Average monthly reported cyber incidents have tripled since September compared to Jan–Aug: CSA

The spate of recent cyber incidents do not appear to be part of coordinated campaigns targeting Singapore, the Cyber Security Agency of Singapore (CSA) said on Friday (Nov 13).

The agency also noted that the average monthly number of reported cyber incidents since September has been three times the January to August average.

"(They) reflect a broader global trend of opportunistic attacks," CSA said, adding that some incidents have also involved compromised third-party suppliers, underscoring the importance of managing supply chain risks.

Explaining the trend, it highlighted that threat actors would actively scan the internet for vulnerable systems.

Even organisations that are not specifically targeted can become victims, CSA said, pointing to the growing use of artificial intelligence (AI) by threat actors that could further accelerate the discovery and exploitation of vulnerabilities, reducing the time organisations have to secure their systems. 

On the use of AI, CSA warned that this has also "significantly compressed" the window organisations have to detect and address vulnerabilities before they are compromised.

This poses an increasing risk to all organisations in Singapore, where they could face operational disruptions, reputational damage, and financial losses from successful cyberattacks.

Observations from recent incidents

Since the start of November, victims have included healthcare service providers, SATS Food, M1, SPH Media, and personal finance portal MoneySmart.

CSA said its preliminary observations indicate that many recent incidents arise from common security gaps, particularly third-party systems and exposed digital infrastructure.

These include unpatched and exposed system, weak identity and access management, third-party and supply chain risks, and social engineering.

To address these issues, CSA recommended that organisations take the following measures:

• Patch vulnerabilities quickly by applying security updates to Internet-facing servers, network appliances, software dependencies, and Application Programming Interfaces (APIs), prioritising known exploited vulnerabilities.
• Identify and secure Internet-facing assets through an urgent audit of all external-facing systems, disabling unnecessary services or open remote access ports, and enforcing proper authentication and firewalls.
• Enforce multi-factor authentication by immediately enabling phishing-resistant MFA across all privileged accounts, remote access portals, email systems, and cloud applications.
• Review and enforce least privilege access by auditing user and service accounts to revoke excessive permissions, removing dormant accounts, and restricting administrative privileges strictly to those who require them.

Over the longer term, organisations should also adopt measures such as strengthening third-party and supply chain oversight; conducting regular phishing simulation and staff training; implementing continuous monitoring and vulnerability management; maintaining and testing business continuity plans, and protecting internet-facing applications.

Entities may refer to the Cybersecurity Health Check tool to assess their cybersecurity posture and identify areas for improvement. 

editor@asiaone.com