CHAPTER 1 Build Resilient Infrastructure Raise the level of cybersecurity competency across Government The Government Bug Bounty Programme and Vulnerability Disclosure Programme As we become more reliant on Safeguard important entities and systems beyond CIIs digital systems, the Government The Government Bug Bounty Programme (GBBP) is must ensure that public officers a programme that invites established cybersecurity are well equipped with the researchers to conduct targeted assessments on skills and knowledge to keep critical government systems with a bounty reward themselves cyber safe. The for critical vulnerabilities discovered. On the other Government will also develop hand, the Vulnerability Disclosure Programme (VDP) disruption will have significant knock-on effects to the rest of Singapore. We will a Cybersecurity Functional is a crowdsourcing platform for the public to identify Competency Framework to and report vulnerabilities in government internet- also address the risks of new digital operating models, so that Singaporeans can provide clear development facing mobile and web-based applications. Through milestones for government this platform, SNDGG encourages responsible cybersecurity specialists. reporting of any suspected vulnerability while In addition, SNDGG has strengthening the sense of collective ownership over launched the GovTech Digital the cybersecurity of government systems. Academy that will provide customised cybersecurity Building on the success of the GBBP and VDP, SNDGG training programmes for ICT&SS launched the new Vulnerability Rewards Program professionals in Government. (VRP) in 2021. Together, the three crowdsourced vulnerability discovery programmes supplement Govtech’s suite of initiatives to safeguard Government systems. Vulnerability Rewards Programme (VRP) Vulnerability Disclosure Programme (VDP) With increasing reliance on digital infrastructure and services, the Government must look beyond CIIs to support the cybersecurity of other entities, especially if their confidently unlock the benefits of new technologies with peace of mind. Raise cybersecurity posture of important systems and entities beyond CIIs Address cybersecurity risks arising from new digital operating models While cyber regulations around the world are Digital technologies will always evolve, largely focused on preventing the disruption and we must be ready to adapt to the of essential services, there are some new operating models that emerge as systems and entities that do not deliver a result. For example, cloud services essential services but can nevertheless are increasingly important for the have a significant impact on Singapore if provision of digital services supporting disrupted or compromised. In this regard, key business functions and operations. we must likewise raise their cybersecurity The Government will study the public posture to protect that our digital economy policy implications of emerging digital and way of life. The Government will study operating models and seek to address the wider digital landscape and ensure that the risks as appropriate. these significant systems and entities are adequately protected against malicious cyber threats. 19 The Singapore Cybersecurity Strategy 2021 20