Preliminary indications from the recent spate of cyber incidents are that these data breaches were a result of opportunistic attacks exploiting a range of common vulnerabilities in IT systems, the Personal Data Protection Commission (PDPC) said in a statement on Friday (Nov 13).
PDPC stressed that although more significant data breaches have been reported in the past week, there were no clear connections between incidents and some incidents being related to global data breaches.
The commission pointed out that while the connectedness of systems today has supported business efficiency and innovation, there are inherent risks that organisations should be aware of. These, it said, include third-party supply chain risks and Application Programming Interface (API) exploitation.
"When threat actors find a vulnerability at any part of these connected systems, they find it easier to move laterally through the different systems," PDPC explained in its statement.
"They may also find it easier to gain remote access to the systems, as well as impact other third parties in the organisation’s supply chain."
In a post on LinkedIn, PDPC commissioner Denise Wong said that organisations should take cyber security and data breaches seriously to avoid becoming victims. She said, "Threat actors are moving faster than before to exploit common vulnerabilities, and more systematically attacking a wider range of targets."
What organisations can do to protect themselves
PDPC's findings echo that from an earlier statement by the Cyber Security Agency of Singapore, which pointed to similar vulnerabilities.
On measures that organisations can take, PDPC said they should regularly check for vulnerabilities and have a plan for how to patch them, protect access and credentials, and use industry standard encryption to protect sensitive data or store them offline.
The commission also reiterated an earlier advisory that organisations should not keep data that is not needed and protect against unauthorised data theft by taking loss prevention measures as set out in its Guide to Data Protection Practices for ICT systems.
Employees can also be trained on good data protection practices through a refreshed e-learning programme.
PDPC also stressed that organisations have an obligation to report data breaches, including notifying customers if the data breach is likely to result in significant harm to individuals, and/or are of significant scale.
"Encouragingly, PDPC has seen more organisations affected by data breaches voluntarily notifying customers. This brings greater visibility to data breaches and allows consumers to take steps to protect themselves," it said.
Consumers also have a part to play
The commission also advised consumers to protect themselves by sharing only what is necessary, and to use secondary email accounts for accessing non-essential services.
They should also be vigilant against phishing scams, especially following a notification by an organisation that their personal data has been affected by a data breach.
"In Singapore’s highly digitalised and digitally connected landscape, protecting personal data requires a whole of society effort.
"Organisations and consumers must remain updated on data protection practices and safeguards," PDPC said.
[[nid:751215]]
editor@asiaone.com
