Speaker 1: imagine your computer system is taken hostage by criminals who
Speaker 1: demand that you pay them a ransom to get your
Speaker 1: device back. Now this kind of ransomware attack is on
Speaker 1: the rise and no business big or small is immune.
Speaker 1: So what are the five things you need to know
Speaker 1: to protect yourself against ransomware? I'm sonar Ramesh from the
Speaker 1: man
Speaker 1: my team and I'll be getting some answers from David,
Speaker 1: co chief executive of the cybersecurity agency of Singapore and
Speaker 1: Jon Scheyer, Senior security advisor at sofas. That's a security
Speaker 1: software and hardware company. So my first question to both
Speaker 1: of you is just explain to us what exactly is ransomware.
Speaker 1: We're familiar with cyber attacks that are phishing attacks that
Speaker 1: try to get your password and then try to gain
Speaker 1: access to your computer systems. And this would then either
Speaker 1: result in them stealing information or perhaps tricking you into
Speaker 1: transfer of monies or your bank account, et cetera, which
Speaker 1: will result in financial loss. So those are the traditional
Speaker 1: types of cyber incidents which we are familiar with ransomware
Speaker 1: is a
Speaker 1: different kind of cyber attack. What happens is that they
Speaker 1: come into your computer system and then they launch a
Speaker 1: specific type of malicious software which locks up your entire
Speaker 1: computer system so that you can't access it. They then
Speaker 1: tell you that we have locked up your computer. If
Speaker 1: you want access to this computer please pay us a
Speaker 1: certain amount of money, which is the ransom hands the
Speaker 1: term ransomware. So it's ransom
Speaker 1: malware. Initially when the criminals started to do this they
Speaker 1: did it at a small scale. They targeted individuals, small
Speaker 1: and medium enterprises and the amount of ransom that they
Speaker 1: charge was at a very small level. So the victim
Speaker 1: would typically pay the ransom because it was an inconvenience etcetera.
Speaker 1: But it was a lucrative business because the Attackers, the
Speaker 1: criminals were able to do this repeatedly across
Speaker 1: the board many times so many small attacks, but each
Speaker 1: one a few $100 adding up to be lucrative small business.
Speaker 1: From the criminal perspective the criminals have now evolved and
Speaker 1: they have become more organized and they have formed into
Speaker 1: very large gangs. So the gangs are sophisticated and they
Speaker 1: are increasingly targeting larger companies not just small and medium enterprises,
Speaker 1: large enterprises listed companies etcetera.
Speaker 1: In these cases they recognize that the sophistication that's required
Speaker 1: has to go up because large companies don't just have
Speaker 1: one or two computers but they have entire networks. So
Speaker 1: their tax systems now need to be able to overcome
Speaker 1: the defenses of the large company and to be able
Speaker 1: to lock up the entire network once they have done
Speaker 1: this as a whole element of negotiation. Once I've locked
Speaker 1: up your networks I'll charge you a much larger amount
Speaker 1: and then there's an element of negotiation. So the entire
Speaker 1: system is like a criminal business and it's now evolved
Speaker 1: where they have their own R. And D. Teams, they
Speaker 1: have their own negotiation teams, they have got teams that
Speaker 1: deal with the technical aspects, teams that deal with the
Speaker 1: financial aspects and teams that deal with the human aspects
Speaker 1: of negotiation for example. So it's almost like a shadow business.
Speaker 1: It's organized in gangs and they operate internationally.
Speaker 2: Traditionally ransomware. It's a piece of malicious software that will
Speaker 2: encrypt the files on your systems and the criminals will
Speaker 2: ask for a ransom. So that sum of money to
Speaker 2: buy back the decryption key to decrypt your
Speaker 1: files, some of the
Speaker 2: ransomware criminals have also shifted and we've seen this in
Speaker 2: the past couple of years to also stealing data so
Speaker 2: they will steal that data and they will threaten to
Speaker 2: publish that data publicly if you don't pay up. And
Speaker 2: we've even
Speaker 2: seen lately some groups that are actually foregoing the encryption
Speaker 2: bit and just doing the data stealing because in their
Speaker 2: minds
Speaker 1: the extortion
Speaker 2: part is still part of that data stealing. If you've
Speaker 2: got some data that's intellectual property or is going to
Speaker 2: compromise your customers privacy. Some companies are opting to pay
Speaker 2: for preventing the release of that data.
Speaker 1: So it's an evolution of traditional data breaches.
Speaker 2: It does start that way the
Speaker 2: for ransomware has really diversified and specialized, you've got different
Speaker 2: groups doing different kinds of things and we've got some
Speaker 2: groups that are called initial access brokers, they're sole job
Speaker 2: really is to just find victims gain access to those
Speaker 2: victims gain persistence meaning they gain a point of presence
Speaker 2: within those networks and then they resell that access to
Speaker 2: other criminals and often those criminals or ransomware criminals. But
Speaker 2: if you look at the way that the initial access
Speaker 2: brokers work, they exploit vulnerabilities. So
Speaker 2: if you're not patching your systems, then they'll use that
Speaker 2: as a way into your networks or they'll just rely
Speaker 2: on good old fishing, grabbing your credentials or sending in
Speaker 2: malicious attachments that will provide them a foot in the
Speaker 2: door and once they've got that foot in the door,
Speaker 2: then they can either go forward and perpetrate any crime
Speaker 2: they want. But more often than not, they'll resell that
Speaker 2: to another group of criminals which will then go on
Speaker 2: for the next step of the attack.
Speaker 1: Why is ransomware a growing problem? Not just here in
Speaker 1: Singapore but also around the world.
Speaker 1: We've seen the number of cases in Singapore go up
Speaker 1: from about more than 50% in the last one year
Speaker 1: up to 137 cases reported to us last year. And
Speaker 1: these are only the reported cases. I'm sure there are
Speaker 1: many other cases which haven't been reported to the authorities.
Speaker 1: We see the trends going up
Speaker 1: in terms of the scale and the intensity ransomware used
Speaker 1: to affect individuals, small and medium enterprises. Now we see
Speaker 1: it intensifying the criminals are going after big companies and
Speaker 1: including essential services. One example was earlier this year, the
Speaker 1: government of Costa rica was hit by a ransomware attack.
Speaker 1: And this affected essential services in Costa rica, Their medical services,
Speaker 1: tax services, customs, the government actually declared a state of emergency.
Speaker 1: So these have real world implications, not just small companies,
Speaker 1: but actually large companies and even countries as a whole.
Speaker 1: So this is of growing concern, ransomware also is by
Speaker 1: nature a cross border issue. The criminals are typically coming
Speaker 1: from outside the country from anywhere in the world. Actually, secondly,
Speaker 1: they exploit the jurisdictional differences boundaries to avoid the prosecution
Speaker 1: or legal consequences of their actions.
Speaker 1: And thirdly, as I said, they're going after bigger and
Speaker 1: bigger companies that can result in real world impact to citizens, individuals, people.
Speaker 1: This being the case, it is essential for us to
Speaker 1: respond to this. And as we respond to this, it
Speaker 1: can't just be a domestic issue but has to be
Speaker 1: an international response.
Speaker 1: So we're talking about a cross border problem that also
Speaker 1: requires cross border solutions tell us who's most at risk here.
Speaker 2: Well, the fact is that 100% of companies are potential
Speaker 2: victims I'm often asked is, you know, how bad can
Speaker 2: it get? Well, I think it's already as bad as
Speaker 2: it can be because every single business out there is
Speaker 2: a potential target of ransomware criminals. The idea that there
Speaker 2: are bigger fish out there are too small to be
Speaker 2: a target. It's just false. There are many, many different
Speaker 2: ways to monetize a victim.
Speaker 2: It doesn't have to be ransom where there are other
Speaker 2: crimes out there, simply stealing data and reselling the contents
Speaker 2: of that data to other criminals? Additional phishing campaigns against
Speaker 2: them and their partners? There's just too many ways to
Speaker 2: monetize this data
Speaker 1: so you're never too small or too big to be
Speaker 1: a victim of cyberattacks. And one form of cyberattack that's
Speaker 1: on the rise in Singapore and around the world is ransomware. Now,
Speaker 1: that's when criminals launch malware that locks up your computer
Speaker 1: and then demand a ransom from the victor
Speaker 1: and before you can get your computer system back. These
Speaker 1: attacks have also evolved and in some attacks, the criminals
Speaker 1: steal data as well. It looks like these cyber bad
Speaker 1: guys are just constantly upping their game. How can businesses,
Speaker 1: particularly small and medium sized ones, step up defenses against
Speaker 1: such threats in the last two years have been hugely
Speaker 1: challenging for small and medium enterprises. Firstly, we had covid,
Speaker 1: then we had to respond to that many small and
Speaker 1: medium enterprises took the opportunity over force to adopt
Speaker 1: digital solutions. So we were forced to adopt digitalization. This
Speaker 1: has resulted in some benefits for us, but at the
Speaker 1: same time the very act of going more digital exposes
Speaker 1: us to greater cyber risks. So it's a double edged sword.
Speaker 1: On the one hand, you have the opportunity that digitalization
Speaker 1: brings us more customers ability to do things at scale faster,
Speaker 1: more convenient. But on the other hand, digitalization opens us
Speaker 1: to greater cyber risks. So we need to understand this.
Speaker 1: What are the challenges that small and medium enterprises face?
Speaker 1: First of all is the issue of resource, don't have
Speaker 1: enough people don't have enough money, we don't have an
Speaker 1: I T department. So this is a real big resource,
Speaker 1: but I also want to address perhaps a misconception that
Speaker 1: cyber is not just a technical issue. Yes, at the
Speaker 1: base level there are technical issues, but I would like
Speaker 1: to
Speaker 1: urge us to understand from the small and medium enterprises,
Speaker 1: I want to say that cyber actually is a business
Speaker 1: risk issue. If you understand that your business depends on digitalization,
Speaker 1: your business depends on your computer databases, etcetera. Then actually
Speaker 1: as a business leader, you need to be aware of
Speaker 1: the risks that you're taking with respect to cyber and
Speaker 1: you need to be able to do
Speaker 1: deal with this just like any other business risk. It
Speaker 1: is something that the business leader needs to think about
Speaker 1: needs to consider and their trade offs, do you do
Speaker 1: this or you do that? On the one hand, it's
Speaker 1: more convenient, but on the other hand, you're taking on
Speaker 1: more risks. Ultimately it is a business decision that may
Speaker 1: impact your bottom line and you as a business leader
Speaker 1: need to be aware of this and making those kinds
Speaker 1: of decisions.
Speaker 2: The first way we do this is by building resilience
Speaker 2: into our infrastructure, into our
Speaker 1: systems. The thing to
Speaker 2: note about ransomware specifically and and really just cyber attacks
Speaker 2: in general is it starts as a trickle and then
Speaker 2: becomes a torrent. So as we're talking about these little
Speaker 2: things like a phishing attack where the document provides them
Speaker 2: a little bit of an access into the network. Once
Speaker 2: they're in the network, they have to then do a
Speaker 2: little bit of discovery and reconnaissance to understand what kind
Speaker 2: of network there in where the high value
Speaker 2: assets are, they have to move around laterally. They have
Speaker 2: to escalate privileges. So all these little things are signals
Speaker 2: that are potentially discoverable and can give people an opportunity
Speaker 2: to detect and then stop the criminals. So building resilience
Speaker 2: into the system where we monitor the networks continuously and
Speaker 2: then are able to spot those signals when they happen
Speaker 2: and investigate those signals is part of it. And then
Speaker 2: the other part of it, we have to stop paying
Speaker 2: these criminals. The volume of money that is going into
Speaker 2: criminals pockets a self fulfilling prophecy, right? The more we
Speaker 2: pay the
Speaker 2: guys, the more they're going to improve their ability to operate,
Speaker 2: the more they're going to be able to recruit affiliates,
Speaker 2: the more they're going to be able to just go
Speaker 2: about their business
Speaker 1: with this ever evolving range of online threats. What sort
Speaker 1: of help is available for businesses smes need to recognize
Speaker 1: that they can and they are being targeted. Some smes
Speaker 1: take the view that I'm too small, no one will
Speaker 1: come after us. The reality is that we are exposed
Speaker 1: to cyber criminals from all over the world.
Speaker 1: They're opportunistic so when they find a potential victim they
Speaker 1: find a target. They're not specifically targeting you but they
Speaker 1: just find somebody and just hit it. And the nature
Speaker 1: of the digital spaces that they can fire many bullets
Speaker 1: as it were at a relatively low cost.
Speaker 1: So you need to plan for this, you need to
Speaker 1: be prepared for this, understand the resource constraints that smes face.
Speaker 1: So in that respect what government has done is that
Speaker 1: we have launched many programs which could help smes many
Speaker 1: of them are actually free.
Speaker 1: For example CSC has launched the S. G cyber safe
Speaker 1: program in 2021. This provides free to kids which you
Speaker 1: can download from us. Get access from us for free.
Speaker 1: These are designed for the leaders. The bosses in the smes,
Speaker 1: they're designed for all the employees as well as for
Speaker 1: their I. T. Departments so you've got different two kids
Speaker 1: which are designed for the different parts of the organization.
Speaker 1: So there are some which are
Speaker 1: designed just for the bosses to understand some for the I. T.
Speaker 1: Department so that they can implement the solutions and then
Speaker 1: others are for awareness for all the employees because actually
Speaker 1: all of us are at the front lines of this
Speaker 1: challenge that we're facing and all employees need to do
Speaker 1: the basic things cyber actually is a team effort. We
Speaker 1: need everyone in the organization not just the I. T. Department,
Speaker 1: the bosses, all the employees to be aware of the
Speaker 1: part that they play and play their part. Well. In
Speaker 1: March of 2022 C. S. A. Has also launched two
Speaker 1: new initiatives. These are the cyber essentials and the cyber
Speaker 1: trust Mark, one of the big challenges that we glean
Speaker 1: when we talked to all our stakeholders is that cyber
Speaker 1: is just too complicated. There's so many things to do,
Speaker 1: what am I supposed to do And then when I
Speaker 1: speak to the vendors, they're always telling me their solution
Speaker 1: will solve all the
Speaker 1: so as an sme it is a huge challenge to
Speaker 1: try to make sense of the space, know exactly what
Speaker 1: you need to do and what you can do cyber
Speaker 1: essentials is a move in that direction where we simplify
Speaker 1: it and say that look if you're an S M E,
Speaker 1: these are the basic things that need to be done
Speaker 1: and if you do this, you give you a relative
Speaker 1: level of cyber hygiene which will put your enterprise in
Speaker 1: a better state.
Speaker 1: And in addition to that, we have also reached out
Speaker 1: to different companies to make sure that their products aligned
Speaker 1: to this and that us sme then you have a
Speaker 1: choice of which products you can buy, which will meet
Speaker 1: the cyber essentials. Mark. We hope that in due course
Speaker 1: you can put this a bit like a simpler version
Speaker 1: of I. S. O. Mark on your company and then
Speaker 1: you can tell your customers that your company has reached
Speaker 1: this level of basic cyber hygiene, which
Speaker 1: is recognized by the cyber essentials Mark. Beyond the cyber
Speaker 1: essentials Mark, there's also the cyber trust Mark. This is
Speaker 1: meant for larger enterprises, those which more resources where you
Speaker 1: can aim for a higher level of excellence in cybersecurity.
Speaker 1: So help is available for smes, but it's also about
Speaker 1: a mindset change, isn't it? David, The nature of cyber
Speaker 1: is perhaps unfamiliar to many of us. Many of us
Speaker 1: instinctively know how to deal
Speaker 1: with physical security dangers. We know that when we leave
Speaker 1: our homes, we lock the door, we close the windows.
Speaker 1: If we drive, we'll lock our cars. You are careful
Speaker 1: not to leave your wallet, your handful in your purse
Speaker 1: lying around. You know how to take care of this.
Speaker 1: If you're walking late at night, you'll be a bit
Speaker 1: more careful if it's unsafe part of the place. Where
Speaker 1: do we get all of these instincts? We got this
Speaker 1: as we were growing up, our parents taught us.
Speaker 1: But when it comes to cyber, we don't have these instincts.
Speaker 1: Our parents didn't teach us anything. If anything, we're teaching
Speaker 1: our parents what to do to be safe on cyberspace.
Speaker 1: So as it were, we haven't had a chance to
Speaker 1: hone these instincts of what needs to be done? What
Speaker 1: is natural, How do we be more cautious? We're using
Speaker 1: digital devices, but we haven't got those instincts yet. I'm
Speaker 1: not a digital native. I speak the language. Perhaps I
Speaker 1: speak the language and an accent.
Speaker 1: My Children are digital natives. They will grow up having
Speaker 1: much more instincts of what is safe. What is natural
Speaker 1: and how to look out for science, which perhaps things
Speaker 1: don't add up. So because we don't have these instincts,
Speaker 1: we need to build them up. We need to train
Speaker 1: our employee.
Speaker 1: We need to train ourselves when we are on e
Speaker 1: commerce sites, how to be more careful how to watch
Speaker 1: for signs of fishing, how to look for telltale signs
Speaker 1: that this perhaps may not be a legitimate website or
Speaker 1: this is asking for things which you shouldn't be putting
Speaker 1: out on the net.
Speaker 1: How would a typical cyber attack take place? It typically
Speaker 1: begins with a phishing email so someone that's still the
Speaker 1: vast majority of the start of cyber attacks so they
Speaker 1: send out emails that entice the employee or the individual
Speaker 1: to click on. It Sometimes could be a free offer.
Speaker 1: Sometimes it could be a warning. Your bank account is
Speaker 1: not working. You need to click on this in order
Speaker 1: to reactivate it.
Speaker 1: So it prays on human psychology, our greed or our
Speaker 1: fears and then entices you to then click on this
Speaker 1: when your guard is let down, then you do this
Speaker 1: and then you make a mistake,
Speaker 1: even when that happens, one shouldn't panic. It doesn't happen instantaneously.
Speaker 1: You may result in the attacker gaining access to your device,
Speaker 1: but even then you can call the bank, you can
Speaker 1: call the company involved, the credit card company to then
Speaker 1: cease operations increasingly that is something that we've been educating
Speaker 1: the public to do.
Speaker 1: But then if you're not aware that this has happened,
Speaker 1: then in the company, for example, an employee makes a mistake,
Speaker 1: what then happens? The attacker comes in, he then gains
Speaker 1: access to one computer. That's not good enough because yes,
Speaker 1: you've taken over one computer. But actually his goal is
Speaker 1: to take over the entire company's network. So he actually
Speaker 1: needs to employ some sophisticated technical means to then gain
Speaker 1: access to the
Speaker 1: one computer and then from there move sideways into the network.
Speaker 1: So if the company has well designed system, if the
Speaker 1: company has a well designed security, then he can detect
Speaker 1: the adversary in his networks. The conceptual equivalent of an
Speaker 1: employee left the door open, someone comes into your office,
Speaker 1: then the next question is, can he wander around your
Speaker 1: entire office at will,
Speaker 1: can you walk into the Ceo's office and steal the
Speaker 1: money that's in the safe? So the question that I
Speaker 1: would ask, sme leaders is that are your digital assets
Speaker 1: kept in the safe, just like your physical assets are kept?
Speaker 1: Have you identified what are your digital crown jewels in
Speaker 1: the physical world? We know what's important. We keep it
Speaker 1: in the safe is your office all open for anyone
Speaker 1: to walk it
Speaker 1: probably not. Probably they can walk into the reception area,
Speaker 1: but then if they want to come to the senior management,
Speaker 1: there's someone to check. There's another layer of doors etcetera.
Speaker 1: And the most valuable things are kept in the safe.
Speaker 1: The kind of thinking the kind of instinct, the kind
Speaker 1: of layout that we have for physical security should be
Speaker 1: implemented in the digital space, ransomware evolved out of phishing attacks.
Speaker 1: What do you think will be the next big cyber
Speaker 1: threat out there?
Speaker 2: All those threats are still around, we still see viruses,
Speaker 2: we still see worms, we still see phishing ransomware is
Speaker 2: just the very final payload. Now in the past it
Speaker 2: was more about defacement or notoriety and there was some
Speaker 2: monetization of hosts. So if if you got infected by
Speaker 2: a botnet for example, you could then get resold and
Speaker 2: get those hosts resold to send spam that might sell,
Speaker 2: you know Viagra or fake Viagra in this case. Right.
Speaker 2: But I think some of the scams that are coming
Speaker 2: up are related to some of the newer technologies that
Speaker 2: we're seeing things like deepfakes. So according to the FBI
Speaker 2: business email compromise or also known as ceo fraud where
Speaker 2: basically you're tricking somebody into sending money to your account
Speaker 2: instead of your distributors account. That is one of the
Speaker 2: bigger crimes out there. Far dwarfs in terms of just
Speaker 2: monetary value. Far dwarfs, ransomware and that crime works by
Speaker 2: Impersonating somebody. And so when we've got these deepfakes now
Speaker 2: that are getting so convincing, both the voice models that
Speaker 2: where somebody calling you over the phone or even the
Speaker 2: video models, it's going to really impact that side of
Speaker 2: the crime as well. So we're talking about really high
Speaker 2: tech cutting edge technology that is going to supercharge and
Speaker 2: already very big, big crime. In addition to things like
Speaker 2: business email compromise, we're seeing a lot more crypto scams
Speaker 2: now that are involving personalities that are being created by
Speaker 2: hand by people. So they are creating fake instagram accounts
Speaker 2: and all sorts of different fake personalities. Now with deep
Speaker 2: you don't have to actually hand create them. You can
Speaker 2: let the machines create the personalities for you. And as
Speaker 2: the technology matures and gets better, we kind of envision
Speaker 2: a world where these technologies will be able to interface with.
Speaker 2: You hold basic conversations and perpetrate fraud on a scale
Speaker 2: that we've never seen before
Speaker 1: as technology evolves. So too will the threat from cyber criminals?
Speaker 1: One major type of cyber attack that's on the rise
Speaker 1: is ransomware cases reported in Singapore have risen
Speaker 1: Over 50% and businesses big and small are at risk.
Speaker 1: What makes such attacks tricky to trace is that they
Speaker 1: often cross border, which means that solutions will also have
Speaker 1: to be transboundary, there's help available for businesses to scale
Speaker 1: up their defenses. But in addition to stronger cyber protection protocols,
Speaker 1: a mindset change is also needed. Now, that's because cybersecurity
Speaker 1: isn't just a tech issue, it's ultimately about protecting your business.
Speaker 1: Well, those are five things you need to know about
Speaker 1: protecting against ransomware attacks. My guest today, David cole, chief
Speaker 1: executive of the cyber security Agency of Singapore, and john
Speaker 1: Sha senior security advisor at Sophia's Money Mind as every
Speaker 1: saturday at 10 30 PM on Mediacorp c n a,
Speaker 1: you can also catch us online at CNN dot asia
Speaker 1: on youtube.