Challenges in building ASEAN
Cyber Resilience
Tony Low, AiSP VP

Royalty-free image for Microsoft O365 subscribers.

Today’s Agenda
1. State of Digital and Cyber Security ofASEAN
2. What are the countries in ASEAN
facing today in Cybersecurity?
3. Looking at a collective community
Effort4. Where are we today?
5. Call to Action

[Unknown]
Inflation & RecessiondellikStoN

hguorsiyJourne

Treacherous Digital + Business
Environment

e ssnisuByM
Source: Movie Scene from Dunkirk 2017

State of Digital and Cyber
Security of ASEAN4

Huge opportunity within Asean Post
Pandemic and Beyond•

Foreign businesses expect sales in the region to growby 23.2% in 2023•

ASEAN is on track to become the world's largest
market by 2030.

•Celebrated young and dynamic population with 34%
of ASEAN's population consists of young people, aged
between 15 and 34 years old•

In 2023, 86% of tech founders is still looking to
expand their head count with engineers and data
scientists remaining high in demand.

•Digital economy is projected to triple by the end of
the decade through the natural adoption of digitaltechnologies, growing from approximately US$300
billion to almost US$1 trillion by 2030.

How ready is the economy in Asean to keep up with the Pace?
Some Examples:● Malaysia - experienced several high-profile cyber breach
incidents in 2022 including the data leak of 22.5 million
Malaysians on the dark web. Total estimated of almost
RM600 million in losses were recorded throughout 2022
as a result of cybercrimes in the country.
● Singapore – The public sector reported 182 data
incidents in the year up to March 31 2023, up from 178
cases reported in the year before, as data sharing amongagencies accelerated due to increased digitalisation.
● Bangkok - The average number of cyber-attacks onorganisations in almost double the average rate globally
2,388 times per week on average during the last six
months, compared with 2,375 attacks per week inSoutheast Asia.

Source: NCSI ,Survey by: NCSI
Release dateJuly 2023

ASEAN countries can emerged as launchpads for cyberattacks

1. Large number of vulnerable hotbeds of unsecured infrastructure:a. Personal devices and home networks accessing the corporate
network (47%)
b. Unmonitored IoT devices and unsecured IoT devices (60%)
c. 94% of ASEAN organizations had experienced a rise in the number ofattacks in 2021.
d. ~ 269,533 phishing attempts were targeted against Malaysian SMEs
in the first half of 2020.
2. 5% of IT professionals in the region have the technical knowledge andexperience to analyze attacks on their networks
3. Nascent local cybersecurity industry with shortages of home-growncapabilities and expertiseWhat are the countries in
ASEAN facing today in
Cybersecurity?

8

ASEAN faces a number of challenges in building cyber resilience in 2023 andbeyond•

Limited resources: Needed more resources to invest in
cybersecurity, implementing necessary security measuresand developing a skilled cybersecurity workforce•

Lack of awareness: General population must be fully
aware of the cybersecurity risks they face, understandcareless behavior makes them more vulnerable to attack.

•Complex regulatory environment: The cybersecurity
regulatory environment in ASEAN is complex andfragmented for organizations to comply with all relevant
regulations.

•Growing sophistication of cyber attacks: Cybercriminals
are becoming increasingly sophisticated in their attacks
and better funded.

Limited Resources - Talent, Budget & Capabilities

1. Many ASEAN countries, Governments andEnterprises just started capacity - Cambodia, Laos,
Myanmar and Vietnam are in the early stages ofcyber-security capacity building and are also
struggling with a lack of resources and technicalexpertise
2. 97% of the enterprise in Asean are SMBs who
typically does not have the ability to drive large scale
security programs, SMEs are unaware of the extentof the damage that a cyberattack can cause.
3. Acute shortage of cybersecurity talent in all
countries including Singapore - e.g Vietnam has an
estimated shortage of around 100,000 engineersVarying Maturity and approach towards Cybersecurity

1. Cisco Cybersecurity Readiness Index - Only 23% SEA
companies ready to defend against cybersecurity
threats
2. Countries with a high degree of cyber maturity, such asSingapore, are more likely to push for advancing norms
adoption, capacity-building measures, and other cyberpolicy aspects.
3. Countries with a lower degree of cyber maturity, such asMyanmar, are more focused on establishing protection
measures for their national infrastructures.
4. Different cybersecurity priorities of ASEAN member
states with varying levels of cyber maturity pose achallenge to regional cybersecurity cooperation.

Complex regulatory environment - Different stages if definition in each economy*
1. ASEAN intergovernmental structure - 10 countries x 10 different
sets of cybersecurity regulations to comply with creating challenges
for businesses and organizations to comply with all of the relevantregulations
2. The ASEAN Way of consensus-based decision-making and noninterference slows the policy-making process and limits regional
cyber policies.
3. Differing views among ASEAN member states due to their diverse
cultural and political contexts and histories hinders the sharing of
threat intelligence.
4. Disparity in cyber-crime laws and enforcement among ASEAN
member states prevents the agreement on an overarchingregulation.
5. Digital divide among ASEAN member states where issue of a cyberinduced emergency may be a lower priority for developing countries.
*https://www.iiss.org/globalassets/media-library---content--migration/files/research-papers/2023/06/asean-cyber-securitycooperation.pdf

Growing sophistication of cyber attacks
1. Cybercriminals are becoming increasingly sophisticated in their
attacks, using a variety of new and emerging techniques to
exploit vulnerabilities and gain access to systems and data.
2. Cybercrime is a multi-billion dollar industry. This means thatcybercriminals have the resources to invest in research anddevelopment to develop new attack techniques.
3. Digital landscape is constantly evolving. The rise of mobile
technologies and the increase adoption of IoT
4. Increase difficulty to defend against cyberattacks and to
recover from them. e.g Ransomware
5. The rise of cybercrime-as-a-service. Cyber Attack
Commoditization where attacks can be paid and initiated byanyone. Tools, services and people are out for rental byanyone.

Looking at a collective
community Effort

14

A Point of View: Strengthening Regional Cyber Resilience – One block at a time
1. Enterprises are built on the structure of People
Excellence, Process Engineering and Technology
Investments.
2. Looking at a Holistic Partnership between
Government, Ecosystem (Industry, Enterprise) andCommunity.
3. Starting with the Community - Developing a strong
base within the Enterprise- Core throughCommunity and Social Uplift.
4. Expert Advice: Cybersecurity is getting
complicated, you can do it alone.
5. Get Involved: Government Agencies / Ministry arestarting to develop policies and guidelines suitable
for the country and the economy.

Guideline +Policies

Building a Safer
Enterprise at the CORE

Project, Funding,Ecosystem

Technology

Industry Experts

Process

Community
Social FabricPeopleRegional, Government, Ecosystem, Community

A Point of View: Strengthening Regional Cyber Resilience – One block at a time
Improve your organization's cybersecurity posture and reduce the risk of a cyber attack.
1. Layered security approach - Physical and logical (forCloud) security need assessments.
Guideline +Policies

Building a Safer
Enterprise & Society

3. Best practices - Collaboration can help everyone learn andimprove their cybersecurity posture.

Project, Funding,Ecosystem

Technology

4. Provide technical assistance - Seek help for specificcybersecurity (Incident response, vulnerabilityassessment)

Industry Experts

ProcessCommunity
Social FabricPeople

2. Systems and software up to date - Software updates(security patches) can help to protect from known
vulnerabilities.

5. Map the cybersecurity regulatory landscape - Complex
and ever-changing to map the cybersecurity regulatory
landscape.
6. Develop a cybersecurity compliance plan - Help andguide organization meets all applicable cybersecurity
regulations

A Point of View: Strengthening Regional Cyber Resilience – One block at a time
Create a more supportive and innovative ecosystem for cybersecurity.
1. Prioritize critical Cyber Security projects:
a. Improving tools, technologies & infrastructure.
b. Educating people about risks and best practices.
2. Clear and concise plan - project goals, objectives,timeline, budget, and resources required.
3. Establish metrics - for measuring the success of eachproject to track your progress and adjust accordingly.
4. Secure funding for cybersecurity projects - Could
include government grants, project fundings.
5. Create a cybersecurity innovation hub - Gather thecommunity together to collaborate and develop new
cybersecurity solutions.
6. Create a cybersecurity mentorship program - Matchexperienced cybersecurity professionals withnew/early-career cybersecurity professionals.

Guideline +Policies

Building a Safer
Enterprise & Society

Project, Funding,Ecosystem

Technology

Industry Experts

ProcessCommunity
Social FabricPeople

A Point of View: Strengthening Regional Cyber Resilience – One block at a timeWorking together, governments, vendors, and industry experts - a vital role in improving cybersecurity
1. Establish regional, local, and community
cybersecurity cooperation mechanisms.

Guideline +Policies

Building a Safer
Enterprise & Society

3. Develop guidelines and policies that are SMART(specific, measurable, achievable, relevant, andtime-bound).

Project, Funding,
Ecosystem

Technology

4. Engage with stakeholders to get their feedback
and input on the guidelines and policies.

Industry Experts

ProcessCommunity
Social FabricPeople

2. Identify the key cybersecurity risks and challenges
that need to be addressed.

5. Communicate the guidelines and policies to allstakeholders.
6. Monitor and evaluate the effectiveness of theguidelines and policies, update and revise

A Point of View: Strengthening Regional Cyber Resilience – One block at a time
Share best practices and provide technical assistance - Help organizations to improve their cybersecurity posture.

1. Training programs, workshops:
a. Educate people about cybersecurity risks andbest practices.
b. Public awareness campaigns, cybersecurity
training for employees, and integrating
cybersecurity into school curricula.
2. Develop a cybersecurity awareness plan:a. Identify the key cybersecurity risks.

Guideline +Policies

Building a Safer
Enterprise & Society

Project, Funding,
Ecosystem

Technology

Industry Experts

Process

Community
Social FabricPeople

b. Best practices for mitigating these risks.
c. Communication Plan for educating youremployees and customers about cybersecurityrisks.

Where are wetoday?

20Collaboration and working across ASEAN Agencies• On the occasion of the 32nd ASEAN summit, the leaders of ASEAN countries issued a Statement oncybersecurity cooperation.
• The leaders recognised the need to build closer cooperation and coordination among ASEAN Member
States on cybersecurity policy development and capacity building initiatives.
• Relevant Ministers are to recommend options of coordinating cybersecurity policy, diplomacy,cooperation, technical and capacity building efforts among various platforms of the three pillars of ASEAN.
• They also tasked Ministers to identify a concrete list of voluntary practical norms of responsible State
behaviour in cyberspace that ASEAN could adapt and implement, taking into consideration the report of
the UN GGE from 2015.
• The Ministers are further requested to facilitate cross-border cooperation in addressing criticalinfrastructure vulnerabilities, and encourage capacity building and cooperation for combating criminal andterrorist use of cyberspace.

Full statements: https://asean.org/wp-content/uploads/2018/04/ASEAN-Leaders-Statement-on-Cybersecurity-Cooperation.pdf

First ASEAN Strategy Paper (2017-2020)
1. Strengthening CERT-CERT cooperation and capacity building● ASEAN CERT Maturity Framework● Establishment of future ASEAN Regional Computer EmergencyResponse Team● ASEAN Cyber-security Cooperation● Targeted Capacity Building Initiatives
2. Key ASEAN Achievements in support of Cyber Cooperation● Policy Coordination● Incident Response● Capacity Building
2. Accelerated Digitalisation:● 80% in Southeast Asia vs 67% of Asian with access to the Internet● High Smartphone usage - 90% in Malaysia
2. “Digital by default”
3. Sophistication of Cyberattacks and its Implications
4. Complex Interrelation of Cyber and Digital Issues

Looking Ahead - OBJECTIVE OF 2021-2025 STRATEGY

1. Advancing Cyber Readiness
Cooperation;
2. Strengthening Regional Cyber
Policy Coordination;
3. Enhancing Trust in Cyberspace;
4. Regional Capacity Building; and5. International Cooperation.

Source: ASEAN CYBERSECURITY COOPERATION STRATEGY (2021 – 2025), figure 1, page 8

AiSP - Leading the formation of Southeast Asia Cybersecurity
Consortium (SEACC)
MOU PARTNERSHIP with key overseas organisations to foster cooperationand collaboration• Participating in and benefiting from each other's respective initiativesand programs.
• To Create a vibrant and dynamic international information andcybersecurity ecosystem.
• Scale and grow our community and partners beyond geographic
boundaries
Objective:• Create a consortium of like-minded individuals and organizations topromote cybersecurity collaboration in the Southeast Asia.
• Drive initiatives and events that bring together a community ofindustry and academia stakeholders for knowledge exchange, talentdevelopment and promotion of diversity and inclusion.
• Drive industry-led initiatives for cybersecurity awareness to elevate theoverall security posture for the Southeast Asia region.

Cybersecurity Awareness & Advisory Programme (CAAP)
Targeted for Singapore SMEs, the CAAP aims to drive
digital security awareness and readiness. Supported byCSA, our CAAP operating committee focuses on:
Enhance security awareness and training
Create cohesive security knowledge resources
Offer security solutions and services support

The three thrusts are driven by the respective working
groups of credible and passionate infosec professionals,
supported by AiSP secretariat. We are looking for morecompanies to tap on CAAP and also, partners andprofessionals to support the cybersecurity ecosystem.

25

CYBERSECURITY AWARENESS & ADVISORY PROGRAMME

Current Focus: Improving Readiness ofSMEs through outreach programs andwebinars• NEW!: Providing basic (pro bono)
guidance on improving
their Cybersecurity Journey• Matchmaking between SMEs needswith Advisors• Time box and only specific topics
engagement to prevent abuse andeffort•

Next Steps: Awareness

1:1
Workshops
Kick off-------Advisors Planning& Training--------Workshops
Code of Conduct

Advisory

Working with Community - AiSP Cyber-wellness under IMDA Digital for Life
Career Advice, Hygiene Tips, Game & Quiz

Annual AiSP SME Conference - Bringing the community together

Supported by:Partnering with Agencies - Singapore Business Federation

Summary - Call to Action

1. These challenges are likely to become more acute in the coming years, as the region becomes more digitalizedand interconnected.
2. Increase investment in cybersecurity: ASEAN countries need to increase their investment in cybersecurity.
3. Raise awareness: ASEAN countries need to raise awareness of cybersecurity risks and best practices among thepublic and private sectors.
4. Streamline the regulatory environment: ASEAN countries need to work together to streamline the cybersecurity
regulatory environment.
5. Continue to develop and collaborate a regional cybersecurity strategy at all levels: This should include
measures to improve cooperation on threat intelligence sharing, incident response, and capacity building.

Thank You for Your Participation!
Please contact secretariat@aisp.sg for any queries.

© 2008 - 2020 Association of Information Security Professionals. All Rights Reserved

Royalty-free image for Microsoft O365 subscribers.

https://www.ptsecurity.com/wwen/analytics/asia-cybersecuritythreatscape-20222023/#:~:text=Asia%2DPacific%20(APAC)%20was,vulnerable%20as%
20digital%20transformation%20continues.
https://css.ethz.ch/content/dam/eth
z/special-interest/gess/cis/centerfor-securitiesstudies/pdfs/Challenges%20and%2
0Opportunities%20for%20Cyber%2
0Norms%20in%20ASEAN%20Revi
sed%20Final.pdf

https://www.iiss.org/globalassets/m
edia-library---content-migration/files/researchpapers/2023/06/asean-cybersecurity-cooperation.pdf

https://itsnews.widener.edu/2021/1
0/21/20-ways-to-stop-mobileattacks/

https://www.rsis.edu.sg/rsis-publication/idss/asean-moves-to-strengthen-digital-defence-cooperation/
CO23101 | ASEAN MOVES TO STRENGTHEN DIGITAL DEFENCE COOPERATION
Empowering ASEAN Cyber Resilience

https://opengovasia.com/empowering-asean-cyber-resilience/pa

Enterprise level
https://techwireasia.com/2021/11/cybersecurity-are-challenging-asean-businesses/
Cybersecurity is still challenging for ASEAN businesses

What the world can learn from ASEAN’s cyber cooperation

1.It is the only regional organization to have subscribed to theUN's 11 voluntary, non-binding norms of responsible statebehaviour in cyberspace.
2.Working to develop a regional community with a coordinatedapproach to cybersecurity. This includes initiatives such as theestablishment of the ASEAN Cybersecurity Centre of Excellence
and the development of a regional cyber security strategy.
3.Cooperation is based on the principles of mutual trust, respect,and sovereignty. This has allowed ASEAN to build a strong
foundation for cooperation in this important area.
4.Challenges still exists in cybersecurity cooperation, such as theneed to improve capacity building and to develop a moreharmonized regulatory environment.

AiSP - Actively driving collaboration across ASEAN

1.Launched the regionalisation programme to foster closer
relationships with other regional cybersecurity associations andorganisations.
2.Organized and invited associations / organisations from theSoutheast Asia for this key milestone to be distinguishedfounding members of the South-East Asia Cybersecurity
Consortium (SEACC)
3.Launch of the inaugural Southeast Asia Cybersecurity
Consortium Forum Nov 2022

South East Asia Cybersecurity Consortium (SEACC)Country
Brunei

AssociationBrunei Cyber Security Association (BCA)

Cambodia

ISAC-Cambodia (InfoSec)

Indonesia

Association Of National Information andCommunication Technology Entrepreneurs(APTIKNAS)

Malaysia

Malaysia Board of Technologists (MBOT)

Myanmar

Myanmar Information Security Association (MISA)

Singapore

Association of Information Security Professionals(AiSP)

Philippines

Women in Security Alliance Philippines (WiSAP)

ThailandThailand Information Security Association (TISA)

VietnamVietnam Information Security Association (VNISA)