Singapore government to share classified cyberthreat info with critical sectors

Key Concepts

• Critical Information Infrastructure (CII): Essential services like water, electricity, transportation, and banking that are vital for a nation's functioning.
• Advanced Persistent Threats (APTs): Sophisticated, stealthy, and long-term cyber attacks, often state-backed, aiming to steal information or disrupt operations.
• Operational Technology (OT): Technologies used in industrial control systems and other operational environments, distinct from Information Technology (IT).
• Threat Intelligence Sharing: The exchange of information about cyber threats between government agencies and CII owners.
• Threat Hunting: Proactive searching for hidden threats within a network, analogous to the body's immune system.
• Cyber Kill Chain: A multi-stage model describing the phases of a cyber attack, from reconnaissance to achieving objectives.
• Social Engineering: Manipulating individuals into divulging confidential information or performing actions that benefit the attacker.
• Cyber Diplomacy: International efforts to establish norms and responsible behavior in cyberspace.

Shift in Government Approach to Cyber Security for Critical Infrastructure

Singapore is implementing a significant shift in its approach to cyber security for Critical Information Infrastructure (CII) owners, moving beyond regulatory enforcement to a more collaborative partnership. This involves sharing classified information on cyber attackers with CII owners, such as water and electricity suppliers.

Main Topics and Key Points

• Enhanced Information Sharing: The government will now share classified threat intelligence with CII owners. This is a departure from the past where such information was exclusively held by the government due to national security concerns.
• Leveling the Playing Field: This initiative aims to "level the playing field" between sophisticated state-backed attackers and defenders, helping to "turn the tide against the threat actors."
• Addressing Sophisticated Threats: APTs are described as highly sophisticated, stealthy, and difficult to detect. CII owners, often not cyber security specialists, face these advanced threats.
• Bridging Detection Gaps: The government's classified intelligence can help CII companies detect threats they might otherwise be unaware of, especially since they may lack access to sensitive data required for threat actor identification.
• Broad Scope of CII: In Singapore, CII encompasses 11 diverse industries, including banking, transportation, and aviation, each with unique technologies and vulnerabilities.
• Vulnerabilities: Potential vulnerabilities for CII owners include supply chain risks, third-party compromises, and inherent software weaknesses. The use of Operational Technology (OT) also presents specific challenges.
• Singapore's Preparedness: Singapore is considered advanced in its planning and dealing with these threats, citing the Cyber Security Agency's (CSA) OT security expert panel as an example of proactive measures.
• Efficiency Gains: Sharing classified intelligence with cleared CII parties is expected to be more efficient, reducing time delays in threat detection and response.

Important Examples and Real-World Applications

• UNCC 3886 Attack: Communication between CII owners and the government played a crucial role in investigating the attack by APT group UNCC 3886, which was identified as a serious threat to national security.
• Telco Industry Perspective: A telco representative highlighted that clear communication between authorities and industry players helps protect the sector as a whole, enabling validation of potential threats observed on the dark web or within the sector.

Step-by-Step Processes and Methodologies

• Threat Hunting Process: Threat hunting is described as a proactive measure, akin to the body's T-cells searching for anomalies. It involves a security operational center running 24/7 to identify abnormal activities and reduce the time gap between incident discovery and response. The goal is to proactively find where threat actors are hiding.
• Cyber Kill Chain Application: The concept of the cyber kill chain is mentioned as a framework to understand the stages of an attack. The objective is to detect attackers before they reach the final stage of achieving their objective, thus enabling defenders to "win."

Key Arguments and Perspectives

• Government's Proactive Stance: The government's decision to share classified intelligence signifies a proactive shift from a reactive regulatory role to a collaborative defense strategy.
• Necessity of Collaboration: The argument is made that collaboration and information sharing are essential to counter the sophisticated nature of APTs and protect critical national infrastructure.
• CI Owners' Responsibility: CII owners will face increased responsibility in handling sensitive data, requiring investment in people, processes, and technology to manage and protect this information.
• Inherent Vulnerabilities: The inherent imperfections of humans (vulnerability to social engineering, fatigue) and software (bugs, zero-days) mean that complete security is unattainable, but structural changes can buffer against these issues.

Notable Quotes and Significant Statements

• "Imagine going up against an opponent that can linger in your house for months to years on end. One that uses the most sophisticated tools and expertise to steal your information and break your appliances without ever being seen." - Describing the reality faced by CII owners.
• "So the government has decided that it will have to move beyond the traditional regulator regulatory relationship when it comes to infrastructure owners. The government will partner more closely with them in this fight against cyber attacks." - Nicholas reporting on the government's new approach.
• "But we have decided that this significant shift is necessary for us to level the playing field between attackers and defenders and help to turn the tide against the threat actors." - Coordinating Minister for National Security on the rationale for sharing classified intelligence.
• "Uh especially when it comes to safeguarding against AP level attacks. That is that is because actually a attacks they are very sophisticated by nature and when they attack they are very stealthy and they are very difficult to detect." - Eiha Lim explaining the importance of intelligence sharing against APTs.
• "Cyber security is a a shared responsibility and sharing information not just sharing information sharing experience uh will benefits everyone uh in this kind of activities involving especially it involves as member states where the spirit of collaboration is always high and understanding and we can always work Together." - Malaysia's Cyber Security Chief on the benefits of regional collaboration.

Technical Terms, Concepts, or Specialized Vocabulary

• Critical Information Infrastructure (CII): Essential services vital for a nation's functioning.
• Advanced Persistent Threat (APT): Sophisticated, stealthy, and long-term cyber attacks, often state-backed.
• Operational Technology (OT): Technologies used in industrial control systems and operational environments.
• Threat Intelligence: Information about existing or potential threats to an organization's security.
• Threat Hunting: Proactive searching for hidden threats within a network.
• Cyber Kill Chain: A model describing the phases of a cyber attack.
• Social Engineering: Manipulating individuals to gain access or information.
• Zero-day: A vulnerability in software that is unknown to the vendor and for which no patch exists.

Logical Connections Between Different Sections and Ideas

The summary progresses from the announcement of Singapore's new policy to the rationale behind it, the specific threats it addresses, the preparedness of Singapore, the changes required from CII owners, the operational aspects of threat hunting, the broader implications for national cyber security policy, potential loopholes, and finally, Singapore's international cyber diplomacy efforts. The discussion on APTs logically leads to the need for enhanced intelligence sharing and proactive measures like threat hunting. The challenges faced by CII owners in handling sensitive data are directly linked to the government's decision to share classified information.

Data, Research Findings, or Statistics

• CII in Singapore encompasses 11 industries.
• The CSA has hosted an OT security expert panel for three to four years.
• 36 participants from 16 countries worked on a simulated cross-border attack during the ASEAN cyber drill.

Clear Section Headings

• Shift in Government Approach to Cyber Security for Critical Infrastructure
• Main Topics and Key Points
• Important Examples and Real-World Applications
• Step-by-Step Processes and Methodologies
• Key Arguments and Perspectives
• Notable Quotes and Significant Statements
• Technical Terms, Concepts, or Specialized Vocabulary
• Logical Connections Between Different Sections and Ideas
• Data, Research Findings, or Statistics
• International Cyber Diplomacy and Regional Collaboration
• Synthesis/Conclusion

International Cyber Diplomacy and Regional Collaboration

Singapore is also actively engaged in building international trust in cyberspace. This includes:

• UN Program Expansion: Extending and expanding a program with the United Nations to cover emerging AI and quantum threats, and to foster discussions on responsible state behavior in the digital world. This program is seen as a significant contribution to "cyber diplomacy."
• ASEAN Cyber Drill: Singapore hosted its annual ASEAN cyber drill physically for the first time, simulating a cross-border attack with 36 participants from 16 countries. This exercise highlighted that regional countries face similar threats and that information-sharing exercises boost overall security.

Synthesis/Conclusion

Singapore's new policy of sharing classified cyber threat intelligence with Critical Information Infrastructure (CII) owners marks a significant evolution in its national cyber security strategy. By moving beyond a purely regulatory role to a collaborative partnership, the government aims to equip essential service providers with the information needed to defend against sophisticated state-backed Advanced Persistent Threats (APTs). This initiative necessitates substantial changes for CII owners in terms of people, processes, and technology to handle sensitive data responsibly. While acknowledging that complete security is unattainable due to inherent human and software vulnerabilities, this enhanced intelligence sharing, coupled with proactive measures like threat hunting and international cooperation, is expected to bolster Singapore's overall cyber resilience and its standing in global cyber diplomacy. The emphasis is on a shared responsibility and a continuous effort to adapt to the evolving threat landscape.