Singapore sets up digital defence unit to deal with threats to critical infrastructure

SINGAPORE: A new digital defence unit has been set up to deal with cyber threats targeting Singapore's critical infrastructure.

The new Digital Defence Hub (DDH) is within the Centre for Strategic Infocomm Technologies (CSIT), a technical agency in the Ministry of Defence.

The unit will focus on providing advanced cybersecurity services and capabilities to the whole-of-government to counter sophisticated cyber threat actors known as advanced persistent threat (APT) groups, CSIT said in a news release on Friday (Oct 17).

APTs are highly skilled, well-resourced and usually state-linked.

The hub was announced by Coordinating Minister for National Security K Shanmugam during the third edition of the CSIT's annual closed-door technical conference, TechCon.

COUNTERING ADVANCED THREATS LIKE UNC3886

In July, Singapore uncovered an APT identified as UNC3886, which attacked the country's critical information infrastructure.

Mr Shanmugam said at the time that the threat actor posed serious danger to Singapore and could undermine national security.

During his speech at TechCon on Friday, the minister noted that suspected APT attacks on Singapore increased more than fourfold between 2021 and 2024.

He also pointed to the Russia-Ukraine war, where APTs took down critical infrastructure and caused widespread power outages ahead of physical attacks.

Mr Shanmugam, who is also Minister for Home Affairs, said every sector has gone digital: national digital ID Singpass powers more than 2,700 digital services, while critical infrastructure such as energy and healthcare also runs on digital networks.

Apart from APTs, there are also other forms of digital threats, such as ransomware, digital scams and many that leverage artificial intelligence (AI).

"Challenges are continuing to grow, and it's very clear we all have to up our digital defence. It's a critical priority," said Mr Shanmugam.

He also spoke of the need for collaboration to uncover the activities of attackers.

To this end, the Digital Defence Hub will work with and support government agencies such as the Cyber Security Agency with its technical expertise to monitor and investigate APTs targeting Singapore’s government systems and critical infrastructure.

This will be done through cyber threat research; malware analysis; threat hunting to proactively search for previously unknown or ongoing cyberthreats in organisations' networks; and red teaming, which involves simulated cyberattacks on computer systems.

For malware analysis, CSIT developed the Automated Malware Analysis and Attribution System – or ACUBE – that significantly reduces the time taken to analyse malware.

It also has a threat detection system that uses CSIT's threat insights for effective detection and proactive hunting of cyber threats across networks.

CSIT's chief executive Darren Teo noted that close collaboration with industry partners is essential as the digital and cyber space is vast and globally interconnected.

"The government needs to partner industry to counter threat actors who could be operating from anywhere in the world," he added.

"Through the DDH, CSIT will provide a platform to collaborate in building capabilities and sharing intelligence and insights to better safeguard our digital space."