Adam Peckman and Ken Soh on cybersecurity threats

Key Concepts:

• Cyberattacks, UNC 3886, Cyber Security Act
• Geostrategic attacks, industrial espionage, grayzone tactics
• Advanced Persistent Threats (APTs)
• People, Process, Technology (PPT) framework
• Cyber risk insurance, insurance protection gap
• AI-driven deep fakes, social engineering
• Cyber resilience, risk quantification

1. Singapore's Exposure to Cyber Threats:

• Coordinating Minister for National Security Kanugum states Singapore is under cyber attack by UNC 3886.
• Minister Shaugum calls for strengthening cyber defenses and updating the Cyber Security Act for more powers.
• Adam Pegman (AON) notes Singapore's leading economy status makes it disproportionately exposed to geostrategically motivated attacks.
• Cyberattacks increased by 29% last year, with 63% of nation-state-backed attacks originating in the Asia-Pacific region.
• Motivations include harming rivals and industrial espionage.

2. Vulnerability of Businesses:

• Keno (SGTech) emphasizes that businesses are vulnerable, and efforts are "never enough" due to the dynamic landscape.
• Approximately 500,000 new viruses emerge daily, with nearly 200 APT groups active.
• Advocates for coordinated nationwide public-private partnerships (PPP).

3. Keeping Up with Evolving Threats:

• Keno highlights the "people, process, technologies" (PPT) framework.
• Proactive measures, trend awareness, technology updates, and people education are crucial.
• Regulation and PPP are essential, citing the Cyber Security Assurance Alliance co-chaired by CSA.

4. Advanced Persistent Threats (APTs) vs. Everyday Hackers:

• Adam Pegman outlines three key differences:
  • Objectives: Geostrategic, grayzone tactics, industrial espionage, destabilization.
  • Timeline: Longer-term strategic goals compared to immediate financial gains of ransomware.
  • Resources: Immense investment in intelligence gathering and research.
• APTs focus on covering tracks, creating backdoors for persistent access, and targeting critical infrastructure.

5. Hardening Defenses and Weak Links:

• Keno reiterates that it's "always not enough" due to the evolving nature of threats.
• Attack vectors target critical infrastructure (state-sponsored) and businesses (ransomware, malware).
• Emphasizes the importance of a protective "hygiene layer" but acknowledges no 100% security.

6. Cyber Risk Insurance:

• AON report highlights a 29% year-on-year increase in cyber incidents and a 134% rise from 2020 to 2024.
• AI is a driving force, with a 53% rise in AI-driven deep fake attacks.
• Cyber-related insurance claims increased by 22% in 2024.
• Affected companies saw a 27% fall in average shareholder value due to malware and ransomware attacks.
• Cyber insurance take-up rate is only 6% in APAC.

7. Cyber Insurance Coverage and Adoption:

• Adam Pegman explains that cyber insurance covers:
  • First-party costs: Forensic, legal, remediation expenses.
  • Direct financial loss from attacks.
  • Third-party liabilities.
• There's a trillion-dollar cybercrime loss in Asia Pacific, with most losses uninsured.
• Cyber insurance aims to close the "insurance protection gap," freeing up capital for innovation.

8. Barriers to Cyber Insurance Adoption:

• Keno notes that cyber insurance is not a substitute for cyber protection and is a post-event measure.
• Premium escalation during the lockdown period hindered adoption.
• SGTech advocates for a holistic approach to cyber protection, including outreach and publications (e.g., cyber for AI papers).

9. AI-Powered Deep Fakes:

• Adam Pegman reports a 233% increase in claims related to social engineering events powered by deep fakes.
• Technical controls alone are insufficient; companies need to invest in technical posture and management coordination.
• Cyber resilience encompasses technical measures, management response, and risk capital allocation.

10. The Future Landscape:

• Adam Pegman emphasizes the rapid advancement of AI technology in the hands of bad actors.
• Cyber insurance helps companies balance investment needs with balance sheet risk.
• Only 14% of companies use financial risk quantification when deciding on cyber insurance.
• AON has invested a billion dollars in analytics tools to address the insurance protection gap.

11. Building Cyber Resilience:

• Keno highlights the increasing challenge of deep fakes, citing a CSA survey where people overestimate their ability to identify them.
• Reiterates the importance of the PPT framework, emphasizing people education and mindfulness.
• "What you see may not be what you get anymore."

12. Conclusion:

Singapore faces significant and evolving cyber threats, particularly from nation-state-backed APTs. Businesses need to adopt a holistic approach to cyber resilience, encompassing technical measures, robust processes, and well-informed personnel. Cyber insurance plays a crucial role in mitigating financial risks, but adoption rates remain low due to various factors, including cost and a lack of risk quantification. The rise of AI-powered deep fakes presents a new challenge, requiring increased vigilance and education to combat social engineering attacks.