In addition to tone from the top, staff members at the operational level must also be more vigilant of the cyber risks involved in their day-to-day tasks. Second, while in the past much efforts had been put on reinforcing protection and detection systems, we must now shift our focus towards improving response and recovery. Readiness in addressing cyber-attacks—preparing a response plan or a playbook—remains a common gap among financial institutions. Frequent cyber exercises are also crucial, as vulnerability of response plans are often discovered during these exercises which allow organizations to continually improve their response processes. Regular practice is the best practice. Not only should these exercises be done by individual firms, but also at an industry level. The financial sector, for example, has started these exercises within the banking sector and will soon expand to other parts of the financial sector. As time goes by, our society becomes more interconnected, and eventually these cyber resilience exercises need to be done at the inter-industry level. For instance, the banking sector needs to have joint exercise with telecommunication companies for scenarios involving mobile banking attacks, or with the utilities sector for power outage scenarios. Third, collaboration and information sharing are crucial in strengthening the overall cyber resilience. Cyber threats are becoming much more complex that an individual organization’s defensive technology may not be able to catch up.

Close cooperation and sharing of cyber threat information will help organizations better monitor the development of cyber threats, recognize unfamiliar threats, and develop more comprehensive plans for dealing with such issues. Cooperation is also more than just information sharing: whether it is cooperation in terms of supervision, development of standards, cyber exercises, or capability building. These kinds of cooperation that would eventually create a “Cybersecurity Ecosystem” requires efforts from all sides, including governments, regulatory agencies, the private sector, and the education sector. It is very welcoming that today there are already a number of information sharing platforms available at the national, regional, and international levels. Thailand’s finance, banking, capital markets, and insurance industries have established a Computer Emergency Response Team (CERT) for their respective industry. The teams share cybersecurity information on a daily basis. At the regional level, ASEAN has established the Cybersecurity Resilience and Information Sharing Platform (CRISP). The Central Banks, Regulators, and Supervisors (CERES) forum serves as a  3  platform for the international community. These collaborations on multiple levels present opportunities for countries to learn from one another. More recently, under our capacity as the 2019 ASEAN Chairman, Thailand has collaborated with the Bank for International Settlement (BIS) to organize the ASEAN Financial Regulators’ Program on Cyber Resilience, a series of training programs, the last of which concluded just yesterday. We envision that these Cyber Range collaborations will continue to be held for ASEAN members going forward.