This article first appeared in Digital Edge, The Edge Malaysia Weekly on February 12, 2024 - February 18, 2024

The surge in innovation and acceleration in technology adoption have led to an increase in the number and sophistication of cybercrimes.

“To thrive in this digital landscape, businesses must prioritise their ability to persist through the entire lifecycle of a cyber­attack — before, during and after,” says Vivek Gullapalli, chief information security officer at the Asia-Pacific office of Check Point Software Technologies, an international cybersecurity solutions company.

As a growing market with increasing trade, Malaysia — along with Asean — has seen a rising number of cyberthreats, says Vivek.

According to Check Point’s Threat Intelligence Report, organisations in Malaysia saw an average of 1,277 attacks per week in the last six months.

“This is higher than the global average of 1,091 attacks per week. This is in line with our third-quarter cybersecurity report, where research shows that Asia-Pacific was the most heavily attacked region, with a substantial 15% year-over-year increase,” says Vivek.

The Palo Alto Networks’ State of Cybersecurity Report 2023 reveals that this rise in cyberattacks is due to rapid digitalisation. With Malaysia ramping up its digitalisation efforts to draw investments, it makes the country a larger target for cyberattacks.

Efforts to increase cybersecurity in the country and around the world are complicated due to the speed at which technology is advancing, constantly shifting with every new advancement, such as the rise of artificial intelligence (AI).

Eugene Teow, managing director of Cygnus Technology Solutions, an IT infrastructure and ecosystem solutions provider, says: “[AI enables] faster and smarter detection and response [to cyberthreats], improving data analysis [and] facilitating faster decision-making, innovation and automation.”

AI can look through cybersecurity reports and filter out false positives and false alarms, allowing cybersecurity experts to address real and urgent cases, he adds.

When used alongside 5G connectivity, AI provides an advantage on a wider scale, according to Vivek. “With 5G’s global reach, AI can swiftly detect previously unseen attacks in one geographic location, analyse its malicious nature, and promptly disseminate this intelligence to all security controls worldwide,” he says.

Advancements in AI, however, would also bring new dangers and issues such as the creation of new or more sophisticated threats and cybersecurity vulnerabilities, requiring more resources and expertise to address, says Teow.

“While the promise of AI and 5G is significant, it is crucial to acknowledge that these advancements also empower threat actors,” says Vivek. “As technology evolves, it becomes a double-edged sword, necessitating a continuous and proactive approach to cybersecurity.”

The Palo Alto Networks’ cybersecurity report confirms that point: While 5G would allow for more efficient communication between devices, it would also mean that bad actors such as hackers would be able to retrieve more data faster in a shorter time.

The adoption of standard cybersecurity practices, such as mandatory updates of systems and infrastructure, is important to address the rising threat that technologies such as AI could bring. These practices need to evolve and adapt quickly, alongside the changing digital landscape.

Connectivity through the internet, cloud technology, the Internet of Things (IoT) and more has led to more entry points for cyber criminals to infect a business’ digital infrastructure, known as endpoints.

Mathivanan Venkatachalam, vice-president of ManageEngine, a division of Zoho Corp that carries out IT monitoring and management, including securing network endpoints, says: “Companies have a lot of reasons [to adopt mobile devices, cloud storage and more because] productivity will increase when they adopt these technologies, and revenue will increase. So, definitely, they are adopting [digitalisation]. But it comes with a lot of challenges in terms of cybersecurity returns.”

He explains that while the technology itself is good, companies have to use proper endpoint security tools to automate security policies and prevent security attacks.

Endpoints are any devices that provide an entry point to corporate assets and applications, explains Mathivanan. Desktops, laptops, servers, workstations, smartphones and tablets are all examples of endpoints.

Endpoint security is important, as it prevents, detects and remediates cyberattacks from these endpoints, be it connection via a traditional network or even over the cloud.

Mathivanan says: “Previously, [all the cybersecurity you would need was a] firewall and router. Now, if your company has 1,000 employees, they would have 1,000 laptops and 1,000 smartphones. So, you have 2,000 endpoints, also a firewall and router. The attack surface is really big now.”

This leads to the next major challenge in cybersecurity — a lack of awareness. Many companies do not take the necessary steps because fixed, mandatory standards are not in place.

“Today’s endpoint attack surface is large and constantly [being] used by people with low cybersecurity awareness,” says Mathivanan. “It’s difficult to say that data breaches can be eliminated, but it can be drastically reduced with the proper endpoint protection.”

Standards are needed so that companies can teach their employees how to use their systems responsibly to minimise risks and data compromise, as well as to increase overall awareness of cybersecurity.

Cybersecurity awareness has been lacking in Malaysian businesses. Despite rising cyberattacks, both Teow and Vivek note a lack of urgency in taking precautionary measures.

Teow is frustrated that many companies still have not adopted basic practices and standards such as constant data back-up and “educating employees on cybersecurity awareness and practices by enforcing clear and consistent policies”.

This lack of urgency not only leaves these businesses vulnerable to attacks but also makes it harder for them to qualify for cyber insurance.

“Cyber insurance can help cover the cost of responding to a cyber incident, such as forensic investigation, legal fees, notification expenses and crisis management,” explains Teow. “It can also provide compensation for business interruption, data restoration and third-party liability claims.”

Cyber insurance, much like any other type of insurance, helps businesses obtain compensation if their cybersecurity is compromised. Since 2022, however, it has become more expensive to purchase such insurance.

Vivek says the rise in cyberthreats is a big contributor to the increase in insurance costs. Owing to the rise in cyberattacks, “insurers, in response, have become more cautious and stringent in underwriting policies to mitigate their own risks”, he adds.

“High-profile cyberattacks on major companies have drawn attention to the potentially massive financial losses associated with such incidents. Insurers are adjusting their risk assessments and pricing accordingly, making it harder for companies to obtain coverage at reasonable rates.”

This has led to insurers “placing a greater emphasis on companies implementing robust cybersecurity measures”, says Vivek.

Essentially, for businesses that do not already have an acceptable level of cybersecurity measures in place, the insurers would either raise the premiums or decline to provide them with insurance cover.

Teow, who has reached out to various cyber insurance companies, lists three main points they usually look for: endpoint security to mitigate security vulnerabilities; identity authentication to prevent unauthorised access; and a robust incident monitoring and detection system to prompt detection of security breaches.

Vivek says, “Cyber insurance can serve as a financial cushion, but it is imperative for businesses to proactively invest in comprehensive cybersecurity strategies, such as robust security controls and employee training.”

“According to the Global Cybersecurity Index 2020, Malaysia ranked eighth out of 194 countries in terms of cybersecurity commitment, with a score of 97.53 out of 100,” says Teow.

The country’s commitment to cybersecurity can be seen in the adoption of several standards and frameworks such as the National Cyber Security Policy, the Malaysian Common Criteria Evaluation and Certification Scheme, and the Malaysia Trustmark for Private Sector.

Teow points out, however, that these standards are “not mandatory for all sectors, and there is a lack of awareness and compliance among some businesses”.

Vivek says: “Organisations may not fully understand the complex and evolving nature of cyberthreats, therefore underestimating the importance of cybersecurity measures and failing to prioritise them.

“Companies with limited resources may also lack the internal expertise to design and implement effective cybersecurity strategies. Other companies, especially smaller ones, may perceive themselves as having a lower risk of being targeted by cyberattacks.”

Vivek believes that some degree of government intervention or policies to encourage companies to meet cybersecurity standards are needed — not just to incentivise companies to do so, but also to help smaller companies in compliance, as well as protect businesses and public security.

Among the measures he suggests are providing incentives or subsidies for companies to adopt cybersecurity measures or obtain cyber insurance; establishing or enforcing mandatory or voluntary cybersecurity standards or regulations for certain sectors or industries; creating or supporting cybersecurity awareness and education programmes or initiatives for the public and private sectors; and facilitating or coordinating cybersecurity information sharing and collaboration among stakeholders.

“A phased rollout accommodates the practicalities faced by small businesses, alleviating concerns about the financial implications of cyber insurance and the implementation of enhanced security controls. This strategic approach ensures a comprehensive and sustainable enhancement of cybersecurity across diverse sectors,” says Vivek.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.