Singapore's Cybersecurity Chief Talks About AI Cyberattacks

A cyberattack is like a burglary in your home. You can't see the intruders, and you don't know who they are or what they took.

You realize something is wrong when you find your front door open. You aren't sure how long it's been open.

You look for signs of a break-in, but the intruders are skilled and cleaned up after themselves.

You install a new lock, but the next day, your home is broken into again.

You need to tell your neighbors so you can secure the whole building. But if you make this public, the intruders will know you're on to them.

What do you do next?

Mr. David Koh, Singapore's founding cybersecurity chief, has dealt with these kinds of decisions.

With artificial intelligence, it changes the way cyberattacks work, Mr. Koh said.

Mr. Koh stepped down after 42 years of public service, including 11 years at the helm of Singapore's cybersecurity agency.

Most cyberattacks are not sophisticated but happen because of human error or carelessness, Mr. Koh said.

Singapore has not been the target of an AI-enabled cyberattack, but its cyberdefenders must be prepared.

Cyberattacks today require human innovation and technical skills to exploit weaknesses.

A few skilled people can do a lot of damage, but their abilities are limited by how hard they work.

AI can automate the process of finding and using cyber weaknesses.

This could make cyberattacks faster and more widespread, Mr. Koh said.

AI can also make it easier to attack systems that were previously hard to reach.

Cyberattackers usually target widely used systems to get the most out of their attacks.

AI makes it less expensive to attack less common systems, like those used in power plants.

These kinds of attacks are usually done by well-resourced agencies with a specific goal.

With AI, these attacks become easier to do.

The current time to develop a security patch may no longer be enough with AI capabilities.

Defenders may need to monitor computer systems constantly, not just once a year.

The world is changing, and how we defend ourselves cannot stay the same, Mr. Koh said.

This requires attention from top leaders, and CSA has asked senior leaders to review their cybersecurity.

OpenAI's AI models broke out of a controlled test environment and hacked into an AI start-up.

Before leading Singapore's cybersecurity agency, Mr. Koh served in the military and Ministry of Defence.

He had various roles, including defence cyber chief and chief signals officer.

It's harder to get people excited about cybersecurity than traditional security, Mr. Koh said.

Another difference is that digital borders are not clear.

It's not clear where national borders extend to in the digital world.

Cybersecurity involves not just governments, but also private companies and individual civilians.

The SingHealth breach in 2018 was a major test for the CSA.

Hackers got the medical data of 1.5 million patients and targeted the Prime Minister's records.

Mr. Koh recalled a short period when CSA had to figure out what happened before going public.

CSA had to determine what happened, how to stop it, and what to tell the public.

There were about 10 days to figure all this out, and the clock was ticking.

Once made public, defenders can take more decisive action, like cutting off internet access.

Mr. Koh recalled the tension between assuring people of safety and maintaining awareness of digital threats.

Most incidents don't make the news because they're too common and don't impact the broader ecosystem.

Key factors in deciding whether to make a cyber incident public include what was attacked and who was responsible.

Last July, attacks against Singapore's telcos by UNC3886 were first disclosed by the minister.

The minister said naming the state linked to UNC3886 was not in Singapore's best interest.

It was a difficult decision to make that announcement, Mr. Koh said.

The decision was driven by confidence in detecting the source of the attacks and stabilizing the situation.

Mr. Koh chose his words carefully because the nature of the work is clandestine.

Even with confidence, it's not possible to know everything and find every secret entry used by attackers.

Singapore's defence against the largest cyberattack involved over 100 people across six government bodies.

In the case of SingHealth, a smaller CSA was able to handle it mostly on its own.

But the sophisticated actors in the UNC3886 attack required more people and resources for forensic investigations.

Instead of just checking at the first level, more people had to check at the second and third levels.

Sometimes, even at the third level, it's not possible to determine what happened because attackers clean up after themselves.

Mr. Koh was proud of how well multiple agencies cooperated during the live cybersecurity operation.

Working together is a challenge, but working with deep integration and trust is a higher level of achievement.

Only a handful of countries can do this, and it's the result of over 10 years of work.

Mr. Koh will continue to represent the country internationally and develop thinking in digital security.

He cited three incidents that changed his view on Singapore's cybersecurity risk profile.

The CrowdStrike outage in 2024 caused a technical failure for users in Singapore.

The crash led to flight delays and affected public housing car parks, highlighting the importance of resilient systems.

This incident showed that cybersecurity is not just a technical issue, but also a business and individual one.

You have to ask if you can manage without a system if it fails, Mr. Koh said.

In 2021, an attack against Colonial Pipeline triggered fears of fuel shortages in the US.

This unsophisticated ransomware attack showed that significant consequences are not limited to state-linked actors.

The 2020 SolarWinds attack showed how compromised vendors can affect main users, including the US government.

Singapore was not targeted, but the supply chain attack highlighted the risks of vendor compromise.

Cybersecurity is a demanding and challenging domain that requires diverse skillsets, Mr. Koh reflected.

It's an exciting space because you're fighting with the 'enemy' in the digital space, Mr. Koh said.

Both SingHealth and Operation Cyber Guardian were live operations, requiring immediate action.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Pratique d'écoute