This is Part 2 of a 3 part series. Read Part 1 and Part 3 here.

Cybersecurity has risen to the top of both national and international agendas. Government leaders from all over the world said that without cybersecurity there is no real national security. The boom of the digital economy and the digitalisation of businesses and society especially during the COVID-19 pandemic has now put the private sector at the centre of cybersecurity debates. Recent data mismanagements, or the revelations that social media sites compromised the data of millions of their users, highlight the central role that the private sector plays in cybersecurity. Undeniably, corporations are key players in the digital realm whether it is as distributors of malicious software, victims of cyber-attacks, or first responders to security breaches.

In the issue of cyber insecurity, the question lingers; what is the role of the private sector in cybersecurity policies, and how can this co-exist with the traditional responsibilities of government?

On a podcast by the Centre for Strategic and International Studies (CSIS), co-hosts Jim Lewis and Chris Painter talked with David Koh, Chief Executive of the Cyber Security Agency of Singapore (CSA). They discussed the integration between the private and public sectors in improving cybersecurity capacities.

Mr Koh recalled that the United Nations Open-Ended Working Group (OEWG) hosted consultative meetings with 100 States, 114 non-governmental stakeholders from the private sector, civil society academia, as well as the technical community. He said that he was fundamentally shocked as to how many people from all over the world, from many dimensions, were committed and so deeply involved and had such great ideas on cybersecurity. For him, this only shows that dealing with cyber requires a multi-stakeholder strategy. Solutions cannot be made without the help of other sectors because a lot of internet infrastructures are not controlled by the states’ government alone, as most of them are operated by private industries.

A lot of the technologies coming out are from industry, academes and civil societies. Therefore, a multi-stakeholder engagement is an ideal method to improve cyber resilience on a bigger scale. Mr Koh noted that at an intellectual level, everyone understands cyber so everyone must also be committed to trying to find viable solutions. He also emphasised that cybersecurity is the key factor in achieving an open and secured internet environment that can help boost domestic and international economies.

Mr Koh acknowledges that countries have different perspectives and angles about cybersecurity. Therefore, the UN OEWG gave both private and public sectors the platform to voice their varying ideas regarding cybersecurity within their respective jurisdictions. The forum also helped in terms of building the cyber capacities of ASEAN and other developing countries.

Mr Koh and the CSA view cyber capacity building as a collective effort. For the agency, cybersecurity is only as good as its weakest link. Singapore has made it a point to include ASEAN countries in this endeavour to fully improve cyber resiliency in the region.

First, they want to raise awareness of cybersecurity among their neighbours. Secondly, they are looking to help these countries build capacity in a uniform manner between concerned parties. Likewise, non-member countries of the ASEAN can also do dialogue with the association so there will be a broader agreement that cyber resiliency is an urgent concern for everyone. The CSA believes that things will be much more effective if they are properly coordinated on a much larger scale.

To support these coordinated cybersecurity efforts, Singapore launched the ASEAN-Singapore Cybersecurity Centre of Excellence (ASCCE), an extension of the ASEAN Cyber Capacity Programme (ACCP). It aims to build more secure and resilient cyberspace through capacity building programmes for ASEAN senior policy and technical officials with decision-making responsibilities. The ASCCE seeks to fulfil three principal functions:

1. Conduct research and provide pieces of training in areas spanning international law, cyber strategy, legislation, cyber norms, and other cybersecurity policy issues.
2. Provide CERT-related technical training as well as facilitate the exchange of open-source cyber threat and attack-related information and best practices.
3. Conduct virtual cyber defence training and exercises.

The ASCCE undertakes a modular, multi-disciplinary and multi-stakeholder approach to deliver these programmes. The ASCCE engages top cyber experts and trainers and collaborates with ASEAN member states, ASEAN dialogue partners and other international partners including Australia, Canada, the European Union, Japan, New Zealand, the Republic of Korea, the United Kingdom, and the United States, in designing and delivering cybersecurity capacity-building programmes.

The ASCCE delivers programmes in consultation with the International Advisory Panel (IAP) comprising senior representatives from key partner countries and international organisations. The ASCCE will also review and further develop its training curriculum with the support of the International Programme Committee (IPC), which comprises experts from participating countries and international organisations.

Mr Koh and the CSA continue to follow the four Ms when building cybersecurity capacities. Multi-disciplinary, where it is not just about technologies but also policies to be implemented in capacity building. Multi-stakeholder, where it is recognised that governments need support from industries in the private sector. Modular, where programmes can upscale. Matrix, where agencies like the CSA can measure the effectiveness of their campaigns over time.

This is Part 1 of a 3 part series. Read Part 2 and Part 3 here.

The Association of Southeast Asian Nations (ASEAN) is the world’s fastest-growing internet region, with the user base now at 480 million people. Digitalisation in Southeast Asia has important economic implications. By 2025, online spending could rise more than six-fold to US$200 billion. Most of this consumption will be in the areas of electronics, clothing, household goods, and increased travel across the region and elsewhere. This all bodes well in terms of building a middle class and fostering job growth in the region.

At the same time, there are negative sides to the transformation to a digital economy, with cyberterrorism, cyber fraud, and identity theft increasingly threatening its potential. Bad actors are working fast and creatively to wreak havoc on countries, businesses, and people. Today, the quality of a nation’s technology backbone is likely to influence its economic success. If cybersecurity is threatened, investor confidence in the ASEAN Economic Community (AEC) will begin to decay.

On a podcast by the Centre for Strategic and International Studies (CSIS), co-hosts Jim Lewis and Chris Painter talked with David Koh, Chief Executive of the Cyber Security Agency of Singapore (CSA). They discussed progress in cybersecurity done by the CSA in its first six years, technical and policy cooperation within ASEAN, and next steps in cyber diplomacy after the conclusion of the current United Nations’ Open-Ended Working Group (OEWG) processes.

Mr Koh stated that Singapore’s CSA is on a steady pace in the last six years, but it has been a frantic and hectic rollercoaster ride altogether. For him, they have made significant progress in Singapore in terms of cybersecurity. Firstly, by instilling the realisation that the country is tremendously dependent on digital infrastructures as a highly connected society. The way we work, the way we play, all kinds of things that we do depend on the internet today. This should make organisations and citizens realise that cybersecurity is an integral part of these practices. Mr Koh also sees cybersecurity as a key enabler for the nation to continue the way it lives, works, and plays.

From that perspective, CSA was born. Mr Koh said that he had the great honour of being selected to head up the organisation. He also noted that significant high-profile cyber hacks that occurred around the world helped in forming the agency. These cyber-attacks brought the message home to Singapore, a message that cyber risks are indeed real and must be taken care of.

Moreover, Mr Koh said that the CSA laid out the various cybersecurity strategies and the Singapore Prime Minister himself launched it.  By doing so, it galvanised the domestic audience by showing a commitment from the national government that boosting cyber resiliency is something that needs to be done.

In the ASEAN, Mr Koh conceded that no man is an island, all more so in cyber issues. The nature of digital is cross border international. The country must realise that no matter what happens in Singapore, it would not be sufficient to curtail the widespread cyber threats. Singapore knows that its economic growth is tied to the ASEAN region thus building up the region’s cyber resiliency is vital. David noted that to do this, ASEAN countries should leverage ICT technologies in terms of economy, education and so on. The region can fully leverage these tech advancements if it can also deal with cyber risks as well.

The message is clear that nations are all dependent on each other and they can only reap the full benefits of digitalisation by dealing with cyber issues.  Mr Koh is also glad that ASEAN members attend their meetings on cybersecurity at a ministerial level. That is how the ASEAN Ministerial Council on Cybersecurity (AMCC) was launched.

From a larger perspective, Mr Koh also mentioned that a rules-based framework must be implemented when dealing with cybersecurity. The United Nations’ Open-Ended Working Group (OEWG) is the perfect platform to do so, as it is open and inclusive to all 193 countries, large and small have their place there. By conducting discussions on the forum, UN members can now see the importance of cybersecurity for their respective countries. The broadening of the conversation on cyber resiliency to a much wider body of the international community is a significant achievement. Mr Koh believes that the OEWG is the right forum to continue the discussion on improving cyber resiliency. He added that it is a welcome sight that the UN members came to an agreement and a consensus that the issue of cybersecurity is something that we should all work on together as a community.

Mr Koh said that if the approach in cybersecurity is in the same direction, whether it be for the potential impacts of cyber threats to the solutions that deal with them, countries can expect a positive outcome in terms of strengthening cyber resiliency. Leaders and decision-makers must recognise that cybersecurity is an issue, and they need to work together so everyone can move forward in this journey of full digital transformation.