Chapter 3 Upping the Game on Singapore’s Cybersecurity Pillar One: Building a Resilient Infrastructure “As a community we have Critical Information Infrastructure (CII) sectors are essential pillars which support the foundation of Singapore’s economy. The effects of a cyber-attack on the CII sectors could result in significant disruptions to the economy and our society. In addition, there may be ramifications beyond our shores as Singapore is an international hub for trade, finance and logistics. The strategic imperative is to ensure that essential services are resilient to minimise impact and the duration of disruption in the event of a cyber-attack. The Government is committed to working with key stakeholders to strengthen the resilience of our CII sectors. Singapore’s Operational Technology (OT) Cybersecurity Masterplan 2019 Operational Technology are systems that control physical processes, industrial processes and manufacturing equipment. As many of the CII rely on them, attacks on OT systems can have serious consequences, including physical disruption of its activities. Singapore’s OT Cybersecurity Masterplan hence serves as a strategic blueprint to guide national efforts to foster a resilient and secure cyber environment for Singapore’s OT environment. Launched at the Singapore International Cyber Week (SICW) 2019, the Masterplan takes a balanced approach between security requirements, rapid digitalisation and ease of conducting business-asusual activities. moved beyond the land of theoretical cyber-attacks on industrial operations to a world where these attacks are a reality for denying power, disrupting operations, and even specifically targeting human life as was the case in the TRISIS cyberattack in 2017. The threat is worse than we realise but not as bad as we want to imagine. It is a worthy cause to invest in and prioritise OT cybersecurity and it is a winnable battle.” Mr Robert M. Lee CEO and Founder of Dragos Inc. Spanning the areas of “People”, “Process” and “Technology”, the Masterplan aims to uplift the cybersecurity practices of CII Owners (CIIOs) and organisations that operate OT systems. The key thrusts include: • Providing OT cybersecurity training to develop human capabilities; • Facilitating the sharing of information through an OT Cybersecurity Information Sharing and Analysis Centre (OT-ISAC); • Strengthening OT owners’ policies and processes through the issuance of an OT Cybersecurity Code of Practice (CCoP) that provides cybersecurity controls and outcomes specific to OT systems; and • Adopting technologies for system resilience through Public-Private Partnerships. Featured Topic International Critical Infrastructure Security Showdown Supported by the National Cybersecurity R&D Programme (NCR) that is co-chaired by CSA and National Research Foundation (NRF), the 3rd International Critical Infrastructure Security Showdown was conducted at the Singapore University of Technology and Design (SUTD) in August 2019. Teams from the USA, Italy, Japan, Estonia and Singapore took part in the three-day invitation-only exercise, which brought together security assessors and researchers from both industry and academia to develop capabilities in handling a diverse range of attack vectors on a realistic critical infrastructure platform. Cloud Software-as-aService (SaaS) Whitelisting In 2019, the Government adopted a “CommercialCloud first” policy where agencies shall, as a default, use Commercial Cloud for new Restricted and Unclassified ICT systems. This is to deliver better, faster and more cost-efficient digital services to citizens and businesses. In support of this policy, GovTech launched a Software-as-a-Service (SaaS) whitelisting process. This process ensures that only SaaS with adequate controls can be utilised in the Government environment. To use the SaaS, an agency has to document the necessary features, controls and contractual agreements of the SaaS. Thereafter, the Government will assess the risk of the software application by investigating areas, such as data jurisdiction, mode of access, use case, contractual agreements and information sensitivity. With the SaaS whitelisting process, GovTech has evaluated over 20 applications and services on the cloud, and has approved more than 15 SaaS requests that complied with stringent cybersecurity requirements. 32 SINGAPORE CYBER LANDSCAPE 2019 Whistleblowing Scheme CSA has implemented the Whistleblowing Scheme to provide individuals with a channel to disclose information on coverups relating to: • Incidents that may threaten the cybersecurity of CII sectors; • Malicious behaviour and dereliction of duty from individuals who may compromise the cybersecurity of CII; and/or • Deliberate mis-stating or falsification of information to CSA. The objective of the scheme is to uncover wrongdoings that may threaten the cybersecurity of CII. The scheme will enable CSA to have better oversight of incidents affecting the CII sectors, and for CSA to take prompt and necessary action. 33