We are creating some awesome events for you. Kindly bear with us.

Protecting data, not devices

Protecting data
[social-share align="left" style="icon" size="m" template="18" counters="0" total_counter_pos="leftbig" buttons="linkedin,twitter,facebook,share"]

What are the major cybersecurity challenges you see for the public sector?

In all businesses, a balance has to be struck between what the business needs, how much risk it can afford and the budget. The security budget globally is around 5% of IT budgets. Five percent is not a small amount. If directed properly it could be used to make the organisation reasonably secure.

A CIO in the private sector might get overly excited by the new, cool security start-up that they met last month at a convention and then spend money buying their product, without analysing if it works for them.

With governments, the problem is the opposite. They are very conservative. They want stable, reliable solutions, from big established names. That makes them buy legacy products, such as anti-virus and firewalls, which might not no longer be relevant and which drain dollars from that 5% IT security budget towards ineffective, out-of-date solutions.

Governments are relatively slow in responding and embracing new technology. They are often not pro-active. If one division gets targeted by ransomware today, tomorrow all the security dollars will go towards ransomware. You can bet that tomorrow the threat won’t be ransomware. By the time you deploy sandboxing technology to protect yourself from ransomware, you have to deal with something else.

Governments need to start thinking ahead of time and focus on not just patching the problems of today, but look to where we are going and prepare for those challenges.

Where are the threats coming from?

The problems are coming from inside, not outside. Insider threats are a daunting challenge.

It is not just malicious insiders. It could be insiders who just want to do the right thing for the company.

Say a nurse who needs to have the patient data on-hand, as she goes for rounds with the doctors. She just puts the data on an unsecured USB drive. You ban USB drives, she creates a Google drive account. She is putting patient data at risk

You need to have a technology that allows this lady to do business but also protects the company and the end-users, ensuring that the data stays safe.

Do you think most nations are considering the risks associated with IoT, when developing their Smart Nation plans?

During the Singapore International Cyber Week, the Prime Minister did not say Smart Nation. He said Secure Smart Nation.

That’s the problem with most other countries. Most countries end up saying something along the lines of, “We are going to embrace Smart Nation. Can you give me some boxes to make it secure?” That is not how it works.

The Singapore approach is a good one. In Singapore, new projects are going to be built with security in mind, which is fantastic.

These days everyone is talking about security-by-design. But what do you do about the systems and the infrastructure you already have in place?

Last month, we released a report on ‘Abandonware’. It is a term commonly used to refer to legacy game software that has been abandoned by the author but is still widely loved and used by the user community.

We have become accustomed to and rely upon various web-connected devices, available whenever and wherever we need them in our personal and professional lives. We expect them to receive the benefits of automatic patching and updating of software, as is done by Apple, Adobe, Microsoft and Google. We have become so used to it that this leads to a sense of complacency and we don’t bther to check for vulnerabilities while using "end-of-life'd” software, for which no product support is available.

Here we are using it to refer to the use of software that has come to its end-of-life but, for a variety of reasons, is still in use. We had a case study where around 75,000 users in the IT security field continued to use an abandoned and somewhat obscure plug-in for an abandoned software package, thereby unknowingly and unnecessarily putting themselves at risk.

In your view, what kind of approach should be taken by governments for defending their organisations against cyber-threats?

You might have a hundred pieces of security software, but still not be secure because you do not have access to the big picture. Instead you have thousands of logs. A disjointed view can hinder the ability to detect and defeat advanced security attacks.

We invested to connect the dots and produce a risk-incident scoring system. It will help in prioritising. It will tell you that these are the incidents you need to deal with first.

Having a security process, however robust it might be, cannot make anyone fully secure. We need to figure out what is the most important thing to protect. It is not the devices.

Protecting all devices in any organisation might be a lost battle. What I need to protect is the data. That’s where I should be investing 95% of my IT security budget.

We have to protect data contextually. Suppose you have a legitimate reason to access customer data on a regular basis. But if the security system detects that all the customer details are being sent out in a batch, that should be a red flag. Either you are doing something wrong, maliciously or otherwise and you need to be stopped or it is someone pretending to be you.

So, contextual, behavioural analysis is essential, around data, not around people and devices. In the past we protected laptops. Protecting the data is of paramount importance in today’s environment.

[easy-social-share align="center" style="button" size="xxl" template="59" counters=0 noaffiliate="no" sidebar="no" popup="no" float="no" postfloat="no" topbar="no" bottombar="no" point="no" mobilebar="no" mobilebuttons="no" mobilepoint="no" facebook_text="Share on Facebook" linkedin_text="Share on LinkedIn" buttons="linkedin,facebook"]


Qlik’s vision is a data-literate world, where everyone can use data and analytics to improve decision-making and solve their most challenging problems. A private company, Qlik offers real-time data integration and analytics solutions, powered by Qlik Cloud, to close the gaps between data, insights and action. By transforming data into Active Intelligence, businesses can drive better decisions, improve revenue and profitability, and optimize customer relationships. Qlik serves more than 38,000 active customers in over 100 countries.


CTC Global Singapore, a premier end-to-end IT solutions provider, is a fully owned subsidiary of ITOCHU Techno-Solutions Corporation (CTC) and ITOCHU Corporation.

Since 1972, CTC has established itself as one of the country’s top IT solutions providers. With 50 years of experience, headed by an experienced management team and staffed by over 200 qualified IT professionals, we support organizations with integrated IT solutions expertise in Autonomous IT, Cyber Security, Digital Transformation, Enterprise Cloud Infrastructure, Workplace Modernization and Professional Services.

Well-known for our strengths in system integration and consultation, CTC Global proves to be the preferred IT outsourcing destination for organizations all over Singapore today.


Planview has one mission: to build the future of connected work. Our solutions enable organizations to connect the business from ideas to impact, empowering companies to accelerate the achievement of what matters most. Planview’s full spectrum of Portfolio Management and Work Management solutions creates an organizational focus on the strategic outcomes that matter and empowers teams to deliver their best work, no matter how they work. The comprehensive Planview platform and enterprise success model enables customers to deliver innovative, competitive products, services, and customer experiences. Headquartered in Austin, Texas, with locations around the world, Planview has more than 1,300 employees supporting 4,500 customers and 2.6 million users worldwide. For more information, visit www.planview.com.


SIRIM is a premier industrial research and technology organisation in Malaysia, wholly-owned by the Minister​ of Finance Incorporated. With over forty years of experience and expertise, SIRIM is mandated as the machinery for research and technology development, and the national champion of quality. SIRIM has always played a major role in the development of the country’s private sector. By tapping into our expertise and knowledge base, we focus on developing new technologies and improvements in the manufacturing, technology and services sectors. We nurture Small Medium Enterprises (SME) growth with solutions for technology penetration and upgrading, making it an ideal technology partner for SMEs.


HashiCorp provides infrastructure automation software for multi-cloud environments, enabling enterprises to unlock a common cloud operating model to provision, secure, connect, and run any application on any infrastructure. HashiCorp tools allow organizations to deliver applications faster by helping enterprises transition from manual processes and ITIL practices to self-service automation and DevOps practices. 


IBM is a leading global hybrid cloud and AI, and business services provider. We help clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Nearly 3,000 government and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM’s hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM’s breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and business services deliver open and flexible options to our clients. All of this is backed by IBM’s legendary commitment to trust, transparency, responsibility, inclusivity and service.