Asia-Pacific seriously lagging rest of world on cyber risk – report

Asia leads the world in internet usage, but continues to seriously lag behind the rest of the world in its approach to cyber security, according to a new report from security consultancy Control Risks. The firm’s latest Cyber Security Landscape report concludes that there are two big problems in the Asia Pacific region when it comes to cyber security. First, Asia-Pacific companies still view cyber security as a basic compliance matter rather than a fundamental business risk. Second, and presumably as a result of the above, companies in the region are aware that they are under threat but have low capacity to identify the threats coming their way. The focus on compliance in the region was made obvious by the fact that Control Risks found that when Asia-Pacific (excluding Australia) companies measure the success of their cyber programme, some 42% of respondents in the region benchmark against whether it meets the latest regulatory requirements. Only a quarter of Australian companies take this approach. “With cyber policy and regulatory landscape in Asia-Pacific (excluding Australia) still largely underdeveloped and unevenly implemented, the struggle to maintain compliance is somewhat unsurprising. In short, the regulations are not strong enough to really enable companies to effectively manage the risk,” concludes the consulting firm. “Solely following the local regulatory standards instead of adopting a more holistic, risk- based approach could leave many companies open to a costly and reputation-damaging breach,” it states. The situation is exacerbated by the fact that cyber security is still not on the board agenda of enough companies in Asia, said Control Risks. It notes that half of the survey’s respondents in Asia say that their organisation’s board does not take cyber security as seriously as it should. The firm adds that one of the main reasons for this is simply a lack of awareness. “In many markets in Asia, companies are not required to publicly disclose a cyber-breach, and a cultural tendency to deal with issues privately results in lost opportunities to learn from peers and implement industry best practice defences,” states the report. Australia is, however, the exception in the region. Control Risks describes the country as a regional and global leader in terms of cyber regulatory developments, implementation and enforcement. “Survey respondents are far more focused on adopting this more holistic approach, treating cyber as a ‘risk issue’ instead of a ‘compliance issue’. This is facilitated by two things in particular: an evolving corporate governance landscape which works to support and improve company performance, and a commitment by business and government to work together to tackle cyber issues,” concludes the report. The survey found that more than nine out of ten organisations in Asia-Pacific have suffered an attempted attack and a similar number of companies are worried that their organisation will suffer a cyber attack in the next year. But unfortunately, the survey found that almost two thirds of organisations in the region are unable to identify where all attempted cyber attacks emanate from. Control Risks asks the obvious question: “When the threat of an attack is so prevalent, why are organisations so ill equipped to identify, and therefore accurately and economically mitigate against, any potential sources of attack?” The consulting firm says this lack of insight among business leaders tasked with their organisations’ cyber security is again a factor. The firm adds, however, that in many cases (particularly in Southeast Asian countries such as Indonesia, Vietnam and Thailand), it is also a result of rapid digitisation, combined with a lack of technically skilled and experienced professionals to implement and maintain an appropriate level of “cyber hygiene”. Control Risks points out that in more developed countries in Asia-Pacific, such as Singapore, sophisticated companies are now leading a shift towards a more strategic focus on “threat actors” and their capabilities. It adds that a number of organisations in the critical infrastructure industries now have in-house threat intelligence teams that focus on the technical, operational and strategic aspects of threat intelligence, enabling them to meet the challenge effectively. “It is only by adopting this threat-led approach to cyber security that an organisation, wherever they might be operating in the world, can really understand the potential impact on the business and adopt the necessary measures to be able to protect it from any potential cyber threats,” states the report. Ben Wootliff, partner and head of cyber security, Asia-Pacific at Control Risks based in Hong Kong, said one of the big problems remains a tendency within companies to still treat cyber risk as an IT problem rather than a fundamental business risk. “Cyber risk is frequently cited as one of the top priorities on a board’s checklist. Yet all too often in practice it is still treated as ‘an IT problem’ instead of a major strategic corporate risk. Without full board-level support, the IT department often finds itself under-resourced, isolated from the rest of the business and without sufficient budget to manage cyber risks effectively,” he commented. Mr Wootliff strongly advised business managers to look at cyber risk in the same way that they ought to look at all other business risks and not get bogged down in the technical details. “Cyber tools and techniques used to attack organisations are often technically complex compared with other corporate threats organisations may face. Nonetheless, it is important that business leaders do not become overwhelmed by this technical complexity and maintain the same strategic approach as with any other corporate risk, starting by understanding the threat landscape,” he said.

Asia-Pacific seriously lagging rest of world on cyber risk – report

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

Related Articles