Cyber threats to Malaysia now extend beyond data theft to daily disruption, Nacsa says

KUALA LUMPUR, Nov 10 — The threat of cyberattacks in Malaysia has expanded past data theft, now encompassing daily disruptions to essential public services, according to National Cyber Security Agency (Nacsa) Chief Executive Dr Megat Zuhairy Megat Tajuddin. He noted that cybercriminals are increasingly targeting industrial control systems within sectors like healthcare, energy, water supply, and supply chain, with recent incidents in Europe providing stark examples.

These attacks, designed to cripple supermarket operations and medical refrigeration systems, illustrate how cyber threats are targeting fundamental services. Dr Megat Zuhairy highlighted the growing influence of artificial intelligence (AI) in intensifying the scale, speed, and impact of cyberattacks globally, warning that Malaysia is not immune to this trend.

To mitigate these risks, Nacsa advised National Critical Information Infrastructure (NCII) entities to isolate critical operational systems from the internet and frequently update their service continuity plans. He emphasized that while no system is entirely invulnerable, preparedness and quick recovery can significantly lessen the impact of an attack.

Legally, the Cyber Security Act 2024 (Act 854) mandates stringent security practices for NCII entities, while Nacsa has provided guidelines for other organizations to bolster their preparedness, early detection, response, and service continuity. The recent decision by the National Security Council (MKN) to elevate the National Cyber Threat Level (NCTL) from Low to Moderate on Nov 4 was a precautionary stance, according to Dr Megat Zuhairy, indicating a proactive measure rather than a sign of an impending crisis.

He instructed sector leads and NCII entities to bolster monitoring and submit weekly reports to Nacsa, even without reported incidents. He stressed that cybersecurity is a shared responsibility, urging all individuals to adopt secure practices and avoid disseminating unverified information. To enhance future defenses, Dr Megat Zuhairy advocated for accelerated threat intelligence sharing between government and industry, fostering local talent development, leveraging technology-assisted monitoring including AI, conducting routine training and incident simulations, and establishing the Cyber Security and Cryptology Development Centre (CSCDC) to bolster the nation's cyber capabilities.