The Asean Regional Computer Emergency Response Team (CERT) has been formally established, operating as a virtual centre comprising analysts and incident respondents from across member states. It is tipped to play a key role in beefing up the region's cyber resilience amidst a threat landscape that is increasingly complex.

It would deepen collaboration between CERTs amongst Asean member states and boost the region's cybersecurity posture, said Minister for Communications and Information Josephine Teo, who was speaking at the Asean ministerial conference held Thursday in Singapore.  

Noting that the region already had conducted annual CERT incident drills since 2006 to boost the readiness of CERTs within the individual countries, Teo said setting up the Asean CERT was an important step in building regional cyber resilience. 

There currently are 10 Asean member states including Singapore, Indonesia, Thailand, Malaysia, and the Philippines. The region in September 2018 agreed on the need for a formal framework to coordinate cybersecurity efforts, outlining cyber diplomacy, policy, and operational issues. 

Analysts and incident respondents in the regional CERT would ensure timely information exchange when a cybersecurity incident, such as a supply chain attack, occurred in any of the member state. 

The CERT held eight functions, including facilitating coordination and information sharing between national CERTs and developing partnerships with industry players and academia. These served to boost Asean's operational readiness in dealing with the changing cyber landscape through stronger regional incident response coordination and collaboration in critical information infrastructure (CII) protection. The latter would include cross-border CII, such as aviation, maritime, and banking and finance. 

"Regional CERT analysts would rapidly share information from their own countries and jointly develop advisories when needed," Teo said. "We are weaving a tighter net that will hopefully help prevent cyber attackers from getting through too easily."

She said the regional CERT now would need to be operationalised, adding that Singapore had distributed a draft operational framework and was seeing feedback from member states.

This document detailed the purpose, scope, functions, mechanism, as well as composition and partners of the Asean Regional CERT. The facility is targeted to be established by 2024, after both the operational framework and financing model have been agreed upon by member states. 

For the Asean CERT to be effective, every member state would have to be onboard and share information freely, said Alex Lei, Asia-Pacific Japan senior vice president at security vendor ProofPoint. 

While it was still early days to assess its effectiveness, establishing a cross-national CERT was a positive step forward, Lei said in an interview with on the sidelines of the conference, which was held in conjunction with Singapore International Cyber Week. 

He noted the competitive landscape in cyber was "lopsided", with the "defenders" such as organisations and nations often working in silos, while the attackers operated in a marketplace where there were no national divisions. Ransomware attacks also were offered as as service and hacking tools were freely sold, he said, with hackers all working together. 

Defenders, on the other hand, were concerned about their proprietary data, he added, but noted that this was starting to change with more willingness now to exchange threat intel. 

"So for the Asean CERT to work...the free exchange of ideas and information is important or you'll lose leverage from what you're seeing [in the threat landscape]," he said. 

Teo also pointed to the need to implement "rules, norms, and principles" of responsible state behaviour in cyberspace. Asean, she said, remained the first and only regional group to have subscribed, in principle, to the United Nations' (UN) 11 voluntary, non-binding norms of responsible state behaviour in the use of ICTs. 

"All of us in Asean appreciate the importance of an open, secure, stable and interoperable cyberspace, based on mutual trust and confidence," she said. "Developing the 'rules of the road' for cyberspace requires deliberate and consistent effort. We need to actively implement the 11 voluntary and non-binding norms."

She noted that a plan of action to put these principles into practice was endorsed last year, outlining concrete steps Asean members could take as well as specific areas they could focus on to drive capacity building. 

Importance of clarity, readiness in incident response

Detailing clear steps to take was especially important to better guide businesses in mitigating security risks and incidents, said Imperva CTO Kunal Anand in an interview with . 

He noted that companies were overwhelmed by the deluge of tools, concepts, and frameworks being thrown at them by security vendors. Market players also were touting different messaging on ways to address security risks, making it even more confusing for organisations, Anand said. 

It could be difficult for companies to really understand their risks, know what to invest in, and who to hire, he said, noting that this should be addressed by providing businesses with playbooks that offered clear steps to take to protect themselves.

Pointing to Singapore's CII supply chain guide, he noted that the document currently was not prescriptive and offered little as a constructive playbook for businesses to implement if they experienced a supply chain attack. 

Released by the Cyber Security Agency (CSA), the CII Supply Chain Programme Paper aimed to mitigate supply chain risks through five key areas, including a toolkit for CII owners to identify and rate supply chain risks. 

If there was another Log4j, for instance, CII operators needed to know how they should respond to a supply chain vulnerability, the steps to take, and how they should communicate and talk about it with their ecosystem, Anand said. 

The paper instead took on a high-level view and did not go into detail concrete steps companies should take to mitigate and address supply chain risks. He also pointed to the need to connect cybersecurity risks with financial risks. "We need to be more prescriptive so companies know where to begin and what to do," he said, adding that Singapore could codify core principles and actions into such playbooks. 

That said, he noted that the Asian nation was amongst the most advanced in cybersecurity preparedness, with CSA availing many collaterals and guidelines such as the supply chain paper to support the local industry.  

SolarWinds' head geek Sascha Giese also underscored the need for businesses to know exactly what they had to be done in the event of a breach. 

Asked about gaps that needed to be plugged. Giese said companies still lacked preparation for worst-case scenarios, with their employees insufficiently trained on what they had to do in the event of a breach. 

Running incident response drills, for example, would allow organisations to finetune policies and steps their staff should take, including public statements the company should make when a breach occurred. 

"Preparation is everything. You don't place a fire extinguisher at the door only when a fire breaks out," he said. "That's what still missing even in big enterprises today."

RELATED COVERAGE

• Asean champions regional efforts in cybersecurity, urges international participation
• Singapore to offer bug bounty, set up Asean cybersecurity centre
• Pandemic pushes cybersecurity to top agenda in Asean boardrooms
• Asean countries to establish framework for cybersecurity collaboration
• Singapore holds emergency meetings with CII sectors over Log4j