Story image

Public feedback demands clarity in Singapore's draft Cybersecurity Bill

14 Nov 2017

The Singapore Government has revealed stakeholders’ feedback from the country’s draft Cybersecurity Bill, which shows a need for clearer regulations and concern about the proposed licensing framework.

The public consultation on the Bill was originally scheduled from July 10 to August 3 2017, however the deadline was extended to allow respondents more time to provide feedback. The Ministry of Communications and Information (MCI) and the Cyber Security Agency of Singapore (CSA) received 92 submission as part of the feedback process.

“Respondents acknowledged the timeliness and importance of the Bill in setting the necessary legislative framework for pro-active oversight and response to cyber threats and incidents. Several respondents also agreed with the need for cybersecurity information-sharing between CSA and other organisations, including the need to safeguard the information source and information disclosed. However, respondents had some reservations about the proposed licensing framework,” a statement from MCI says.

While stakeholders expressed concern that cyber attacks could cause major disruptions, the Government decided to refine the bill in three key areas: Designation of critical information infrastructures (CIIs); duties of CII owners and the requirements of the proposed licensing regime.

Designation of critical information infrastructures (CIIs):

Respondents asked for a clearer definition of what makes up CIIs, ‘computers’ and ‘computer systems’ that could be CIIs.

“We wish to clarify that this definition is intended to formalise our existing engagements with CII stakeholders, which has been in place since 2013. We will amend the Bill to clarify that only systems which have been explicitly designated by the Commissioner will be considered CIIs.”

“All other computers and computer systems will not be considered CIIs, and the obligations in Part 3 of the Bill therefore do not apply to them. Specifically, computer systems in the supply chain supporting the operation of a CII will not be designated as CIIs, therefore third-party vendors will not be considered as owners of CIIs.”

Duties of CII owners:

Respondents said that the Bill should consider existing codes and standards CII owners must already comply with, such as sectoral regulations.

“We will work closely with sector regulators to streamline and harmonise the obligations of CII owners under the Bill with their respective sectoral regulations.”

“The appointment of Assistant Commissioners to oversee CIIs in each sector will ensure that the Bill requirements are sensible and take into account existing sector-specific requirements, including international requirements. This is because the sector regulators understand the unique contexts and complexities in each sector, and are in a good position to balance the sectors’ cybersecurity needs and business requirements.”

Requirements of the licensing regime:

Some respondents voiced concerns about the regime and others said cybersecurity service providers should not be licensed. Doing so could ‘impact the development of a vibrant cybersecurity ecosystem in Singapore,’ MCI says.

“To strike a balance between industry development and security needs, MCI and CSA intend to simplify the licensing framework by doing away with the licensing of individual cybersecurity professionals, and removing the distinction between “investigative” and “non-investigative” types of licensable services.”

“This will allow the Bill to be more future-proof, and enable it to stay relevant even as cybersecurity services continue to evolve. At this point, we intend to license only penetration testing and managed security operations centre (SOC) monitoring service providers, as such services are already mainstream and widely-adopted.”

Organisations and associations who submitted feedback on the Bill include (but are not limited to) Palo Alto Networks, Wolfe Cyber Security, FireEye, Singtel, Singapore Airline Group, Kaspersky Lab, NTT Security Singapore, ISACA Singapore Chapter, the Association of Information Security Professionals, Singapore International Chamber of Commerce and the Singapore Computer Society.

Ping Identity offerings accelerates cloud MFA and SSO adoption
90% of respondents trust MFA as an effective security control to protect identity data in public clouds, yet only 60% of organisations have formally adopted it.
Trend Micro introduces cloud and container workload security offering
Container security capabilities added to Trend Micro Deep Security have elevated protection across the DevOps lifecycle and runtime stack.
Veeam joins the ranks of $1bil-revenue software companies
It’s also marked a milestone of 350,000 customers and outlined how it will begin the next stage of its growth.
Veeam enables secondary storage solutions with technology partner program
Veeam has worked with its strategic technology alliance partners to provide flexible deployment options for customers that have continually led to tighter levels of integration.
Veeam Availability Orchestrator update aims to democratise DR
The ability to automatically test, document and reliably recover entire sites, as well as individual workloads from backups in a completely orchestrated way lowers the total cost of ownership (TCO) of DR.
Nuix eyes legal sector as eDiscovery demand skyrockets
eDiscovery must encompass so much more than email and documents. If you haven’t looked at text messages and online chats, digital images, mobile devices, data in the cloud and social media, you’re not getting the whole story.
EXCLUSIVE: Forcepoint global channel chief talks strategy
As a solution sold 100% via the channel, cybersecurity solutions company Forcepoint places a strong emphasis on its partner relationships.
Salesforce continues to stumble after critical outage
“To all of our Salesforce customers, please be aware that we are experiencing a major issue with our service and apologise for the impact it is having on you."