURITY ACT: THE JOURNEY The Cybersecurity Bill was passed in Parliament on 5 February 2018 and came into force on 31 August 2018. Extensive public consultations were carried out by CSA and the Ministry of Communications and Information (MCI) in the drafting of the Act. This included closed-door consultations with key stakeholders, ranging from Government agencies, potential CII owners, industry associations and cybersecurity professionals, as well as an open public consultation from 10 July to 24 August 2017. The Cybersecurity Act establishes a legal framework for the oversight and maintenance of national cybersecurity in Singapore. Its four key objectives are to: Strengthen the protection of CII against cyber-attacks. Authorise CSA to prevent and respond to cybersecurity threats and incidents. Establish a framework for sharing cybersecurity information. Establish a light-touch licensing framework for cybersecurity service providers (to come into force at a later date). A key feature of the Act is the appointment of a Commissioner of Cybersecurity who is empowered by the Act to oversee all aspects of cybersecurity in Singapore. The Commissioner is assisted by Assistant Commissioners of Cybersecurity, appointed from the respective sectors, who provide the deep domain knowledge and expertise. The Cybersecurity Act provides the Commissioner and his supporting cybersecurity officers with an important regulatory instrument and statutory powers with which to strengthen Singapore’s cybersecurity and combat cyber threats. PSA remains fully committed towards strengthening the capabilities and resilience of our people, processes and platforms against cyber threats, to ensure the continuity of global trade and realising the “Internet of Logistics”. – Mr Ong Kim Pong, Regional CEO of PSA Southeast Asia, on contributing to cybersecurity in Singapore’s maritime sector 36 37