GKSD - stock.adobe.com
CSA warns of emerging security risks with cloud and AI
Few users appreciate the security risks of cloud and have the expertise to implement the complex security controls, says CSA chief executive David Koh
The rapid adoption of emerging technologies such as cloud computing and artificial intelligence (AI) is posing new cyber security risks, adding to the increasingly complex cyber threat landscape.
In his keynote address at Black Hat Asia 2024 in Singapore, David Koh, chief executive of the Cyber Security Agency of Singapore (CSA), noted that although the global cloud market is expected to surpass $1tn by 2027, few users appreciate the security risks of cloud and have the expertise to implement the complex security controls needed to safeguard virtual networks and data.
“Adversaries are aware of this and are increasingly exploiting cloud environments through common vulnerabilities, identity theft, insecure APIs [application programming interfaces] and misconfigured containers,” he said, citing a CrowdStrike study that found cloud intrusions have increased by 75% from 2022 to 2023.
Koh said that was why the Singapore government recently introduced the Cybersecurity Amendment Bill, which will require cloud suppliers to shoulder responsibility for the cyber security of their infrastructure.
Cloud providers will also need to be transparent about cyber security incidents that have caused disruptions to customers and the infrastructure services they provide to businesses and individuals.
The upcoming amendment to Singapore’s Cybersecurity Act extends the government’s regulatory oversight beyond critical infrastructure to not only cloud, but also datacentre infrastructure on account that any compromise or disruption could have widespread implications on those who depend on those services.
But regulation is not the only tool in the arsenal. Koh said the Singapore government has also invested significantly in educating and equipping organisations and individuals with cyber security resources so they can help themselves. One example of this is the SG Cyber Safe programme that provides cyber security toolkits, self-assessment tools and playbooks to help organisations conduct phishing exercises and train employees to spot and act against phishing attempts.
Read more about cyber security in APAC
- Highly publicised cyber attacks and growing regulatory obligations are keeping security and risk top of mind for Australian organisations this year, says Gartner.
- The OAIC has called for organisations to proactively address privacy risks from outsourcing personal information handling to third parties.
- The chairman of Ensign InfoSecurity traces the company’s journey and how it is leading the charge in cyber security by doing things differently, investing in R&D and engaging with the wider ecosystem.
- The president of ST Engineering’s cyber business outlines the common myths around OT security to raise awareness of the security challenges confronting OT systems.
To improve awareness of cloud security among organisations, the CSA has also launched two cloud security companion guides that offer advice for enterprises on how they can operate safely in the cloud.
Koh said the world is also on the cusp of the AI revolution, which will bring opportunities to many aspects of business and IT, including sales, marketing and software development.
“If you had asked me in 2022 about the biggest tech challenges affecting cyber security, AI might not have been what I said,” he said. “ChatGPT was not known or understood then, but a year after its release, it had over 100 million weekly users with two million developers building on OpenAI’s API.”
Amid the immense potential of AI, Koh sounded a word of caution about the dark side of the technology, noting that Microsoft and OpenAI have found that threat actors have been using large language models to improve productivity, develop malware, and perform adaptive scripting and reconnaissance of victims, as well as machine learning to refine social engineering attacks and disseminate false information.
To defend against such attacks and other cyber threats, Koh stressed the importance of collaborating with industry partners and the broader cyber security community.
“Timely information sharing is key to disrupting threat actors who seek to use our interdependencies to move from target to target,” he said, adding that CSA has inked agreements with Google, Microsoft, NTT and Dragos to formalise the exchange of threat intelligence and work together to improve awareness of cyber security threats.
“Whatever your role is – practitioner, researcher, developer or government servant – you have a part to play in this team sport of cyber security,” said Koh in his concluding remarks. “It is a complex and challenging world out there, but we are not helpless. We are not without agency. I believe that together, we can make cyber space safer, more secure and trusted so that we can live, work and play safely and securely online.”
