2. Cybersecurity

Podcast Beta

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is included in the definition of a data breach?

Unauthorized destruction of personal data (correct)

Authorized alteration of personal data

Unauthorized access to personal data (correct)

Loss of data without any unauthorized access

Which aspect of responsibility falls on the data controller regarding data intermediaries?

Implementing governance measures via contract (correct)

Managing user access levels

Conducting data encryption

Performing physical security audits

Under section 24, who bears the primary responsibility for processing personal data?

Data controllers only

Both data controllers and intermediaries equally (correct)

Data intermediaries only (correct)

No specific responsibility is assigned

Which of the following is NOT considered a technical measure that a data intermediary might implement?

Public access policies Signup and view all the answers

What constitutes the physical measures in data protection as per the context provided?

Proper disposal of physical documents Signup and view all the answers

What was a major motivation for organized crime in cyberattacks?

Profit from criminal activities Signup and view all the answers

Which type of malware is known to have affected 65% of organizations in Singapore in 2021?

Ransomware Signup and view all the answers

Which of the following types of cyber threats is typically aimed at theft of personal information?

Phishing Signup and view all the answers

What prominent factor contributed to the necessity of regulating cybersecurity?

Significant rise in cyberattacks Signup and view all the answers

Which of the following describes a potential threat from state actors in the context of cybersecurity?

Information harvesting Signup and view all the answers

Which sectoral laws are referenced in the context of cybersecurity?

Telecom and financial laws Signup and view all the answers

Which of the following actions is commonly used by hackers to compromise systems?

Social engineering techniques Signup and view all the answers

Which type of cyber threat involves overwhelming a network to disrupt service?

DDoS attacks Signup and view all the answers

What is the primary purpose of the Cybersecurity Act 2018?

To prevent and manage cybersecurity threats and incidents Signup and view all the answers

Which of the following is included in the definition of a Computer under Section 3?

An electronic, magnetic, or optical data processing device Signup and view all the answers

Which part of the Cybersecurity Act 2018 addresses the appointment of officials responsible for cybersecurity?

Part 2 – Administration Signup and view all the answers

What does the abbreviation 'CIA' stand for in the context of cybersecurity?

Confidentiality, Integrity, Availability Signup and view all the answers

Which of the following best describes a Computer System as per the cybersecurity definitions?

An arrangement of interconnected computers and technologies Signup and view all the answers

Under which provision does cybersecurity service providers fall, according to the Cybersecurity Act 2018?

Part 5 – Regulation of Cybersecurity Service Providers Signup and view all the answers

Which entities are covered under Part 3 of the Cybersecurity Act 2018?

Any critical information infrastructure in Singapore Signup and view all the answers

What is excluded from the definition of a Computer as per Section 3 of the Cybersecurity Act?

Prescribed devices that have not been stated Signup and view all the answers

What must occur for a code of practice or standard of performance to take effect?

A notice must be published regarding its issuance. Signup and view all the answers

What is the consequence of failing to comply with a direction issued by the Commissioner?

It is considered an offence. Signup and view all the answers

How frequently must a CII owner conduct a cybersecurity audit?

At least once every 2 years. Signup and view all the answers

In what scenario must the owner of a CII notify the Commissioner?

For any prescribed cybersecurity incident. Signup and view all the answers

What happens if a provision of a code of practice is inconsistent with the CYSA?

The inconsistent provision has no effect. Signup and view all the answers

What actions may a direction from the Commissioner to a CII owner include?

Compliance with applicable codes and standards. Signup and view all the answers

What is required to be done with the audit report or risk assessment after completion?

Submit it to the Commissioner within 30 days. Signup and view all the answers

What kind of incidents must a CII owner establish mechanisms to detect?

Prescribed cybersecurity incidents. Signup and view all the answers

What do cybersecurity exercises conducted by the Commissioner aim to evaluate?

The readiness of CII owners to respond to incidents. Signup and view all the answers

What is NOT a requirement outlined for a CII owner in a cybersecurity direction?

Hiring external consultants for reviews. Signup and view all the answers

What constitutes a notifiable data breach under the specified regulations?

A data breach likely to result in significant harm or of significant scale. Signup and view all the answers

What is the minimum number of affected individuals for a breach to be considered of significant scale?

500 individuals. Signup and view all the answers

What must a data intermediary do if a data breach occurs while processing data for a data controller?

Notify the data controller without undue delay. Signup and view all the answers

What is the time frame for notifying the PDPC of a notifiable data breach?

As soon as practicable but not exceeding 3 calendar days. Signup and view all the answers

Which of the following statements about notifiable data breaches is incorrect?

Data breaches always require immediate reporting to affected individuals. Signup and view all the answers

What additional obligations may apply to an organization when notifying individuals about a data breach?

Concurrency with obligations to notify any other parties. Signup and view all the answers

What must organizations include in their notification to the PDPC when a data breach is confirmed?

The specific information required by the DBN Regulations. Signup and view all the answers

Which section mentions that a data breach within an organization is not notifiable?

s 26B(4) Signup and view all the answers

Study Notes

Cybersecurity Act 2018

Long Title: An Act to require or authorize the taking of measures to prevent, manage, and respond to cybersecurity threats and incidents, to regulate owners of critical information infrastructure, and to regulate cybersecurity service providers.

Scope

Part 3:
- Applies to any CII (Critical Information Infrastructure) wholly or partly in Singapore
- Applies to any computer or computer system wholly or partly in Singapore
Part 4:
- Applies to activities and service providers in Singapore generally

Key Definitions

CII: A computer or computer system designated under Section 7(1).
Computer: Electronic, magnetic, optical, electrochemical, or other data processing device performing logical, arithmetic or storage functions, including any data storage or communication facility directly related to or operating in conjunction with such device.
- Excludes prescribed devices, currently none.
Computer System: An arrangement of interconnected computers, including:
- An information technology system
- An operational technology system, such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system, or a distributed control system

Key Definitions Continued

Cybersecurity: The state in which a computer or computer system is protected from unauthorized access or attack such that confidentiality, integrity, and availability (CIA) are maintained.

Regulation of CII

The Commissioner may issue or approve Codes of Practice or Standards of Performance for CII.
Owners of CII must comply with the codes of practice and standards of performance that apply to their CII
The Commissioner may amend or revoke any code of practice or standard of performance
The Commissioner must publish a notice of the issuance, approval, amendment, or revocation of a code of practice or standard of performance.

Directions to Ensure Cybersecurity of CII

The Commissioner can issue a direction to the owner(s) of a CII to ensure the cybersecurity of the CII or when deemed necessary or expedient for the administration of the CYSA.
Directions may include:
- Action to be taken by the owner(s) in relation to a cybersecurity threats
- Compliance with any code of practice or standard of performance applicable to the owner(s)
- Appointment of an auditor approved by the Commissioner to audit the owner(s) on their compliance with the CYSA or any code of practice or standard of performance applicable to the owner(s)
Failure to comply with a direction is an offense.

Duty to Report Cybersecurity Incident in respect of CII

The owner of a CII must notify the Commissioner upon the occurrence of a prescribed cybersecurity incident in respect of the CII or any other computer or computer system under the CII owner’s control that is interconnected with or that communicates with the CII.
The owner of a CII must establish mechanisms and processes for detecting cybersecurity threats and incidents in respect of the CII, as set out in any applicable code of practice.
Failure to comply is an offense.

Cybersecurity Audits and Risk Assessments

The owner of a CII must comply with the following:
- At least once every 2 years, carry out an audit to be carried out of the CII’s compliance with the CYSA and all applicable codes of practice and standards of performance (to be done by an approved or appointed auditor).
- At least once a year, conduct a cybersecurity risk assessment of the CII.
The owner of a CII must furnish a copy of the audit report or risk assessment to the Commissioner within 30 days of completion.
Failure to comply is an offense.

Cybersecurity Exercises

The Commissioner may conduct cybersecurity exercises for the purpose of testing the state of readiness of CII owners in responding to significant cybersecurity incidents.

Protection of Personal Data

In relation to data intermediaries and organizations that engage them (data controllers), section 24 applies to both.
The scope of responsibility depends on the extent of tasks to be done by each:
- Processing: The data intermediary must implement necessary technical, physical, and administrative measures.
- Governance: The data controller must implement measures (typically via contract) to govern the data intermediary's protection of personal data.

Data Breach Notification

Data Breach: (a) unauthorized access, collection, use, disclosure, copying, modification or disposal of personal data, or (b) loss of any storage medium or device on which personal data is stored in circumstances where unauthorized access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
Notifiable Data Breach: A data breach that (a) results in, or is likely to result in, significant harm to an affected individual or (b) is, or is likely to be, of a significant scale.

Data Breach Notification Continued

A data breach is deemed to result in significant harm and is deemed to be of significant scale in prescribed circumstances.
Significant Harm: See Personal Data Protection (Notification of Data Breaches) Regulations 2021 (“DBN Regulations”), reg. 3 and Schedule.
Significant scale: 500 (see DBN Regulations, reg. 4)
Notwithstanding the above, a data breach within an organization is not notifiable.

Conducting an Assessment of a Data Breach

If an organization has reason to believe that a data breach has occurred affecting personal data:
- If the organisation is a data intermediary and the affected data is data it is processing for the data controller, the organisation (DI) must notify the data controller of the data breach without undue delay
- If the organisation is a data controller, it must conduct, in a reasonable and expeditious manner, an assessment of whether the data breach is a notifiable data breach.

Notification to PDPC

If an organization assesses that a data breach is notifiable, it must notify PDPC as soon as practicable and, in any case, within 3 calendar days.
Notification to PDPC is to be made via the PDPC website.
The notification must contain the prescribed information, to the best of the knowledge and belief of the organization when the notification is made.
- This information is set out in the DBN Regulations (reg. 5) and the relevant webform on the PDPC website.
Notification to PDPC applies concurrently with any other obligation of the organization to notify any other person.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Explore the key provisions of the Cybersecurity Act 2018, focusing on the regulation of critical information infrastructure and cybersecurity service providers in Singapore. This quiz covers definitions, scope, and critical measures for managing cybersecurity threats and incidents.