Promoting a Culture of Cyber Security – Malaysia Case Study · Title: ITU Regional Cybersecurity Forum - Brisbane, Australia Author: Philip Victor Subject: Promoting a Culture of

An Agency Under

Promoting a Culture of Promoting a Culture of Cyber Security Cyber Security –– Malaysia Malaysia

Case StudyCase Study

Philip VictorPhilip Victorvphilip[at]cybersecurity.my

Head, Training & OutreachCyberSecurity Malaysia

Securing Our Cyberspace

Who Are We?Who Are We?

• Started in 1997 as Malaysian Computer Emergency Response Team (MyCERT)

• In 2001 assumed a larger role in protecting Malaysia’s Cyber Space, known as National ICT Security & Emergency Response Centre (NISER)

• In 2005, Established as a Company Limited by Guarantee under the purview of the Ministry of Science, Technology & Innovation

• In 2006, assumed role as the national cyber security agency

• In 2007, given additional mandate and renamed as CyberSecurity Malaysia

Everyone MattersEveryone Matters

Outreach

PublicSector

PrivateSector

Communities

OutreachOutreach

Promote safe & responsible online behaviour

Promote best practices & positive use of the Internet

To be aware of current online threats & dangers

Reaching out to all Internet users

CoCo--operation & operation & CollaborationCollaboration

ISPs for home users

Public-Private co-operation for organisations (roadshow, portal, etc)

Ministry of Education & other relevant ministries for schools

Reaching out to all Internet users

An Agency Under

CyberSecurity MalaysiaCyberSecurity Malaysia’’ssInitiativesInitiatives

The National Cyber The National Cyber Security PolicySecurity Policy

Designed to facilitate Malaysia’s move towards a knowledge-based economy

(K-Economy)

Formulated based on framework comprising:

1) Legislation and Regulatory2) Technology3) Public-Private Cooperation4) Institutional5) International

NATIONAL CYBER NATIONAL CYBER SECURITY POLICYSECURITY POLICY

Focus Area Focus Area –– 10 Critical National 10 Critical National Information InfrastructureInformation Infrastructure

CyberSecurity CyberSecurity MalaysiaMalaysia

Banking and

FinanceNational Defense and Security

Emergency Services

Government

Health ServicesWater

Transportation

Energy

Information and

Communication

Food and Agriculture

The 8 Policy ThrustThe 8 Policy Thrust

INTERNATIONAL COOPERATION

COMPLIANCE &ENFORCEMENT

CYBER SECURITY EMERGENCY READINESS

RESEARCH & DEVELOPMENT TOWARDS SELF-RELIANCE

CULTURE OF SECURITY & CAPACITY BUILDING

CYBER SECURITY TECHNOLOGY FRAMEWORK

LEGISLATIVE & REGULATORY FRAMEWORK

EFFECTIVE GOVERNANCE

NATIONAL NATIONAL CYBER CYBER

SECURITY SECURITY POLICYPOLICY

An Agency Under

Information Security Information Security Competency DevelopmentCompetency Development

To create knowledge workers through skill development programs and professional

certification in Information Security

Information Security Information Security Professional CertificationProfessional Certification

15171 203

50100150200250

2005 2006 2007

Information Security Professionals in Malaysia

(ISC)2SANSDRI/BCIISACA

Professional DevelopmentProfessional Development

2005 2006 2007

Skill Developement for IT Professionals

TrainedProfessionals

Other InitiativesOther Initiatives

• CyberlawComputer Crime Act 1997

Digital Signature Act 1997

Copyright Act 1997

Communications & Multimedia Act 1998

Telemedicine Act

StandardsStandards

• Promotion of information security related standards to public & private sectors for greater adoption:

ISO27001/ISO17799

BCM Standard

Common Criteria

An Agency Under

CyberSecurity MalaysiaCyberSecurity MalaysiaOutreach ProgramsOutreach Programs

To build a culture of security through awareness programs to target groups (kids/teenagers,

parents/professionals & organisations)

CYBER SECURITY AND INTERNET SAFETY AWARENESS CAMPAIGN

Poster

Publication

Exhibition & Road Show

Video clips

Safety GuideOther

industry partners

Content Partners

International CERT

Communities

Content Channels

Children / students

Parents/home users

Organizations

Target Audience

Content Localization & Packaging

Outreach ProgramOutreach Program

Critical Information Infrastructure Protection Awareness Workshop

INFOSEC.my Information Security Annual ConferenceINFOSEC.my Information Security Annual Conference

INFOSEC.my Knowledge Sharing SessionINFOSEC.my Knowledge Sharing Session

Reaching out to the schools & communities

Awareness Portal Awareness Portal –– www.esecurity.org.mywww.esecurity.org.my

(schools, public & organisations)(schools, public & organisations)

Awareness PostersAwareness Posters

Information Security Information Security Newsletter Newsletter (quarterly publication)(quarterly publication)

Awareness MessagesAwareness Messages

Information Security Information Security BrochuresBrochures

Parent’s Guide to Internet Safety Teenager Guide to Internet Safety

Awareness VideosAwareness Videos

Email & SpamEmail & Spam Safe ChattingSafe Chatting

Cyber StalkingCyber StalkingCyber Stalking

Safe Internet BankingSafe Internet BankingSafe Internet Banking

Exhibition & Road ShowExhibition & Road Show

Lessons Learnt & ConclusionLessons Learnt & Conclusion

• Information security strategies must cover all user groups

• Public-private co-operation is crucial in building a security culture

• Security is everyone’s responsibility and starts at the top management

• Adoption of international standards and best practices is crucial in creating the competitive advantage (e.g. ISO 17799)

• Awareness & education must be deployed throughout the organisations and include all vendors & and alliances

An Agency Under

Level 7, Level 7, Sapura@MINESSapura@MINESNo. 7, Jalan Tasik, The Mines Resort CityNo. 7, Jalan Tasik, The Mines Resort City

43300 Seri Kembangan, Selangor Darul Ehsan, Malaysia43300 Seri Kembangan, Selangor Darul Ehsan, MalaysiaTel: +60 3 8992 6888 Fax: +60 3 8945 3205Tel: +60 3 8992 6888 Fax: +60 3 8945 3205

MyCERT: Tel: +60 3 8992 6969 / Fax: +60 3 8945 3442MyCERT: Tel: +60 3 8992 6969 / Fax: +60 3 8945 3442training[at]cybersecurity.org.mytraining[at]cybersecurity.org.my

Thank YouThank You

Website: http://www.cybersecurity.org.myFor General Inquiries: info@cybersecurity.org.myE-security: http://www.esecurity.org.myMyCERT: http://www.mycert.org.my

Promoting a Culture of Cyber Security – Malaysia Case Study · Title: ITU Regional Cybersecurity Forum - Brisbane, Australia Author: Philip Victor Subject: Promoting a Culture of

Documents

Promoting Culture

Promoting Philippine Culture and Values

Promoting Safety Awareness with Just Culture: Case study ...

PROMOTING A CULTURE OF THINKING

Promoting a Culture of Safety and Health Work Environment

Promoting a Customer Success Culture

PROMOTING A LEARNING ORGANISATION CULTURE IN … ·...

ORGANIZATIONAL BEHAVIOR & WORKPLACE SAFETY: PROMOTING A...

Promoting a positive culture - IOSH

Promoting Maritime Culture to the International Community

Promoting School Culture at ACPS

Promoting good governance - Walmart · Promoting good...

Promoting a Culture of Constitutionalism and Democracy in...

Promoting a security culture in your organisation

ANNUAL REPORT 2013–14 - Museum of Brisbane · for...

Promoting a culture of s...ne news and classifieds