Malaysia could be vulnerable to hybrid cyberattacks, say experts [WATCH]

KUALA LUMPUR – Security experts have warned that while Malaysia may be able to withstand individual cyberattacks, its capacity to handle a sustained, multi-sector assault remains unclear. The concerns stem from weaknesses in coordination, preparedness, and recovery that could leave critical national infrastructure vulnerable. As the country's digital economy expands, its data-center industry grows, and its geopolitical standing bolsters its appeal as a target, these experts argue.

Cybersecurity practitioner Murugason R. Thangaratnam explained that cyberattacks could encompass ransomware, data theft, espionage, and supply-chain compromises by both state actors and hacktivists. Although the recently enacted Cyber Security Act 2024 has laid a framework for safeguarding National Critical Information Infrastructure (NCII), Thangaratnam believes preparedness remains uneven.

He asserts that Malaysia can likely endure most single incidents, but a sustained, multi-sector attack – which constitutes the essence of 'hybrid' cyberattacks – would put coordination, talent, and recovery capacity to the test.

Former CyberSecurity Malaysia chief executive officer Datuk Dr Amirudin Abdul Wahab noted that Malaysia has laid an important foundation with the establishment of the National Cyber Security Agency, the NCII framework, and the National Cyber Crisis Management Plan. However, he cautioned that possessing legislation, institutions, and security technologies does not automatically guarantee operational readiness.

Abdul Wahab emphasized that a disruption in one sector could cascade into others, as banking systems rely on telecommunications, telecommunications depend on energy, and government services hinge on cloud and network infrastructure.

To address these concerns, Abdul Wahab proposed conducting an urgent 90-day cyber resilience audit of critical national systems. The audit would focus on whether attackers could traverse networks, disrupt operations, and compromise recovery systems. The cybersecurity professional Dr Mohamed Anwer Yusoff reinforced the notion that recent incidents, such as the cyberattack on Tanjung Pelepas Port, the attack on Tabung Haji, and the reported compromise of public LED display screens in Kluang, Johor, underscore vulnerabilities that exist within connected infrastructure, technology vendors, and supply chains.

Yusoff stressed that national preparedness should be gauged by the ability to swiftly detect intrusions, contain damage, maintain essential services, and restore operations within acceptable timeframes.