{"id":9846,"date":"2021-03-30T13:43:36","date_gmt":"2021-03-30T17:43:36","guid":{"rendered":"https:\/\/www.cscdbs.com\/blog\/?p=9846"},"modified":"2021-11-09T13:58:48","modified_gmt":"2021-11-09T18:58:48","slug":"understanding-the-monetary-authority-of-singapores-revised-technology","status":"publish","type":"post","link":"https:\/\/www.cscdbs.com\/blog\/understanding-the-monetary-authority-of-singapores-revised-technology\/","title":{"rendered":"Understanding the Monetary Authority of Singapore\u2019s Revised Technology Risk Management Guidelines for APAC Companies"},"content":{"rendered":"\n
\"\"<\/a><\/figure>\n\n\n\n

By John Valenzuela, APAC digital brand consultant Share this post <\/strong><\/span> <\/a> <\/a> <\/a><\/p>\n\n\n\n

The financial services sector has always been a forerunner in adopting technology for automation, and to provide better services to customers. The sector has been embracing digital transformation at an accelerated pace, especially with COVID-19, to continue to provide banking services while minimizing physical contact and exposure. As the technology stack of financial institutions (FIs) grow and become more complex, there\u2019s also an increase in their exposure to cyber risks. The methods used by cyber criminals are becoming more sophisticated and severe. Risks include data breaches, fraudulent financial transactions, and disruption of financial services systems.<\/p>\n\n\n\n

In January 2021, the Monetary Authority of Singapore (MAS) has released updated \u201cTechnology Risk Management Guidelines.\u201d It serves as a framework for FIs in Singapore, to ensure due diligence in minimizing cyber risks. The most important elements of the updated memorandum focus on \u201cstrong oversight\u201d of their providers to mitigate third-party cyber risks. These include having:<\/p>\n\n\n\n

  1. The board of directors and senior management play an integral part in the oversight and management of technology risk<\/li>
  2. FIs apply a defense-in-depth approach to strengthening cyber resilience<\/li>
  3. FIs ensure they are working with a provider they can trust<\/li>
  4. A proper inventory of all assets that could pose risks<\/li>
  5. A prevention and redundancy plan against distributed denial of service (DDoS)attacks, man-in-the-middle attacks, phishing and malware, and domain name system (DNS) hijacking<\/li><\/ol>\n\n\n\n

    Singapore has always been at the forefront of cyber resilience to support its ambition as a Smart Nation that is powered by a digital economy. Though it has experienced its fair share of data breaches, Singapore continues to pave the way in promoting best practices in cyber resilience. The latest \u201cSingapore Cyber Landscape\u201d report acknowledges that \u201c[in] line with global trends, Singapore witnessed a rise in cyber threats targeted at various local industries such as eCommerce, banking, and finance\u2026\u201d[1]<\/sup> And the financial services sector will always be one of the main industries targeted by cyber criminals.<\/p>\n\n\n\n

    As FIs have a growing reliance on technology stacks, therein lies a corresponding increase in their cyber risks with their third-party digital asset providers. Their domain names, DNS, and secure socket layer (SSL) digital certificates are still sitting with low-security providers, especially evident in Asia.<\/p>\n\n\n\n

    The findings from CSC\u2019s Domain Security Report 2020\u2014which looked at the security posture of the Global Forbes 2000 companies\u2014showed that 82% of FIs are still at risk because of their providers. In the same report, it observed that 88% of banks are at risk of a basic domain and DNS hijack because they have not implemented registry locks, which prevents unauthorized changes to domain names and DNS records. There is also a huge gap in the adoption of a defense-in-depth approach because there is low adoption of:<\/p>\n\n\n\n