Do businesses in Singapore need Incident Response?

Netmarks Singapore

12 minutes ago

2 min read

Statistically, most companies and organisations are at minimal risk to cyber attacks as they have comprehensive IT systems in place…right?

Digital lock on circuit board with stacks of cubes. Text reads: "What is Incident Response and why is it important?" Red and blue tones.

Earlier in June, personal data of around 70,000 people were compromised in a cybersecurity incident involving Singapore Land Authority (SLA) and their vendor IBM due to unauthorised access to a data set in a cloud-based environment.

What followed was an extensive investigation by SLA, IBM, the Government Technology Agency of Singapore (GovTech) and the Cyber Security Agency of Singapore (CSA) to ensure remedial action would be taken accordingly.

How Incident Response works

An incident response plan, similar to what SLA had taken is essentially a playbook on the procedures an organisation needs to take in the event after an actual ‘attack’ has happened.

SLA’s incident response plan essentially demonstrated the following:

Preparation (Establish policies, assign roles, train staff) – SLA
Identification (Detect incidents, identify compromised systems) - SLA, IBM
Containment (Limiting exposure, isolating the attack) - IBM
Eradication (Safely remove the virus) - IBM
Recovery (Verify the environment, restore systems) - SLA, IBM
After incident review (Identify gaps, develop improvement plans) – CSA, GovTech

Building up Incident Response capabilites

Most organisations and businesses may not have similar resources and support in the event of a cyber-attack.

However, organisations and businesses can build such resources and support to a certain capability by investing in an incident response plan.

Case example of an email phishing incident:

Without an Incident Response plan:

1. Frantic search for a response vendor

2. Rushed approvals

3. Delayed breach recovery and high costs

With an Incident Response plan:

1. Incident response team activated

2. Malware email contained and neutralised

3. Recommendations made and recovery performed

Simply put, it is not a matter of whether you need incident response, but rather when you need it.

Prevention is always better than cure and investing in an incident response like Blackpanda’s IR-1 plan from as little as SGD40 per staff for a year definitely brings an ease of mind and cost savings compared to the alternative – tens of thousands of dollars incurred just for last minute recovery.