SINGAPORE: Government agencies have rectified about 80 per cent of “high-risk” data security issues that were found in a recent review, and work is under way to introduce new systems to improve user access security, the Smart Nation and Digital Government Group (SNDGG) told CNA.

Findings of the review were released last November, after a Public Sector Data Review Committee inspected 336 systems across 94 public sector agencies. It was part of a major review to better protect the public’s personal data.

In its report, the committee said that about three-quarters of agencies had at least one finding of non-compliance with a government manual on data policies and standards.

Sixty-four per cent of agencies were rated “low-risk”, 23 per cent were rated “medium-risk” and the remaining 13 per cent were rated “high-risk”.

The most common shortcomings found were in the management and monitoring of privileged user accounts, user access reviews, as well as the encryption of emails with highly sensitive data.

The committee’s report did not state which agencies fell under these categories.

READ: Government accepts 5 measures to improve data security, to set up single contact for public to report breaches

The Prime Minister’s Office had announced in March last year that it was forming the committee following several public data breaches.

In July 2018, 1.5 million SingHealth patients’ records – including that of Prime Minister Lee Hsien Loong – were accessed and copied, in what was the most serious breach of personal data in Singapore’s history.

EMAIL ENCRYPTION A TOP PRIORITY

A representative from cybersecurity firm Kaspersky told CNA that the encryption of emails with highly sensitive data should take “top priority”, given that emails are agencies’ preferred mode of communication in today’s digital age.

“Encryption is the basic building block of data security and it is the simplest and most important to ensure that sensitive data does not get stolen and read by someone who may use it for illegal purposes,” said Mr Yeo Siang Tiong, Southeast Asia general manager at Kaspersky.

Safeguarding email communications is also “paramount” to mitigating the risk of data breaches, Mr Yeo added, citing a Deloitte report that said 91 per cent of all cyberattacks begin with a phishing email.

A user infected with malware can allow attackers to intercept and read emails en route from sender to recipient, before extracting any sensitive content, a report by Scarfone Cybersecurity explained.

READ: Confirmation prompts for emails among 13 data security measures to be rolled out across public sector

Following the committee’s findings, the Government has implemented various measures like the use of tools that require public officers to acknowledge and confirm the sending of emails containing sensitive data, said an SNDGG spokesperson.

They are also required to digitally sign and password protect sensitive documents to ensure data in transit are not maliciously modified.

In addition, officers must securely distribute passwords through a separate channel, and use data-sharing platforms like the Singapore Government Document Collaboration to securely send and access sensitive data documents.

READ: Budget 2020: S$1b to be spent on enhancing Government’s cyber, data security capabilities

Since the committee’s report was released, more than 65 per cent of agencies with at least one finding of non-compliance have rectified them, said the spokesperson.

The fixes are validated by the Government Technology Agency, which together with the Smart Nation Digital Government Office make up SNDGG.

Most instances or non-compliance are expected to be rectified by the end of 2021, said SNDGG, except for those related to the updating of user access rights, which includes removing access rights of inactive users.

This will take until end-2023 or end-2024 to implement, as new central systems are needed to automate the checking of user access rights, the spokesperson added.

“Meanwhile, agencies have put in place other mitigating controls, such as 2-factor authentication (2FA), encryption of sensitive data and monitoring of data access logs, to manage the attendant data security risks to ensure that data is secure,” the spokesperson stated.

Kaspersky’s Mr Yeo said the measures “can be quite effective” as a system of information security checks and balances, and are in line with industry best practices.

However, the use of SMS-based 2FA can sometimes be unreliable, he warned, as text messages can be intercepted by a Trojan virus inside the smartphone, or through a basic flaw in the protocol used to transmit the messages.

“In such cases, it would be advisable to use authenticator apps which are entirely self-contained, with the SMS option used only as a last resort to minimise an organisation’s exposure to data breaches,” he added. 

NON-PRODUCTION ENVIRONMENTS COULD BE VULNERABLE

Mr Yeo said the management of extraction of production data to non-production environments is “another key item of non-compliance to pay attention to”.

Production data refer to actual data stored in a system, like personal details. Non-production environments refer to offline systems used during testing and development to prevent interruption to users.

READ: More than a quarter of Singapore residents suffered at least 1 cybersecurity lapse in past year: CSA survey

A report by cybersecurity consultancy UpGuard gave an example of how these two could meet – occasionally, production data are loaded in a non-production environment to help debug a complex issue.

A hacker could exploit this by gaining access to the non-production environment and stealing the production data, the report said.

“Today, a lot of the proprietary data generated and accumulated by organisations are often shared with non-production environments for data analytics, development and other purposes,” Mr Yeo added. 

“While most production environments have established security protocols, the same kind of protocols might not be applicable in a different environment and this creates a vulnerability that could be exploited by cybercriminals.”

CYBERSECURITY EDUCATION KEY TO RESPONSIBLE USER ACCESS

As for user access reviews and the management of privileged user accounts, Mr Yeo said users should be educated on cybersecurity best practices, pointing out that human error appears to be “greatest cause” of cybersecurity breaches.

Users should know not to click on email attachments from unknown senders, avoid the use of unsecure Wi-Fi networks on organisation devices, as well as adhere to an IT code of conduct, he noted.

In its review, the Public Sector Data Review Committee had recommended that officers attend improved data security training every year.

Mr Yeo cautioned that training could become a “rather mundane and ‘tick the box’ activity for organisations”, adding that it should consider how people naturally think and be tailored to different roles.

“Given that employees in the civil service have differing levels of data access and work in different roles, it is important to consider implementing a holistic adaptive framework to cybersecurity education,” he added.

“All three attributes of people, process and technology play a key role in minimising any data breaches arising from user access and the misuse of user privileges.”

INACTIVE USERS HAVING ACCESS A CONCERN

This is also why the updating of user access rights is an area of concern, Mr Yeo said. Under this category of findings, the committee found delays in the removal of access rights of inactive users.

A Kaspersky report released last year showed that one-third of employees continue to have access to files and documents from their previous employers.

“When applied to the context of civil service in Singapore where employees often take up roles in different departments, the updating of user access rights is rightfully a key area of concern where there is a greater need to safeguard sensitive and confidential data that might carry implications for national security,” Mr Yeo said.

“Some potential risks to data security include former employees using the data for their own purposes, sell to interested individuals who are keen to harm the national interest, as well as the fairly innocuous act of corrupting or deleting files by accident on the network.”

TECHNICAL CHALLENGES

Fixing these issues effectively would require a “re-architecture” of existing systems, the SNDGG spokesperson said.

He added that a central identity and access management system will be completed by end-2023 for priority systems, with the remaining systems scheduled for completion by end-2024.

“Some possible challenges in this pertain to the systems’ ability to simplify communication processes across a complex and interconnected system that is expected to monitor and update user access rights on an ongoing basis,” Mr Yeo explained. 

“Generally, this would involve multiple testing phases to ensure that the system is able to deal with the heavy flow of information and compliant with data security measures before it can be officially utilised.”

READ: Committee tasked with reviewing data security practices in public sector holds first meeting

Nevertheless, the agencies have made “quite encouraging” progress on fixing the instances of non-compliance, Mr Yeo said, although he added that both users and processes need to keep up with the technical improvements.

“While it is easier for an organisation to implement the latest cybersecurity technologies, how quick these non-compliances are patched up will also depend on how fast people and processes adapt as well,” he said.

SINGAPORE: How many of us have had bosses with no sense of humour? Working under them can leave us feeling bored and unmotivated. 

On the other hand, if they joke too much, it can be hard to take them (or the job) seriously. 

COVID-19 has changed the face of our work life as we know it. We’re telecommuting, safe distancing, and trying to connect in our virtual teams – yet not enjoying ourselves very much.

According to a COVID-19 mental health survey run by the National University Health System’s Mind Science Centre published on Thursday (Aug 19), 61 per cent of respondents who work from home reported feeling stressed. 

It’s sensible that bosses therefore try harder to lighten the mood and make their teams laugh.

READ: Commentary: Hello COVID-19 remote working, goodbye cult of presenteeism

READ: Commentary: Burned out while working from home? You should check your work-life boundaries

We already know humour in the workplace can be a powerful force. Laughter is associated with higher productivity, better morale and greater rapport at work and has numerous proven health benefits, including alleviating stress, studies have shown. 

You might think these findings do not apply to Singaporeans who seem like serious people who want to get down to business. 

Yet Singaporeans ranked both “happiness” and “humour/fun” in their top 10 personal values as words that best described themselves and their notion of the ideal Singapore society, according to the 2018 National Values Assessment survey.

But here’s the thing about humour: “It’s hard to do well and easy to do badly,” astutely noted by time management guru and author of What The Most Successful People Do At Work, Laura Vanderkam.

We all remember the painful, conspicuous silence of a joke falling flat on its face. Or the obligation to laugh at a bad joke. In other instances, some jokes are just downright inappropriate. 

So how do leaders strike that balance and know when to quit joking around?

WE WANT TO CONNECT WITH COLLEAGUES MORE

Telecommuting is forcing us to take a good hard look at our existing relationships with our coworkers. 

We are devoid of physical connection, feeling the loss of opportunities to connect socially, whether over coffee or a chance meeting at the pantry, and eager to find some level of camaraderie.

We would argue humour isn’t the only way to foster a positive team culture that can withstand COVID-19.

After all, a Work Happy 2019 study by recruitment agency Michael Page showed 97 per cent of Singaporeans feel being on good terms with colleagues and bosses can improve productivity at work. 

This suggests that the answer lies less in humour, but in the intentional strengthening of existing workplace relationships, through having genuine conversations or through team-building exercises.

Rather than crack jokes – which can be tricky because different employees might have different sensibilities and sensitivities regarding humour – we would counsel managers and workers instead to focus on finding ”moments of levity” to bring the team together.

LISTEN: The conversation on race and multiculturalism younger Singaporeans want

READ: Commentary: Who do employers choose to hire if every applicant seems qualified for the job?

Efforts could be at the organisational level – in celebrating a birthday or playing games – or taking personal moments – for instance, being able to laugh at yourself when you make mistakes – which all contribute towards creating a relaxed environment where people feel safe, supported and heard. 

Even when running our Zoom workshops with clients, we encourage check-ins and check-outs to encourage listening and team-bonding separate from work-related matters. 

BUILD A STRONGER CONTAINER

We often advise executives we coach to visualise the goal at the end of the day as one that “builds a strong container” for the team.

Coined by the founder of consulting firm Dialogos and author of The Power of Collective Thinking, William Isaacs, a container is “the sum of the assumptions, shared intentions, and beliefs of a group … (which) creates a collective atmosphere or climate”.

Strong containers can withstand the winds of change in the workplace, while weak containers break when external pressures are exerted on the team.

A strong container can be built through talking and thinking through projects, challenges and issues together as a team, which establishes understanding even if workers have diverse perspectives, priorities or roles. 

Doing this requires leaders to suspend judgment and listen to concerns and ideas, which can be challenging when managers are used to a directive leadership style and often lead from the front. 

Those who are competitive and set high standards can be intimidating to staff, but in our experience, this is when such moments of team discussions where managers demonstrate they care about their teams and see their team-mates as more than number-crunching digits are most appreciated.

READ: Commentary: COVID-19 could make remote working a permanent feature. That has several implications for firms

LISTEN: Disruption 101: How COVID-19 is revolutionising work

WHEN TO LAY LOW ON THE HUMOUR

At the end of the day, humour can be a valuable asset if channelled constructively to ease tensions at critical, peak periods, set the tone for the organisation and make leaders more human and relatable.

When considering humour through the lens of strengthening the container, it helps to be mindful of three key guidelines: Personalities, authenticity, and no-go zones.

First, be mindful that workers have different personalities in the office. Not all employees enjoy laughing and joking with their bosses. 

Some may prefer to maintain a strictly professional relationship with their leaders. This boundary should be respected.

Second, don’t use humour if it feels contrived or even forced. When many people are looking to you for direction, it’s better to remain authentic to ourselves and develop a healthy sense of self at work. 

A leader with a healthy sense of self might say, “I know I don’t naturally crack jokes, but I know other ways to foster engagement with the team.”

Finally, keep in mind the no-go zones and red lines in the sand that should never be crossed. Remember that racist, sexist, immoral, and dirty humour have no place in the office or any other spaces. 

2020 has been a whirlwind of a year. Now, more than ever, we need strong business communities anchored by solid ties and good communication. 

Bosses don’t need to joke to create strong interpersonal relationships in the workplace. They just need to find fresh ways to bring teams together in a world of remote working.

Dr Lily Cheng and Dr Peter Cheng are the co-founders of PACE OD Consulting, an organisational development consulting firm. They have coached leaders and guided teams throughout Asia, Europe and the United States.