Malaysia’s digital economy has been on a rapid trajectory, both as a growing e-commerce market—Malaysian consumers will spend $1.38bn online in 2018, according to Statistica, a 24% increase over 2017—and as a global hub for digital services thanks to its concentration of data centres. As connectivity becomes ever more integral to Malaysia’s overall economic development, it also increases the nation’s attractiveness for cyber-criminals.
Proliferating digital consumers, devices, and data centres creates “an expanding digital attack surface,” says Alex Loh, Malaysia country manager for networking and security firm Fortinet. “IT resources have been pushed to their limits due to the growing adoption of IoT devices and networks, the geometric growth of traffic driven by applications and big data, the creation of complex and highly elastic multi-cloud environments, and the number of highly mobile users demanding network access from anywhere on any device.”
As a result, the nature of cybersecurity incidents is evolving in the country. Data from Malaysia’s Computer Emergency Response Team (MyCERT) shows that while overall incidents are down, fraud-related threats (which have averaged more than two-thirds of all recorded cybersecurity events in 2018) and malware infections are on the rise.
Fraud, malware, and crypto-mining
Dato’ Dr. Haji Amirudin Abdul Wahab, CEO of CyberSecurity Malaysia, a government agency created in 2005 as an emergency response centre for tackling the growing challenges of cyber-malfeasance, sees the continued rise in fraud threats as somewhat of a function of Malaysia’s success as a digital economy. “Fraud has always been one of the most reported incidents in Malaysia,” he says, “including phishing, fraud purchase, illegal investment, business email compromise, and impersonation. This is due to more and more users are engaged online, doing various online activities and transactions.”
He notes that fraud is becoming more sophisticated: while targets are still mainly individual consumers, “the trend now is moving to targeting online business,” where gains are higher. Business Email Compromise (BEC), in particular, is increasingly prevalent.
According to Loh, attackers are actively looking for known vulnerabilities, taking advantage of newly announced zero-day threats, and maximising the accessibility of malware for bad intent. Cybercriminals are also adding IoT devices to their arsenal of tools used for mining for cryptocurrency. These devices are an especially attractive target because of their rich source of computational horsepower, which can be used for malicious purposes. Another critical factor is the fact that these devices tend to always be on and connected, enabling attackers to load them with malware that is continually engaged in crypto mining.
While ransomware continues to impact organisations in destructive ways, there are indications that some cybercriminals now prefer hijacking systems and using them for crypto-mining rather than holding them for ransom.
Beefing up defences
Orchestrating a strong and coordinated response has long been part of the government’s strategy for developing a digital economy. According to the Global Cybersecurity Index (GCI) 2017, Malaysia was ranked third among 193 countries in terms of its commitment to cyber security. Malaysia achieved a score of 0.89, behind Singapore and the United States. State-of-the-art cybersecurity solutions are key for delivering a truly digital nation, notes Dr Amir.
Cybersecurity Malaysia has launched a number of capacity-building efforts both nationally and internationally. These include collaborating with the National Security Council on an annual simulation that tests emergency preparedness of the country’s Critical National Information Infrastructure (CNII) agencies, launching the Global Accredited Cybersecurity Education (ACE) Scheme as an accreditation programme for IT security professionals, and developing MyCERT as a resource centre with technical and non-technical advice for containing incidents.
As cybersecurity threats continue to evolve, the private sector is also active in educating the next generation of cyber-defenders. Loh describes how Fortinet has partnered with the Universiti Teknologi Petronas to develop a network security academy aimed at producing “elite cybersecurity professionals”.
All of these efforts will be vital for keeping pace with the emerging nature of cyber-threats. “Cyber-criminals are also becoming smarter and faster in how they leverage exploits [network vulnerabilities] to their advantage,” he says. “With over 100,000 known exploits, most organisations cannot patch vulnerabilities fast enough to keep up.”
Insightful reads brought to you in partnership with MIT Technology Review Insights.
