The Monetary Authority of Singapore (MAS) on 6 August introduced a set of new requirements for financial institutions, aimed at "raising the cyber security standards and strengthen cyber resilience".
Simply named ‘Notice on Cyber Hygiene’, these new mandatory rules outline specific requirements for members of the financial industry, such as insurance brokers, financial advisers, financial holding companies, finance companies, trust companies, capital market entities, banks, among others, to mitigate the growing risk of cyber threats. “Key elements in the existing MAS technology risk management guidelines will also be made compulsory,” MAS said in a statement.
A summary of the requirements follows:
- Establish and implement robust security for IT systems
- Ensure updates are applied to address system security flaws in a timely manner
- Deploy security devices to restrict unauthorised network traffic
- Implement measures to mitigate the risk of malware infection
- Secure the use of system accounts with special privileges to prevent unauthorised access
- Strengthen user authentication for critical systems as well as systems used to access customer information.
These requirements will come into effect on 6 August 2020, and all licensed financial institutions are subject to the notice, MAS said. The rules are also mandatory for payment service providers such as e-wallet providers and cryptocurrency firms.
“Cyber threats in the financial sector are growing as a result of an increased digital footprint and pervasive use of the internet, said MAS chief cyber security officer Tan Yeow Seng. “The financial sector needs to remain vigilant and ensure that defences are able to counter varied and evolving threats. Good cyber hygiene can go a long way in protecting financial institutions from common types of cyber incursions. These fundamental and essential measures can be implemented by all financial institutions regardless of size or system complexity.”
These rules are a result of a consultation paper released by the central bank in September 2018.