Cyber Hygiene Compliance Guide for Singapore Companies

With the increasing threat of cyber-attacks like ransomware, phishing, and social engineering, it is of paramount importance that companies take measures to prepare for and prevent security breaches.

This is especially so if your company is a financial institution (like a bank, stock exchange, or payment service provider) which handles customers’ money and sensitive data.

As a result, in Singapore, the Monetary Authority of Singapore’s (MAS) “Notice on Cyber Hygiene” (the Notice) has made various cyber hygiene practices mandatory for specified financial institutions.

Read on to find out:

• What is cyber hygiene
• Why is cyber hygiene important
• Is maintaining cyber hygiene compulsory for Singapore companies
• What are the cyber hygiene requirements under the Notice on Cyber Hygiene
• The exceptions to compliance requirements with the Notice on Cyber Hygiene
• Must companies report to MAS on their compliance with the Notice on Cyber Hygiene
• What happens if a company fails to comply with the Notice on Cyber Hygiene

What is Cyber Hygiene? 

Cyber hygiene (also known as cybersecurity hygiene), refers to the habitual practices undertaken by organisations and individuals to ensure the safe handling of critical data and secure their network from cyber-attacks.

Such practices could include:

• Updating software and applications to ensure they stay up to date with the latest software updates
• Performing regular anti-virus scans on employees’ computers
• Educating employees on how to avoid falling for ransomware and phishing scams
• Regularly backing up data to minimise loss of data in the event of an attack

Why is Cyber Hygiene Important?

Practising cyber hygiene helps prevent or mitigate security incidents like data breaches, data loss and operational interruptions.

These security incidents can cause financial losses, damage to the company’s reputation or result in criminal or civil liability (these are explained in further detail below).

Better able to handle existing threats and pre-empt future ones

Maintaining cyber hygiene also positions your company to better handle existing and emerging threats. For example, in the case of a ransomware attack,  a malicious actor may lock up all your company’s data and files, and ask for payment to release the data by a certain deadline. In many cases, a failure to do so may result in the deletion of all data, but the data might also never be released, even after the payment is made. However, if your company frequently backs up its data, data from the last backup can still be restored. You can also avoid having to pay a potential hefty sum of money to the entity that was attempting to blackmail you.

If your company regularly performs vulnerability scans, it will be able to discover a vulnerability as soon as it is announced. It can then quickly cut off any vulnerable connections to prevent any immediate attacks.

With these cyber hygiene practices in place, your company would be better able to preempt a potential attack.

Is Maintaining Cyber Hygiene Compulsory For Singapore Companies?

Yes, maintaining cyber hygiene is compulsory if your company is a financial institution (FI) that falls under the purview of MAS’ cyber hygiene requirements under the “Notice on Cyber Hygiene”. This includes banks, insurers, payment service providers or capital market entities.

For the full list of types of companies that need to comply with the Notice, please refer to this FAQ by MAS, in section ‘A1’. 

What are the Cyber Hygiene Requirements Under the Notice on Cyber Hygiene and How Can Your Company Comply with Them? 

The 6 cyber hygiene requirements under the Notice on Cyber Hygiene are as follows:

1. Securing administrative accounts
2. Applying security patching
3. Establishing written security standards
4. Network Perimeter Defence
5. Implementing anti-malware measures
6. Implementing Multi-factor Authentication

Note: The term “system” will be used to refer to any hardware or software used by your company. This includes the operating system, database, an application (including web or mobile applications), or network devices.

1. Securing administrative accounts

Requirement: The FI must ensure administrative accounts are secured to prevent unauthorised access to or use of those accounts.

Administrative accounts allow users to perform highly sensitive system operations. Examples of such administrative accounts would include the “root” account on a server running Linux (the most common operating system used for servers) or on a cloud service provider such as Amazon Web Services.

Unauthorised access to administrative accounts or allowing too many people to have administrative rights can adversely affect system stability and security. This is because the more accounts there are with administrative rights, the greater the surface of attack, i.e. the number of weak points that attackers (insiders or intruders) can use to gain access to your network or systems.

A user with administrative rights or a hacker who has gained access to that user’s account can cause irreparable harm, including exporting sensitive data, or installing malicious software to steal money and data, or disrupt activities.

To minimise the risks associated with there being too many administrative accounts, companies can:

• Grant administrative rights on a need-to-use basis
• This means that the only people who should have administrative rights are those who absolutely need them to perform their functions (e.g., personnel in charge of licensing or billing matters).
• Further, procedures should be established to assess and approve the granting of administrative accounts.
• Periodic reviews should also be performed to verify that administrative rights are appropriately assigned and revoked when no longer required.
• Prevent unauthorised access to administrative accounts through appropriate controls such as:
  • Enforcing password complexity.
  • Enforcing password expiration.
  • Dual control of passwords (Where a user can only retrieve a password after permission or confirmation has been granted by an “Authorised Safe Owner”).
  • Segregation of duties for system administration.

2. Applying security patching

Requirement:

• The FI must apply security patches (i.e. security updates) to address vulnerabilities in every system.
• Such security patches must be applied within an appropriate timeframe based on the risk posed by each vulnerability
  • For example, if the risk is more serious (e.g., customer data is at risk), a security patch should be applied once it is available.
  • If the risk is minimal (e.g., the risk is to an isolated server that does not affect customers), the appropriate timeframe could be longer.
• If no security patch is available, the FI must ensure controls are put in place to reduce any risks posed by the relevant vulnerability.

When your company discovers a new vulnerability, it should assess the severity of the vulnerability. Your company can then develop a remediation plan that is appropriate to:

• How important the affected systems are to your company.
• The risk that the vulnerability poses.

This remediation plan entails deciding on a timeframe and a procedure to apply the relevant security patch, ideally without affecting end users. The appropriate timeframe for applying the patch may differ from one system to another, or one vulnerability to another.

Example of a remediation plan: Implementing auto-updates or periodic updates during maintenance windows

Depending on your company’s remediation plan, it might make sense to turn on automatic updates (where available) for any non-system-critical software to ensure that your systems are always up-to-date. This way, you will always have the latest security patch applied to your system.

For example, suppose your company has an internally developed customer-facing application like a banking website, which relies on a third-party application (e.g. hosted at “application.com”). On this website, when your banking customers attempt to log in, the banking website will check that the customers’ credentials are valid by getting data from application.com at a particular URL (e.g. “application.com/get/customerData”) in a particular format. This process of getting data is known as an “API call”.

However, such an automatic update might cause “breaking changes” to your internally developed software that relies on the third-party application. This means that some functionality of your software no longer works due to the changes made in the update.

An automatic update to the third-party application might then change the URL (e.g. to “application.com/customer_data” instead) or change the format of the data, meaning the API call would not work. This would cause your customers to be unable to log into your site (this is an example of a “breaking change”).

To mitigate these effects, your company might wish to implement and notify your users of scheduled or ad hoc maintenance periods. You can then safely apply updates without adversely affecting users who rely on your services.

What if no patch is available?

If your company discovers a vulnerability for which no patch is available (e.g. it is a new or ‘zero-day’ vulnerability), your company should mitigate the risks that the vulnerability poses.

One way to do so is to use appropriate network security devices (like Web Application Firewalls) to detect, intercept and/or drop potentially malicious web requests that are targeted to exploit the vulnerability.

You may also wish to consult any vendors (e.g. for your software or databases) that you are working with to see if they have any workarounds specific to their service.

3. Establishing baseline security standards

Requirements:

• The FI must ensure there is a written set of security standards for every system.
• The FI must ensure that every system conforms to these security standards.
  • If the system is unable to conform to these security standards (e.g., if the security standards require that all applications be cut off from the public Internet, but the application in question requires an Internet connection), the FI must ensure controls are put in place to reduce any risks.

MAS has stated that a company can refer to internationally recognised industry best practices from the Center for Internet Security (CIS) and the National Institute of Standards and Technology (NIST).

Some of the best practices from CIS (e.g. the CIS Controls) are similar to the MAS requirements like monitoring administrative privileges on computers, applications and networks, as well as establishing boundary defence They also include other best practices like maintaining an inventory of all hardware and software assets, and monitoring audit logs.

What if a system cannot comply with the standards?

If a system cannot comply with security standards, your company should institute appropriate risk mitigation controls.

For example, one way your company can mitigate the risks posed is by implementing a transparent proxy between the third-party service and the Internet. This allows you to intercept traffic, as well as audit and inspect all the data sent by the third-party service to the Internet. In doing so, this ensures that none of your company’s data is compromised.

4. Implementing network perimeter defences 

Requirement: The FI must put in place controls at its network perimeter to restrict all unauthorised network traffic.

The network perimeter refers to a boundary between the public-facing side of a network and a company’s private network (sometimes known as the De-Militarized Zone). For example, if you are a bank offering an online banking service, your web or mobile application that the customers use to access your banking services is the “public facing” side that customers can access through the Internet. However, the applications will likely retrieve and make changes to a database that is in your private network or Intranet. 

You may also have firewalls and Intrusion Detection Systems that guard this border between the public and private networks. All these constitute your “network perimeter”.

To meet the requirement to defend its network perimeter, your company should implement network security devices at the network perimeter. Such network security devices serve to monitor incoming and outgoing traffic at the border between your system and the outside world, maintaining the integrity of your system.

5. Implementing anti-malware measures

Requirement: The FI must ensure that one or more malware protection measures (e.g. antiviruses) are implemented where it is possible to do so.

Such anti-malware measures may include installing anti-virus solutions. The type of solution to be installed would vary, depending on the type of system to be safeguarded and the IT environment they operate in.

Your company may also need to implement measures at the endpoints (e.g. laptops and desktops that can access your internal network through VPN tunnels), email gateway or internet gateway to mitigate any risk of malware infection.

6. Strengthening user authentication

Requirement: The FI must ensure that multi-factor authentication is implemented for all administrative accounts and all accounts used by the FI to access customer information through the Internet.

Multi-factor authentication refers to requiring multiple methods to authenticate a user. Generally, it utilises two or more independent categories of credentials: 

1. What the user knows (e.g. passwords)
2. What the user has (e.g. a security token generated by a hardware device or mobile application)
3. Who/what the user is (e.g. by scanning the user’s fingerprint or face)

Your company should implement multi-factor authentication (e.g. where a one-time password generated by a hardware device or mobile application is required to log in) for administrative accounts on all its critical systems. This should be done even if these accounts are restricted to your company’s internal network. This is because passwords can be compromised by insiders as well as external intruders who can gain access to the internal network.

While not a strict requirement under the MAS Cyber Hygiene Notice, it is also prudent to enforce a password policy. This will make it harder for attackers to simply guess account passwords or to use passwords obtained in data leaks. Examples of some password policy best practices include setting password complexity requirements (e.g. passwords to contain at least 8 characters and a special character) and a password expiry date at regular intervals.

Exceptions to Compliance Requirements with the Notice 

Your company does not need to comply with any of the 6 requirements above if:

• Your company cannot exercise direct control over that system to ensure compliance with the relevant requirement;
  • For example, if your company is the developer of a customer-facing web application that is hosted on your own servers, your company can exercise direct control by having your system administrators secure the servers, and by having your developers make changes to the application code if necessary.
  • If instead, the vulnerability arises in a third-party system, your company does not have direct control that system, because your company has no direct authority to ask the third party’s system administrators or developers to make the same changes.
• Your company cannot exercise indirect control over that system by requiring the system provider to ensure compliance with the relevant requirement; and
  • For example, your company may have a service agreement with a third-party software provider that makes your security requirements and policies binding on that provider. In this case, you would have indirect control over the system.
• It is not reasonable for your company to procure an alternative system provider that your company can exercise indirect control over to provide the system.

Reporting Obligations on Compliance with the Notice on Cyber Hygiene

If your company is required to comply with the Notice, then it does not need to submit an attestation or audit on its compliance with the Notice on Cyber Hygiene to MAS. Instead, MAS expects that your company will report to its senior management on the state of its compliance with the requirements of the Notice.

MAS will review the extent of your company’s compliance with the Notice as part of its supervisory process.

Failure to Comply with the Notice on Cyber Hygiene

The Notice on Cyber Hygiene is legally binding. This means that a failure to comply with the Notice is an offence that is punishable by law.

The penalty depends on the type of FI your company is. For example, a bank that fails to comply with the Notice on Cyber Hygiene is liable to a fine of up to $100,000 and a further $10,000 for every day or part of a day during which the non-compliance continues.

On the other hand, a credit card provider that fails to comply with the Notice on Cyber Hygiene would instead be liable to a fine of up to $25,000 and a further $2,500 per day or part of a day of non-compliance.

In more serious cases, MAS may revoke your company’s licence to carry out financial services.

Apart from the legal consequences, a failure to maintain cyber hygiene could leave your systems vulnerable to malicious attacks from internal and external sources. This might lead to other adverse consequences like personal data breaches, an interruption in services provided, and/or financial losses for your company and customers.

Such a breach could also lead to your customers losing trust in your company and choosing to engage an alternative financial service provider instead.

—

It is important to maintain cyber hygiene to prevent the loss of your customers’ data, money, and most of all, trust. Maintaining and monitoring your company’s cyber hygiene would also ensure that your company will be well-equipped to prevent breaches and handle any security threats as they arise.

A corporate lawyer may be able to assist your company by assessing your company’s current cybersecurity risks and providing advice on how to ensure full compliance with MAS’ cyber hygiene requirements (provided you are legally mandated to comply with the notice).

You may engage one of our corporate lawyers here.