IC-AJCC

CHALLENGES OF RISK MANAGEMENTAND GOVERNANCE IN THE CURRENTCYBERSECURITY LANDSCAPE:
Operational Best Practices
6th October 2023
DATO’ TS. DR. HAJI AMIRUDIN ABDUL WAHAB FASc,Chief Executive Officer
CyberSecurity Malaysia
1

WE ARE MOVING INTO A MORE
INTERCONNECTED CYBERSPACE

2Digital 2023: Global Overview Report — DataReportal – Global Digital Insights

CONVERGENCE OF TECHNOLOGIES
Add More Complexities to Cyber Space and Digital Transformation

3

The World Has Become Heavily Reliant And Connected To
One Another Whether It’s People, Process And Technology

4IT VS OT VS IOT VS IOEInformation Technology (IT): The computer,data storage, and networking infrastructure andprocesses that are used to create, process, store,secure, and exchange all forms of electronic data. Itdeals with data, information and communication.
Operational Technology (OT): Traditionally, physicaldevices in industrial, agricultural, and mission-criticalsectors or Industrial IoT networks. It deals withmachines.
Internet of Things (IOTs): Networks not specific toa particular sector.
Internet of Everything (IoE): extends beyond IoT byintegrating operational technology (OT) andinformation technology (IT) into a unified ecosystem,enabling seamless communication, data sharing, andintelligent decision-making.
5

The World Are More Interconnected,
Opening new opportunities

THE LANDSCAPE IS CATALYSED WITH IR4.0
AND DIGITAL TRANSFORMATIONIn Phase 2 (2023-2025),
inclusive
digitaltransformation
will
beprioritized.
In Phase 3 (from 2026 to2030) will position Malaysia
as a regional leader in digitalcontent and cyber security.
MyDIGITAL's mission is toensure that all Malaysians
benefitfromtheopportunities of the digital
revolution.
6

CYBER-ATTACKS MAY HAVEPHYSICAL CONSEQUENCES

DIGITALTRANSFORMATION IS
NOT WITHOUT ITS
RISK• Technology such as wireless technology
has changed the way we conductbusiness, offering workers with constantaccess to business-critical applications
and data.
• While this flexibility is convenient andexpands productivity, it introducescomplexity and security risk as these newtechnology and devices become newtarget for hackers looking to infiltrate
a corporate network.

CYBER RISK‘Cyber risk’ means any risk of financial loss, disruption ordamage to the reputation of an organization from some sort offailure of its information technology systems. Hence, CYBERRISK MANAGEMENT is needed!

8GLOBAL RISK 2023

9Source: WEF_Global_Risks_Report_2023.pdf (weforum.org)

UNDERSTANDING HOW TO HANDLE
EACH RISK• Action is taken
to do something
different.
• The threat
is eliminated.

10• No actions
are taken.
• Risk is
acceptable.

AVOID

ACCEPT• Actions taken toreduce the probability
and impact of risk.
• Implementing relevant
controls.
MITIGATE• Shifting theresponsibility
and impact toa third party.
TRANSFER• Sharing risk
with the higher
authority orwith a thirdparty.
SHARE

RISK MANAGEMENTAND GOVERNANCE

BEST PRACTICESRisk Management

And GovernanceBest Practices

HYGIENE
Refers to fundamental
cybersecurity best practices thatan organization’s security
practitioners and users canundertake.
12Practice Great Cyber Hygiene - Cyber Risk Opportunities

RISK MANAGEMENT BESTPRACTICESINTEGRATED ANDCONSISTENTCONTROLS AND
POLICIES

A consistent, systemic andintegrated approach to risk
management can help determine
how best to identify, manage andmitigate significant risks.

GAIN BOARD AND
MANAGEMENTSUPPORT

Ensure strategic direction arealigned and resource are allocatedproperlyRISK MANAGEMENT BESTPRACTICESMONITOR THE
RISKENVIRONMENTManagement can act promptly ifand when the nature, potential
impact, or likelihood of the riskgoes outside acceptable levels

IDENTIFY AND
UNDERSTAND
ONE’S RISKENVIRONMENT

A process of documenting anyrisks that could keep anorganization or program fromreaching its objective

COLLABORATIONWITH EXTERNALPARTIESCollaborating with external parties
can help identify and mitigate
supply chain risks that can disrupt
operations.

GOVERNANCE
BEST PRACTICESHOLISTICAPPROACH
A holistic approach to
governanceincludesvarious elements within anorganization
orgovernment
ina
comprehensive manner.

15

ADAPTIVE
APPROACH
Adaptive security is asecurity approach that'susedtorespondtopotential cyberthreats inreal-time by continuallymonitoring user sessions.

DEFENCE-INDEPTH

ZERO TRUSTContinuousverification.
Always verify access, all
the time, for all resourcesor simply put it as "TrustNo One".

A multifaceted approach tosafeguard
theorganization's overall wellbeing, compliance, andethical standards.

SOURCE: https://www.datamation.com/big-data/data-governance-trends/

GOVERNANCE
BEST PRACTICESTRAINING &AWARENESS
Promote awareness andtraining
programs
toinform the clients orshareholders
oftheir
responsibilities
andfunctions
withinanorganisation.
16

COLLABORATION
Sharing of information,
resources, and expertiseamong various national
and international entities
to collectively address
cyber threats.

SOURCE: https://www.datamation.com/big-data/data-governance-trends/

RISK IS EVERYBODY'SRESPONSIBILITYCYBERSECURITY DOESNOT OPERATE IN SILO!

THE MANAGEMENT MUSTSHOW THE EXAMPLE, BY

LEADINGTHE ORGANISATION INENHANCINGCYBERSECURITY
17

CYBERSECURITY, RISK MANAGEMENT, AND GOVERNANCE:A SHARED RESPONSIBILITY

18

CYBERSECURITY MALAYSIA'SINITIATIVESOFFICIAL LAUNCH ON 23 MARCH 2021

CSM initiatives aimed at developing, empowering, sustaining andstrengthening cybersecurity infrastructure and ecosystem in Malaysia
to ensure network security preparedness.

CYBERSECURITY MALAYSIA’S INITIATIVES
20

Adoption of holistic approach that
identifies potential threats toorganization and impacts to thenational security & public well-being ;andTo develop the nation to becomecyber resilience having the capability
to safeguard the interests of its
stakeholders, reputation, brand andvalue creating activities.

21

(Program PemerKASAan Keselamatan Siber)
Objective: Empowering, strengthening and preserving the cyber security infrastructure and ecosystem inMalaysia so that it is always sustainable, protected and resilient.

PRO
DUC
T

S
E
R
V
I
CE

22

HUMAN

PROCESSTECHNOLOGY

Covers aspects of skills, knowledge, ethics,
behavior and talent

Covers aspects of policy development, strategy,Standard Operating Procedure (SOP), recognition ofinternational standards

Involves technology in particular matters related tominimizing vulnerabilities, digital forensic analysis,
malicious code (malware) and data

PRODUCTS AND SERVICES
1. Global Accredited
Cybersecurity
Education(ACE)Scheme

2. CyberSAFE L.I.V.EGallery
3. Cybersecurity
Competency Training(CyberGuru)
1. Business Continuity
Management System(BCMS) Certification
2. Digital Forensics (DF)
Case Management
3. Incident Handling CaseManagement
4. Cyber Discovery
5. MyTrustSEAL
6. Penetration Testing
Service Provider(PTSP)
Certification

7. Technology Security
Assurance (TSA)
8. ICT Product Security
Assessment (IPSA)
9. Security Posture
Assessment (SPA)
10.SCADA Security
Assessment (SSA)
11.PHP Secure CodeAssessment (PSCA)
12.Malaysian Common
Criteria Scheme (MyCC)
13.Cybersecurity Strategicand Technical Advisory

1. Crypto Random Test Tool
2. X-Forensics Tools
3. PenDua Tool

4. Coordinated Malware,
Eradication, and Remediation
Platform (CMERP)
5. LebahNet
6. CamMuka (Facial Recognition)

1. MyCyberSecurity Clinic(MyCSC)- Data
Recovery and Data
Sanitization Services
2. Lab QualityManagement
3. Cybersecurity LabServices
4. CyberSecurity Malaysia
CryptographicEvaluation Lab(MyCEL)
5. CCTV Forensics
Service

6. Cyber ThreatIntelligence Service
7. Cloud Security
Compliance Audit
8. Cloud Security
Assessment Audit
9. Cloud Security Audit forISMS
10.Security Operation
Centre Service
11.Red Teaming ServiceCopyright © 2020 CyberSecurity Malaysia

23

CYBERSECURITY CAPACITY BUILDING FRAMEWORKGlobal ACE Scheme
https://www.cybereducationscheme.org

Cyberguru
https://www.cyberguru.my

Cybersafe
https://www.cybersafe.my24

CYBERSECURITY AWARENESS FOR EVERYONE (CyberSAFE)• CyberSAFE launched YAB Deputy Prime Minister• Reached out to more than 34,000 students, teachers, adults and more than 190 schools / organisations• Awareness program referred to by Australian Communications and Media Authority

Make it a priority to provide those on the frontlines with the information,
tools and resources necessary to increase the national awareness level on theimportance of cyber security.

OutreachProgram

Inculcate cybersecurityawareness

Help foster a safer
digital world

25

Culture of digitalcitizenship among themasses from all
occupations andlifestyles

DEVELOP CYBERSECURITY PROFESSIONALS

Cyber Security Capacity
Development Collaboration
CyberSecurity Malaysia bundles its
training programs into selected local
and international training programs
and work closely with industry
collaborators to further enhance,
deliver and market these services
effectively and efficiently.

26Cyber Security Academic Collaboration

BUILDING CYBER SECURITY MANAGERS,STRATEGISTS AND PROFESSIONALSGOAL & OBJECTIVES
GOAL
To create world class competent work-force in cyber security andpromote the development of cyber security professional
programmes within the region

OBJECTIVES
1 To establish a
Global ACE Certification
was selected as the Winnerof the Category 5: Building
Confidence and Security in
the Use of ICT at WSISPrizes
2020
27

professional certification
programme that isrecognized globally

33 To promote thedevelopment of cybersecurity professional
programmes globally

2 To provide cyber security
professionals with the rightknowledge, skills, attitude (KSA)
and experience

4 To ensure accredited personnel
has been independently assessedand committed to a consistent andhigh-quality service level

GLOBAL ACE CERTIFICATION TRAINING PROGRAMMES
A. Currently running Global ACE Certification Programmes
1.

Certified Digital Forensics First Responder

2.

Certified Information Security Management System Auditor

3.

Certified Penetration Tester

4.

Certified Secured Applications Practitioner

5.

Certified Information Security Awareness Manager

2.Certified Secure Web Application (PHP)
Developer

6.

Certified MyCC Evaluator

3.Certified Smart Card Reader Analyst

7.

Certified Data Security Analyst

8.

Certified IoT Security Analyst

9.

Certified Cybersecurity Awareness Educator

10. Certified Security Operations Centre Analyst
11. Certified Incident Handling and Network Security Analyst

1.Certified Industrial Control System SecurityAnalyst

4.Certified Cloud Security Auditor
5.Certified IoT Blockchain Practitioner
6.Certified Cyber Forensics Analyst
7.Certified Web Application Penetration Tester

12. Certified IP Associate

8.Certified Data Privacy Officer

13. Certified IT Associate

9.Certified Data Privacy Specialist

14. Certified Cybersecurity Data Science Analyst

10.Certified Chief Data Privacy Officer

15. Certified Mobile Security Analyst

11.Certified Cryptocurrency Seizing Officer

16. Certified Cyber Law Practitioner
17. Certified Cybersecurity Risk Manager
28

B. Ready by 2023/2024

PROCESS
Copyright © 2020 CyberSecurity Malaysia

29

Kerangka Strategik KKD

Rancangan Malaysia
Kedua Belas (RMK-12)

Strategic Thrust 2:
Driving the Digital Economy and IT Towards DevelopedCountries

Pillar 1: Source of Growth
Pillar 4: Human Capital Transformation and Market
Strengthening Labor:
Pillar 5: Inclusivity and People’s Well being
Pillar 6: Institutional Reform
Pillar 7: Social Capital

Strategic Thrust 3:
Strengthen the regulation of a reliable and stablecommunications and multimedia ecosystem

National Technical Cybersecurity Agency
responsible to advice & implement
cybersecurity related programs

CSM’s Role in Supporting National
Cybersecurity Related Policies &Strategic Plans

Malaysia Digital Economy
Blueprint
Thrust 1: Drive digital transformation in the public sectorThrust 4: Build agile and competent digital talent

30

Thrust 6: Build trusted, secure and ethical digital
environment

Malaysia
Cyber
Security
Strategy

Pillar 1: Effective Governance andManagement
Pillar 2: Strengthening Legislative
Framework and Enforcement

National 4th Industrial
Revolution Policy(N4IR)

Pillar 3: Catalysing World Class Innovation,
Technology, R&D and Industry

Thrust 1:
Equip the Rakyat with 4IR knowledge and skill sets

Pillar 4: Enhancing Capacity and Capability
Building, Awareness and Education

Thrust 3:
Future-proof regulations to be agile with technologicalchanges

Pillar 5: Strengthening Global Collaboration

Personal Data Protection Act 2010 (PDPA)

31•Governs personally identifiabledata collected via commercialtransactions.

•Malaysia’s PDPA is aligned with
the EU’s GDPR.

ADDRESSING CYBERSECURITY ISSUES THROUGH GUIDELINES

CyberSecurity Malaysia products
32

CyberSecurity Malaysia

ADDRESSING CYBERSECURITY THROUGH ENCRYPTION TECHNOLOGY• NATIONAL CRYPTOGRAPHY POLICY approved by The Government InJanuary 2013

• Comprehensive applications ofcryptography inGovernment toGovernment (G2G), Government to Citizens (G2C), Government to Business(G2B) and Business to Business (B2B) activities towards ensuring a secureand trusted cyber environment.

• Cryptography also supports the National

Digital Economy and therealization of the National Transformation Agenda to transform Malaysia
into becoming an advanced and high-income nation
33

Proactive Services
Information Security Certification Body (ISCB)
Information Security Certification Body (ISCB) is a department within CyberSecurity Malaysia that manages
certification services focusing on the information security according to international standards andguidelines. Among the services under ISCB: Information Security Management System (ISMS)
Audit and Certification - CSM27001 Scheme Privacy Information Management System (PIMS)
 Business Continuity Management System (BCMS) MyTrustSEAL – web security validation
 Malaysian Common Criteria
Certification (MyCC) Scheme
34

Evaluation

andMANAGEMENT SYSTEM CERTIFICATION
Process
Certification

Continuous Audits conducted by Independent andAccredited Certification Body

ISO/IEC 27001

ISO 22301
Business Continuity
Management Systems

Specifies requirements for establishing,implementing, maintaining and continuallyimproving
aninformation
security
management system within the context of theorganization which includes requirements forthe assessment and treatment of information
security risks tailored to the needs of the35 organization.

Specifies requirements to plan, establish,
implement, operate, monitor, review maintainand continually improve a documented
management system to protect against, reduce
the likelihood of occurrence, prepare for,respond to and recover from disruptive
incidents when they arise.

Information Security
Management Systems

DOMESTIC COLLABORATIONCYBERSECURITY MALAYSIA ENGAGEMENT ECOSYSTEM

36

INTERNATIONAL COLLABORATION- Global Collaborative Efforts And Engagements

ASEAN CERT

Regional and Global
Cyber Security
Cooperation

37

ITUCSCAPARFOIC CERTFIRSTAPCERT

INTERNATIONAL SECURITY
Protecting Common Interests
Conﬁdence Building Measures
DOMESTIC SECURITY
 Protecting National Security
 Prosperity and Public Safety
Public-PrivatePartnership

SOVEREIGN STATESVIABILATERALAND
MULTILATERALENGAGEMENT

Legal andPolicy Framework

TECHNOLOGYTRADITIONAL CYBERSECURITY APPROACH- Not sufficient to deal with smart cyber threats
Protecting networks, dataand devices in today’senvironment requires amultipronged approachthat accounts for every
possible vulnerability andentry point. We are way
beyond firewalls andantivirus here.

DEFENSE IN
DEPTH

POLICY & PROCEDURESOC
CRITICAL ASSETSPHYSICAL ACCESSFIREWALL

AWARENESSINTRUSION PREVENTION

39

This is an approach that relies on using a layered and redundant defensive
mechanism to protect data and assets from cyber-attacks.

ADDRESSING CYBER RESILIENCY THROUGH ADAPTIVE SECURITY
To be more proactive, dynamic and integrated in cybersecurity approach
Adaptive Security is an approach tocybersecurity that analyzes
behaviors and events to protect
against and adapt to threats before
they happen. With an Adaptive
Security Architecture, anorganization can continuously
assess risk and automaticallyprovide proportional enforcementthat can be dialed up or down

The cost to organizations comes at each stage of the incident response lifecycle —detection, notification, responses, post-incidents, and the cost of business losses.
4040

STRENGTHENING CYBERSECURITY THROUGHPREDICTIVE CYBER THREAT INTELLIGENCE (CTI)

41

ADDRESSING CYBERSECURITY THROUGHRESPONSIVE TECHNOLOGY & SERVICESDIGITAL FORENSIC (DF)Cyber Detect, Eradicate andForensics (CyberDEF)

Coordinated Malware Eradication &Remediation Project (CMERP)

Cyber Early Warning

Evidence Preservation Facility

X-Forensics Tools
Technical Coordination Centre

Lebahnet (Honeynet Project)
Digital Forensic Lab

Malware Research Center

Expert Development Lab

42

Data Recovery Lab

Cyber Threat ResearchCentre (CTRC)

Computer Security
Incident Response
Team (CSIRT)
Consultancy

Cyber999 Help Centre

STRENGTHENING CYBER SECURITY PREVENTION THROUGHTECHNOLOGY VULNERABILITY ASSESSMENT
Secure Software Development
Lifecycle (SSDLC) Lab & Services

Internet of Things (IOT) Lab

43

Robotic Lab (4th Industry Revolution)

ADDRESSING CYBERSECURITY THROUGH STRENGTHENINGDETECTION TECHNOLOGY

CyberD.E.F• Detection• Eradication• Forensic44

CONCLUSION AND WAY FORWARD
There is no such thing as 100% security. There is still much room
for improvement. We need to increase and strengthen ourcybersecurity manpower and professional skills.

This involves an ongoing process of identifying security risks andimplementing plans to address them. Risk is determined byconsidering the likelihood that known threats will exploit
vulnerabilities and the impact they may have on valuable assets.

Furthermore, there is a need to ensure a secure, resilient, andtrusted cyber environment to sustain progress and prosperity. In
this regard, a more innovative and proactive adaptive security
approach is required to address such situations. Adaptive
cybersecurity encompasses predictive, detective, responsive, andcorrective capabilities.



Additionally, our approach also needs to be adaptive, dynamic, andinnovative, covering people, processes, and technology.

45

46