BlackBerry Limited unveiled research at the NACSA Cybersecurity Summit, highlighting significant software supply chain cybersecurity vulnerabilities within Malaysian organisations. The study found that 79% of Malaysian IT decision-makers had received notifications of attacks or vulnerabilities in their software supply chains in the past year, exceeding the global average of 76%. Almost 38% of these organisations took up to a month to recover from such incidents.
The survey, conducted in April 2024 by Coleman Parkes, followed the Malaysian Government's gazetting of the 2024 Cyber Security Act (Act 854) and the announcement of the National Semiconductor Strategy (NSS) in May. These initiatives aim to bolster Malaysia's position as a global semiconductor powerhouse and underscore the need for secure-by-design software practices and robust regulations to protect the IT supply chain. The report emphasised the critical importance of these measures in supporting Malaysia's ambitions in sectors like semiconductor manufacturing and Artificial Intelligence (AI).
The study aimed to identify current procedures for managing security breaches in software supply chains. It revealed that nearly one-third of Malaysian respondents identified operating systems (30%) and IoT/connected components (19%) as the most at-risk areas, leading to significant financial loss (71%), reputational damage (66%), and data loss (59%) after an attack.
Ir. Dr. Megat Zuhairy Megat Tajuddin, Chief Executive, NACSA, presented at the media briefing during the NACSA Cybersecurity Summit 2024.
Dr. Megat Zuhairy bin Megat Tajuddin, Chief Executive of NACSA, stressed the importance of the Cyber Security Act 2024 in enhancing the cyber-resilience of Malaysia's National Critical Information Infrastructure. He highlighted Malaysia's commitment to becoming a leader in semiconductor manufacturing and AI, while also recognising the global responsibility to protect the software supply chain through improved compliance, technology adoption, and skills and training initiatives.
BlackBerry Cybersecurity CISO, Christine Gadsby, noted the need for a comprehensive approach to cybersecurity, encompassing skilled workers, secure-by-design products, and modern AI monitoring tools. She acknowledged Malaysia's efforts to increase regulatory measures and investment in skills and technology to protect critical infrastructure and key industries from cyber-attacks.
Malaysian organisations reported strict security measures, including security awareness training (58%), data encryption (48%), and multi-factor authentication (47%). However, only 40% prioritised Software Bill of Materials (SBOMs), despite international regulatory and compliance requirements likely increasing their importance in the coming years. Most IT leaders (95%) expressed confidence in their suppliers' cybersecurity policies, with many demanding compliance certification and third-party audits.
The survey also highlighted challenges in maintaining regular software inventories, with factors such as a lack of technical understanding (58%), effective tooling (44%), visibility (41%), and skilled talent (40%) cited as barriers. More than three-quarters of respondents expressed a need for tools to improve software library inventories and visibility into software vulnerabilities.
Christine Gadsby, Chief Information Security Officer, BlackBerry Cybersecurity, presenting at the media briefing during the NACSA Cybersecurity Summit 2024.
Christine Gadsby concluded that addressing human factors and leveraging AI-powered Managed Detection and Response (MDR) technologies could support organisations in managing emerging threats and complex security incidents. The full survey and further information on AI's role in protecting the software supply chain are available online, along with details on training courses at the Malaysia Cybersecurity Center of Excellence.
黑莓有限公司在NACSA網絡安全峯會上公佈了研究報告,重點介紹了馬來西亞組織內部的重大軟件供應鏈網絡安全漏洞。該研究發現,在過去的一年中,有79%的馬來西亞IT決策者收到了軟件供應鏈中存在攻擊或漏洞的通知,超過了全球平均水平的76%。這些組織中有將近38%花了長達一個月的時間才從此類事件中恢復過來。
這項調查由科爾曼·帕克斯於2024年4月進行,此前馬來西亞政府公佈了2024年《網絡安全法》(第854號法案),並於5月宣佈了國家半導體戰略(NSS)。這些舉措旨在鞏固馬來西亞作爲全球半導體強國的地位,並強調需要通過安全設計的軟件實踐和強有力的法規來保護信息技術供應鏈。該報告強調了這些措施對於支持馬來西亞在半導體制造和人工智能(AI)等領域的雄心壯志至關重要。
該研究旨在確定管理軟件供應鏈中安全漏洞的現行程序。報告顯示,近三分之一的馬來西亞受訪者將操作系統(30%)和物聯網/互聯組件(19%)確定爲風險最大的領域,在攻擊後導致重大財務損失(71%)、聲譽損失(66%)和數據丟失(59%)。
紅外線。NACSA首席執行官Megat Zuhairy Megat Tajuddin博士在2024年NACSA網絡安全峯會期間的媒體發佈會上發表了講話。
NACSA首席執行官Megat Zuhairy bin Megat Tajuddin博士強調了2024年《網絡安全法》在增強馬來西亞國家關鍵信息基礎設施的網絡彈性方面的重要性。他強調了馬來西亞致力於成爲半導體制造和人工智能領域的領導者,同時也認識到通過提高合規性、採用技術以及技能和培訓計劃來保護軟件供應鏈的全球責任。
黑莓網絡安全首席信息安全官克里斯汀·加茲比指出,需要採取全面的網絡安全方法,包括技術工人、安全設計產品和現代人工智能監控工具。她感謝馬來西亞努力增加監管措施和對技能和技術的投資,以保護關鍵基礎設施和關鍵行業免受網絡攻擊。
馬來西亞組織報告了嚴格的安全措施,包括安全意識培訓(58%)、數據加密(48%)和多因素身份驗證(47%)。但是,儘管國際監管和合規要求在未來幾年可能會越來越重要,但只有40%的人優先考慮軟件物料清單(SBOM)。大多數 IT 領導者(95%)表示對供應商的網絡安全政策充滿信心,許多人要求合規認證和第三方審計。
該調查還強調了維護定期軟件庫存方面面臨的挑戰,包括缺乏技術理解(58%)、有效的工具(44%)、知名度(41%)和熟練人才(40%)等因素列爲障礙。超過四分之三的受訪者表示需要工具來改善軟件庫清單和軟件漏洞的可見性。
黑莓網絡安全首席信息安全官克里斯汀·加茲比在2024年NACSA網絡安全峯會期間的媒體發佈會上發表講話。
克里斯汀·加茲比得出結論,解決人爲因素和利用人工智能驅動的託管檢測和響應(MDR)技術可以支持組織管理新出現的威脅和複雜的安全事件。有關人工智能在保護軟件供應鏈中的作用的完整調查和更多信息,以及馬來西亞網絡安全卓越中心培訓課程的詳細信息可在線獲得。