The recent move by the Singapore government to revoke Internet privileges for its civil servants has sparked intense debate. Questions have been raised as to whether this is at odds with Singapore’s intention of becoming a Smart Nation and a hub for technology in the region.
The news also made headlines abroad. Responses have been mixed, with some supporting the decision, while others suggesting it may be merely avoiding the problem.
Tony Jarvis, Chief Strategist – Threat Prevention, APAC, Middle East & Africa, Check Point Software Technologies shares his expert views on the matter.
At first glance, the decision to revoke Internet access might seem extreme. However, it is important to note that this comes after a careful review process, taking into consideration a number of factors. For example, removing access to the Internet will bring with it the benefit of reducing exposure to many threats.
Unfortunately, this comes at the expense of productivity and effectiveness of the organisation and its employees. This particular case highlights the ongoing challenge, organisations face to remain secure in a connected world.
Tony Jarvis, Chief Strategist – Threat Prevention, APAC, Middle East & Africa, Check Point Software Technologies Ltd
This move further comes amidst a growing number of high profile government breaches around the globe. In June of 2015, the Office of Personnel Management in the United States announced that it had suffered a data breach with the most recent figures putting the number of stolen records at 21.5 million.
Closer to home, the Philippines government was subject to a similar breach in April involving details of 55 million voters being stolen. In both cases, personally identifiable information, such as Social Security numbers, passport numbers and fingerprint records were taken.
While it is a rare move for governments to cut off Internet access as a solution, it can occur in highly regulated environments. The military, public utilities, even banking, are often subjected to such measures. There are, however, other risks which need to be addressed, such as email being used as a delivery method for attacks.
See: Singapore Wants Government Employees off the Internet
Is banning Internet the right approach to securing government?
There is no right or wrong approach around banning the Internet. If public servants will be allowed to forward work emails to their private email accounts, this poses another problem because network security protections don’t normally extend to web-based services working outside the organisation’s secure network.
In addition, if the organisation operates without document security, there is the risk of employees forwarding confidential documents to unauthorised parties. In the event that private email accounts are breached, these documents may fall into the wrong hands. It should be noted that there are multiple attack vectors which can be used to infect a victim, with the Internet being only one of these.
There are three pillars to any successful security program: people, processes and technology. Training users in proper cyber hygiene is a good first step. Having robust procedures in place to manage risk is also crucial. Technology allows policies to be enforced and protections to be automated.
Not all technologies are created equal, so it is important to identify what risks an organisation is exposed to, and what technologies are best suited to provide the required protections.
Today’s advanced threats are constantly evolving, and traditional defenses based on signatures were never designed to protect against these dangers. Solutions that are able to identify malicious behaviour in files that have never been seen before are a necessity today.
Most security vendors allow threats into the network and then begin the process of evaluating their behaviour. Once a suspicious activity is identified, it can often be too late. However, threats can be kept at bay by providing users with cleaned versions of documents while evaluation takes place in the background. This ensures productivity is not impacted, and the organisation is kept secure at all times.
Also read: Technology is on the Top of Mind for Singapore Employees. Is it for Better or for Worse?
Image credit: straitstimes.com
