Up to 1,000 board directors to undergo cyber crisis simulation training

Key Concepts

• Cyber Resilience
• Cyber Attacks (Phishing, Business Email Compromise, Supply Chain Attack)
• Board Directors' Role in Cyber Security
• Cyber Crisis Management
• Real-World Simulations
• Cyber Resilience Guide for Boards
• Critical Information Infrastructure
• UNC 3886
• Thinking Process vs. Prescriptive Steps
• Collective and Collaborative Approach

1. Initiative Overview and Goals

• By 2028, up to 1000 board directors in Singapore will be trained to handle cyber attacks.
• The initiative aims to enhance organizations' cyber resilience through increased knowledge and resources.
• Free workshops, utilizing real-world scenarios, will be available for members of the Singapore Institute of Directors (SID) in partnership with Ensign InfoSecurity.
• The simulations are designed to train directors to fulfill their duties during a cyber breach, including making high-pressure decisions and overseeing recovery plans.
• Over 200 directors have already signed up for the workshops.

2. Common Cyber Threats for Board Directors

• Board directors need to understand common cyber threats, though not necessarily at a deep technical level.
• Examples of threats include:
  • Phishing: Deceptive attempts to obtain sensitive information.
  • Business Email Compromise (BEC): Attacks targeting business email accounts to steal money or data.
  • Supply Chain Attacks: Targeting vulnerabilities in an organization's supply chain.

3. Simulation Training Methodology

• The simulations put directors through real-world scenarios.
• Directors are presented with questions that require them to make decisions under pressure.
• The goal is to encourage collective discussion and informed decision-making during a cyber crisis.
• The simulations are based on real-world scenarios and government-level threat compositions.

4. Relationship to Existing Cyber Resilience Initiatives

• The initiative complements the existing Cyber Resilience Guide for Boards, launched earlier in the year by SID.
• The Cyber Resilience Guide aims to equip directors with the knowledge and skills to manage cyber resilience.
• This new partnership with Ensign InfoSecurity focuses specifically on managing cyber crises.
• The training is issue-based and aligned with the Cyber Resilience Guide.
• The overall approach includes general awareness training and specialized training on crisis management.

5. Applicability to Smaller Companies

• While critical infrastructure and financial hubs are primary targets, smaller companies are also vulnerable, especially through supply chain attacks.
• The workshops are designed to be applicable to both large and small companies.
• The focus is on the "thinking process" behind decision-making during a crisis, rather than prescriptive steps.

6. Encouraging Director Participation

• The initial response to the workshops has been encouraging.
• SID is partnering with Ensign InfoSecurity to offer corporate members a complimentary cyber incident response package.
• This is intended to incentivize companies to become SID members and benefit from the available knowledge and expertise.

7. Future Plans and Expansion

• The partnership aims to retrain 1000 directors by 2028.
• Plans include extending cyber resilience training and resources to other members of the SID ecosystem.
• Exploring opportunities to expand the initiatives to include management-level training.

8. Key Factors Influencing Crisis Situations

• The cyber threat landscape is rapidly evolving, especially with technologies like AI.
• A key challenge for directors is keeping up with the evolving threat landscape.
• Knowledge is crucial, and the Cyber Resilience Guide, thought leadership publications, and real-life simulations are all important tools.
• The goal is to train directors to "think" about cyber resilience and ask the right questions at the board level.
• Collaboration between the board and management is essential for tackling complex cyber threats.

9. Addressing Unpredictable Threats

• Many cyber challenges are unpredictable, making it difficult to prepare for specific scenarios.
• The workshops emphasize a collective and collaborative approach, bringing together directors from different businesses and sectors.
• By sharing experiences and insights, directors can expand their understanding of potential solutions during a cyber crisis.

10. Notable Quotes

• Terence Quek (CEO, Singapore Institute of Directors): "...one of the key things is to equip them with the knowledge as well as the skill sets to manage cyber resilience."
• Lim Soon Tze (Executive Vice President of Consulting, Ensign InfoSecurity): "Really, what we're going for is the thinking process behind the study should study of to make."
• Lim Soon Tze (Executive Vice President of Consulting, Ensign InfoSecurity): "...you're not really going for preschool. This steps to to to step step by step. A really is a coming together of different but direct this and decide direct this coming from different businesses, different sectors, Seoul, a coming together, you know, providing these a collective and collaborative approach to treating them to get them here."

Synthesis/Conclusion

The initiative to train up to 1000 board directors in Singapore by 2028 represents a significant effort to bolster cyber resilience across the nation's organizations. By providing practical, scenario-based training, the program aims to equip directors with the knowledge and skills necessary to effectively manage cyber crises. The emphasis on collaborative decision-making, coupled with resources like the Cyber Resilience Guide, underscores a holistic approach to cyber security that extends beyond technical solutions to encompass leadership and governance. The program's adaptability to both large and small companies, along with its focus on the evolving threat landscape, positions it as a crucial component of Singapore's broader cyber security strategy.