Remarks at the Closing of Capital Market Cyber Simulation 2022

Speaker: Dato’ Seri Dr. Awang Adek Haji Hussin, Chairman, Securities Commission Malaysia
Location: Kuala Lumpur
Delivered: 6 December 2022

Note: This is the speech as drafted and may differ from the delivered version

Key Highlights:

At the closing of the Capital Market Cyber Simulation 2022, Chairman of the Securities Commission Malaysia (SC), Datuk Seri Awang Adek Husin emphasised that capital market players cannot afford to be complacent about cyber security. This is critical in order to protect investors and markets.

The SC places a high value on cyber resilience. This yearly simulation exercise was designed to simulate cyber event scenarios as close to the real situation as possible. This year, 110 organisations across the capital market spectrum participated in the exercise. They included Bursa Malaysia, brokers, asset managers, trustees, and recognised market operators such as equity crowdfunding, peer-to-peer platforms, and digital asset exchanges. Here are highlights from his speech –

Last year, Malaysia recorded over 20,000 cyber crime cases with losses amounting to RM560 million.
Cybersecurity requires a holistic approach that addresses both cyber and technology risks.
The SC is making efforts to strengthen the capital market’s overall capabilities and ability to withstand attacks.
In this regard, the CMP3 outlines several strategic initiatives that need to be undertaken:

Strengthening the SC’s and industry’s intelligence capabilities to be better prepared against potential breaches and imminent threats
Develop an approach to bolster the industry’s cyber defence capabilities
Develop a framework to regulate technology risks more holistically

The SC will release a new Regulatory Framework on Technology Risk Management by early 2023.
Based on this year’s exercise, it was observed that the overall score of participants improved significantly compared to last year.
Significant progress was also seen in participants’ ability to implement technical solutions and respond from a policies and procedures’ perspective.
Nonetheless, in light of evolving threats, the industry must continue to improve its cyber resilience and cyber readiness.

Speech as delivered:

Yang Berbahagia Jeneral Tan Sri Dato’ Sri Dr. Haji Zulkifeli Bin Mohd Zin (Bersara)
Pengerusi Lembaga Pengarah, CyberSecurity Malaysia

Yang Berusaha Encik Johari bin Hashim
Pengarah, Pusat Kawalan dan Koordinasi Siber Negara (NC4)

Dif dif kehormat

Tuan-tuan dan puan-puan

Assalamualaikum warahmatulahi wabarakatu dan salam sejahtera.

Terlebih dahulu, saya mengucapkan selamat datang kepada semua peserta Capital Market Cyber Simulation 2022.
Saya dimaklumkan bahawa sebanyak 110 organisasi merentas spektrum pasaran modal telah mengambil bahagian dalam latihan tahun ini. Ini termasuk Bursa Malaysia, broker, pengurus aset, pemegang Amanah dan pengendali pasaran berdaftar seperti pendanaan ramai ekuiti (ECF), pembiayaan antara rakan setara (P2P) dan pertukaran aset digital (DAX).
Sesungguhnya himpunan besar ini membuktikan keseriusan dan kesungguhan semua pihak bagi menjamin integriti pasaran modal di Malaysia.

OPENING: STRENGTHENING CYBER RISK MANAGEMENT IN AN INCREASINGLY DIGITAL LANDSCAPE

Ladies and gentlemen,

Against the backdrop of rising costs, technological improvements, shifting expectations on sustainability, and so on, the operating landscape of businesses are changing. Technology adoption has become a key competitive edge for firms, and data has evolved into a strategic asset for insight-driven decision making and growth.
While the embrace of data and technology presents many benefits, it also brings new challenges in terms of security and privacy.
However, as more devices go online, the risk of harm from a data breach is greater than ever.
Cybercrime is becoming big business and organisations and governments around the world are paying more attention to cyber risks.
Hackers choose to attack for a variety of reasons. Some do so to steal money or intellectual property. Others are driven to undermine our financial system, disrupt economies or simply to show-off their capabilities.
The economic cost of cyberattacks globally is estimated to be in the billions of dollars. Last year, Malaysia recorded over 20,000 cyber crime cases with losses amounting to RM560 million¹.
Throughout the course of the year, a spate of high-profile cyber-attacks, including those carried out on Ipay88 and most recently on Air Asia, have provided a grim picture of the current state of cyber-threats.
In order to safeguard investors and markets, we cannot afford to be complacent about cybersecurity. In addition to this, its importance to national security should not be overlooked.
For example, in May, a group of hackers claimed to have stolen the personal details of 22.5 million Malaysians from the myIDENTITI API, a database that allows government institutions such as the National Registration Department to access information about Malaysian citizens.
Such digital disruptions, data breaches and losses will almost certainly result in financial and reputational implications for your respective firms.
As cyber threats increase in volume and sophistication, and technology becomes more essential, cybersecurity requires a holistic approach that addresses both cyber and technology risks.
In light of this, the SC is making efforts to strengthen the capital market’s overall capabilities and ability to withstand attacks.
Cyber resilience is imperative for all capital market participants and a significant priority for the SC. In this regard, the Capital Market Masterplan 3 outlines several strategic initiatives that need to be undertaken, including the following:

Firstly, strengthening the SC’s and the industry’s intelligence capabilities to enhance readiness against potential breaches and imminent threats.
Second, developing an approach to bolster the industry’s cyber defence capabilities.
Third, developing a framework to regulate technology risks more holistically.

The SC also intends to release the new Regulatory Framework on Technology Risk Management by early 2023. This framework will significantly increase the capital market’s ability to detect and mitigate the risks that come with new technologies.

ABOUT THE SIMULATION EXERCISE

Ladies and gentlemen,

This annual Capital Market Cyber Simulation exercise, organised in collaboration with Cyber Security Malaysia and the National Cyber Security Agency, is critical to strengthening the cyber resilience of the Malaysian capital market.
As you are aware, the simulation exercise is designed to simulate cyber incident scenarios as closely as possible to the real situation.
Greater emphasis was placed on simulating the new norm. Therefore this year’s drill followed three common scenarios involving supply chain attacks, web defacement and data breach.
It is encouraging to hear that the overall score of participants has improved significantly since last year. Significant progress was also observed in participants’ ability to implement technical solutions and respond from a policies and procedures’ perspective.
Nonetheless, we should not rest on our laurels. It is important for the industry to continue elevating its cyber resilience and cyber readiness in light of evolving threats.

CLOSING

Ladies and gentlemen,

On behalf of the SC, CyberSecurity Malaysia, and the National Cyber Security Agency, we wish to thank you for your participation and cooperation in completing this year’s drill.
Let us all continue to embrace this shared responsibility to protect the integrity of the Malaysian capital market.

Terima kasih.

¹ Malaysia records RM560m loss in cybercrime last year – The Malaysian Reserve