BlackBerry Limited unveiled research at the NACSA Cybersecurity Summit, highlighting significant software supply chain cybersecurity vulnerabilities within Malaysian organisations. The study found that 79% of Malaysian IT decision-makers had received notifications of attacks or vulnerabilities in their software supply chains in the past year, exceeding the global average of 76%. Almost 38% of these organisations took up to a month to recover from such incidents.
The survey, conducted in April 2024 by Coleman Parkes, followed the Malaysian Government's gazetting of the 2024 Cyber Security Act (Act 854) and the announcement of the National Semiconductor Strategy (NSS) in May. These initiatives aim to bolster Malaysia's position as a global semiconductor powerhouse and underscore the need for secure-by-design software practices and robust regulations to protect the IT supply chain. The report emphasised the critical importance of these measures in supporting Malaysia's ambitions in sectors like semiconductor manufacturing and Artificial Intelligence (AI).
The study aimed to identify current procedures for managing security breaches in software supply chains. It revealed that nearly one-third of Malaysian respondents identified operating systems (30%) and IoT/connected components (19%) as the most at-risk areas, leading to significant financial loss (71%), reputational damage (66%), and data loss (59%) after an attack.
Ir. Dr. Megat Zuhairy Megat Tajuddin, Chief Executive, NACSA, presented at the media briefing during the NACSA Cybersecurity Summit 2024.
Dr. Megat Zuhairy bin Megat Tajuddin, Chief Executive of NACSA, stressed the importance of the Cyber Security Act 2024 in enhancing the cyber-resilience of Malaysia's National Critical Information Infrastructure. He highlighted Malaysia's commitment to becoming a leader in semiconductor manufacturing and AI, while also recognising the global responsibility to protect the software supply chain through improved compliance, technology adoption, and skills and training initiatives.
BlackBerry Cybersecurity CISO, Christine Gadsby, noted the need for a comprehensive approach to cybersecurity, encompassing skilled workers, secure-by-design products, and modern AI monitoring tools. She acknowledged Malaysia's efforts to increase regulatory measures and investment in skills and technology to protect critical infrastructure and key industries from cyber-attacks.
Malaysian organisations reported strict security measures, including security awareness training (58%), data encryption (48%), and multi-factor authentication (47%). However, only 40% prioritised Software Bill of Materials (SBOMs), despite international regulatory and compliance requirements likely increasing their importance in the coming years. Most IT leaders (95%) expressed confidence in their suppliers' cybersecurity policies, with many demanding compliance certification and third-party audits.
The survey also highlighted challenges in maintaining regular software inventories, with factors such as a lack of technical understanding (58%), effective tooling (44%), visibility (41%), and skilled talent (40%) cited as barriers. More than three-quarters of respondents expressed a need for tools to improve software library inventories and visibility into software vulnerabilities.
Christine Gadsby, Chief Information Security Officer, BlackBerry Cybersecurity, presenting at the media briefing during the NACSA Cybersecurity Summit 2024.
Christine Gadsby concluded that addressing human factors and leveraging AI-powered Managed Detection and Response (MDR) technologies could support organisations in managing emerging threats and complex security incidents. The full survey and further information on AI's role in protecting the software supply chain are available online, along with details on training courses at the Malaysia Cybersecurity Center of Excellence.
BlackBerry在NACSA网络安全峰会上公布了研究报告,重点介绍了马来西亚组织内部的重大软件供应链网络安全漏洞。该研究发现,在过去的一年中,有79%的马来西亚IT决策者收到了软件供应链中存在攻击或漏洞的通知,超过了全球平均水平的76%。这些组织中有将近38%花了长达一个月的时间才从此类事件中恢复过来。
这项调查由科尔曼·帕克斯于2024年4月进行,此前马来西亚政府公布了2024年《网络安全法》(第854号法案),并于5月宣布了国家半导体战略(NSS)。这些举措旨在巩固马来西亚作为全球半导体强国的地位,并强调需要通过安全设计的软件实践和强有力的法规来保护信息技术供应链。该报告强调了这些措施对于支持马来西亚在半导体制造和人工智能(AI)等领域的雄心壮志至关重要。
该研究旨在确定管理软件供应链中安全漏洞的现行程序。报告显示,近三分之一的马来西亚受访者将操作系统(30%)和物联网/互联组件(19%)确定为风险最大的领域,在攻击后导致重大财务损失(71%)、声誉损失(66%)和数据丢失(59%)。
红外线。NACSA首席执行官Megat Zuhairy Megat Tajuddin博士在2024年NACSA网络安全峰会期间的媒体发布会上发表了讲话。
NACSA首席执行官Megat Zuhairy bin Megat Tajuddin博士强调了2024年《网络安全法》在增强马来西亚国家关键信息基础设施的网络弹性方面的重要性。他强调了马来西亚致力于成为半导体制造和人工智能领域的领导者,同时也认识到通过提高合规性、采用技术以及技能和培训计划来保护软件供应链的全球责任。
黑莓网络安全首席信息安全官克里斯汀·加兹比指出,需要采取全面的网络安全方法,包括技术工人、安全设计产品和现代人工智能监控工具。她感谢马来西亚努力增加监管措施和对技能和技术的投资,以保护关键基础设施和关键行业免受网络攻击。
马来西亚组织报告了严格的安全措施,包括安全意识培训(58%)、数据加密(48%)和多因素身份验证(47%)。但是,尽管国际监管和合规要求在未来几年可能会越来越重要,但只有40%的人优先考虑软件物料清单(SBOM)。大多数 IT 领导者(95%)表示对供应商的网络安全政策充满信心,许多人要求合规认证和第三方审计。
该调查还强调了维护定期软件库存方面面临的挑战,包括缺乏技术理解(58%)、有效的工具(44%)、知名度(41%)和熟练人才(40%)等因素列为障碍。超过四分之三的受访者表示需要工具来改善软件库清单和软件漏洞的可见性。
黑莓网络安全首席信息安全官克里斯汀·加兹比在2024年NACSA网络安全峰会期间的媒体发布会上发表讲话。
克里斯汀·加兹比得出结论,解决人为因素和利用人工智能驱动的托管检测和响应(MDR)技术可以支持组织管理新出现的威胁和复杂的安全事件。有关人工智能在保护软件供应链中的作用的完整调查和更多信息,以及马来西亚网络安全卓越中心培训课程的详细信息可在线获得。