21 January 2022

For the past two years, the Asia-Pacific (APAC) region, like the rest of the world, has seen a huge digitalization leap as a result of the pandemic. Given the haste and urgency, cybersecurity measures have taken a back seat, resulting to some high profile ICT supply chain attacks last year.

The world has seen some high profile incidents where cyber criminals took advantage of the weaknesses of ICT vendors, and used them as attack launch pads where many other targets in one fell swoop. Global cybersecurity company Kaspersky sees this trend to continue as cybercriminals try to further monetize this threat.

Commenting on the trend, Eugene Kaspersky, CEO of Kaspersky, said: “In the last two years there has been a new wave of attacks that exploited critical vulnerabilities in the ICT supply chain. As threat actors evolve their techniques and tactics, we should expect supply chain attacks to be a growing trend in 2022 and beyond.”

To map out the possible solutions to beef up the ICT supply chain resilience in the region, Kaspersky held its fourth APAC Online Policy Forum gathering distinguished industry and policy expects including:

• Shri Rajeev Chandrasekhar | Minister of State in the Ministry of Electronics and Information Technology; and Ministry of Skill Development and Entrepreneurship, India
• Dato’ Ts. Dr. Haji Amirudin Abdul Wahab | Chief Executive Officer of CyberSecurity Malaysia
• Pratama Persadha | Chairman of Communication & Information System Security Research Center (CISSReC), Indonesia

Echoing Kaspersky’s note, Dato Amirudin explained, “The number of attacks on those working in the supply chain has increased, heavily targeted, more vulnerable and at risk than ever before. Supply chain attack is difficult to handle due to its malware design which stays hidden among the infected system and user’s device. Especially in today’s environment, nations are slowly recovering from the pandemic and starting to move towards digital transformations.”

He also noted, during the forum, the need to include awareness and education across all sectors involved in ICT supply chain, including small and medium enterprises (SMEs) which do not have the budget and asset to invest in improving their cybersecurity defenses.

For his part, Dr. Pratama Persadha, added, “Resilience is all about resistance and recovery. One way for both government and non-government stakeholders to minimize these risks is to improve cybersecurity capabilities, which will subsequently improve ICT supply chain resilience,” he says.

“However, this will be constrained if all relevant parties do not improve the cybersecurity of their systems. The main obstacle is the lack of understanding surrounding the importance of cybersecurity to increase ICT supply chain resilience. In the end, stakeholders must consider significant investment to increase the overall standard of cybersecurity to improve the resilience of the ICT supply chain,” Dr. Persadha explained.

Cross border collaboration

Speakers at the forum also agreed on the need for intelligence sharing and international cooperation to secure nations, organisations, and individuals in APAC and beyond.

“The responsibility of securing the ICT supply chain and ensuring safe and trusted internet space is something that the Indian government accords high priority to. Core part of the strategy is cross border collaboration with all stakeholders to ensure protection and resilience of the tech space and ICT supply chain,” noted Shri Rajeev Chandrasekhar.

An active advocate of cross border collaborations and building cybersecurity capabilities, Kaspersky has been working consistently with its partners to raise awareness and propose actionable steps for the global community, done in forums such as the recent Paris Call for Trust.

The global cybersecurity company has also established its baseline standard of cybersecurity through Global Transparency Initiative which includes a number of actionable and concrete measures that the company takes to welcome others to validate and verify the trustworthiness of our products, internal processes and business operations and Security in Cyberspace.

Explaining possible solutions, Kaspersky says short-term and long-term strategies should be look into by both government and private sectors.

Short term solution includes improving procedures and regulations on ICT supply chain infrastructure. Kaspersky cited companies certifying supply chain partners to lessen attacks close to zero. The role of government regulations also play a key role in this as in the case of critical infrastructure.

Eugene Kaspersky added: “The long term solution is to make systems immune. This means the system being designed in such a way that even if an ICT supply chain component is vulnerable, it cannot affect the rest of the system. Even if there is a zero-day or any other vulnerability somewhere in the supply chain, it doesn’t carry over into other components in the chain.”