AI cyberattacks mean we can't defend ourselves the same way as before: Singapore's founding cybersecurity chief

Mr David Koh looked back on his time as chief executive of the Cyber Security Agency of Singapore, in his first exclusive media interview since retiring on Jul 1.

SINGAPORE: A burglary is happening in your home right now. You can’t see the intruders – you don’t know who they are, how they got in, what they have taken and how many of them lie in wait.

You realise something is wrong when the front door, which you locked when you left, is mysteriously unlatched when you return. You aren’t sure how long it’s been open.

You look for signs of a mess or forced entry so you know which rooms the intruders went into and what they sought. But they are skilled – they cleaned up after themselves, and there is almost no trace.

You install a new lock, thinking this will fix the problem. The next day, your home is broken into again.

You need to alert your neighbours so you can take steps to secure the whole building. But once you make this incident public, the intruders will know you’re on to them and take more evasive action.

What do you do next?

Raise these stakes to a national level, with repercussions for Singapore’s security, economy and way of life, and you have a sense of the decisions that Mr David Koh has weighed as founding chief of the Cyber Security Agency of Singapore (CSA).

With artificial intelligence, it fundamentally changes the parameters of this “cat-and-mouse game”, Mr Koh told CNA in an exclusive interview after his retirement.

The 61-year-old stepped down in July after 42 years of public service, with the last 11 years at the helm of Singapore’s first cybersecurity agency.

Most cyberattacks that CSA investigates are not technologically sophisticated, but happen through human error, carelessness or social engineering, said Mr Koh.

Singapore has not yet been the target of an AI-enabled cyberattack, he said. But the country’s cyberdefenders must grapple with the impact of the technology.

Cyberattacks today are “handcrafted” and require human innovation, imagination and technical competence to exploit vulnerabilities.

“All of this is held together by a handful of people with the skillsets to do this. Skillsets are rare, hard to come by. So consequently, the amount of damage that these people can do is limited by how hard they work,” said Mr Koh.

AI can automate the process of identifying and stringing together cyber vulnerabilities – a weak hinge here, a loose lock there – to open a door.

This could shorten the time taken to construct cyberattacks from weeks and days, to hours and even minutes, amplifying their speed and scale, he said.

AI can also potentially widen the field of targets by disrupting “security by obscurity”.

Given the time and effort needed to construct a cyberattack, perpetrators typically maximise their “return on investment” by developing attacks that can be replicated on as many targets as possible, said Mr Koh.

This leads them to focus on attacking computer systems that are widely used, while older or proprietary systems fly under the radar by virtue of their rarity.

AI makes it less costly to attack rarer systems, said Mr Koh, citing the operational technology systems running essential services such as power plants, electrical grids and train systems, as examples.

“You typically find that these kinds of attacks are only done by very sophisticated, targeted, well-resourced agencies who have a specific reason they want to target this power plant. So typically, it’s a state attack.

“With the age of AI, these kinds of attacks become easier to do,” he said.

AI capabilities mean that the current industry standard of two to three weeks to develop a security patch for a newly discovered vulnerability may no longer be reasonable.

To respond more quickly, defenders may also need continual monitoring of computer systems, instead of relying on annual security audits.

“We need to be aware that the world is changing. How we used to organise, how we used to operate, how we used to defend ourselves cannot remain the same,” said Mr Koh.

This requires board-level attention, and is why CSA has tasked senior leaders of critical information infrastructure to review their cybersecurity set-ups, he added.

A few days after CNA’s interview, OpenAI disclosed that some of its most advanced AI models managed to break out of a controlled testing environment and hack into an AI start-up to achieve a testing goal.

CRISIS COMMUNICATIONS

Before he was Singapore’s founding cybersecurity chief, Mr Koh served in the Singapore Armed Forces and the Ministry of Defence.

He took on various appointments as defence cyber chief, deputy secretary for technology, director of military security and chief signals officer.

It is harder to galvanise people around cybersecurity, compared with traditional security, said Mr Koh, because the consequences of a cyberattack are not as visible as a physical attack that destroys buildings and injures people.

Another key difference is the porous nature of borders in the digital domain.

“It’s not clear where your national borders extend to. It’s not clear where your infrastructure is sitting. It’s not clear whether things that are happening are coming from within your borders or coming from outside.”

Cybersecurity stakeholders are not only governments or government-linked, but can be private companies, and attacks can more directly impact individual civilians.

This was what happened with the SingHealth breach in 2018 – a major test of the fledgling CSA three years after its founding.

Hackers infiltrated the healthcare provider’s systems and obtained the medical data of 1.5 million patients, while repeatedly targeting then-Prime Minister Lee Hsien Loong’s records.

Mr Koh recalled a “very compressed” period in which CSA had to establish more information before it could go public and notify affected patients.

“In order to inform them and put in place the actions, we first have to have confidence we know what happened exactly. Second, we know how to stop it. And third, we can tell the public definitively, this is what was compromised,” he said.

“I recall there were about 10 days that we had to determine all of these things in that very, very short time. Why? Because the clock was ticking. From a public perspective, you want to be told in a reasonable amount of time something has happened.”

Once made public, defenders can take more decisive action. In the case of SingHealth, the action was to cut off internet surfing for hospital computers, which were identified as the initial gateway for the breach.

Mr Koh recalled the tension between assuring people, businesses and investors that Singapore is safe and secure, while maintaining healthy scepticism among the public to deal with the reality of a digital space filled with hostile actors.

“Most of the incidents that take place don’t make it in the news, and the reason is that they are perhaps too voluminous, happening just too many times, and don’t really impact the broader ecosystem,” he said.

‘DIFFICULT DECISION’ TO NAME UNC3886

Mr Koh said key factors in deciding whether to make a cyber incident public are: What was attacked? What is the impact on Singapore’s national security, economy or way of life? Who was responsible? What are the broader geopolitical and domestic contexts?

Last July, prolonged and ongoing attacks against Singapore’s major telcos by UNC3886 were first disclosed by Coordinating Minister for National Security K Shanmugam.

The minister said then that while naming the state linked to UNC3886 was not in Singapore’s best interest, the attacks were serious enough to notify the public.

“It was a difficult decision to make that announcement,” said Mr Koh.

“It was driven by sufficient confidence that we have detected the source of the attacks and have been able to stabilise the situation sufficiently.

“I chose the words very carefully because the nature of the work is that it is a very clandestine operation.

“And because of that, even when we say that we are confident that we have stabilised the situation, I cannot say for certain that we know everything and that we have found every possible secret entry that the attackers have used.”

        Listen:



  Singapore’s defence against the largest cyberattack to date involved more than 100 people across six government bodies, and was codenamed Operation Cyber Guardian.

“In the case of SingHealth, a much smaller CSA, a much less mature CSA, was able to do almost all of it by ourselves,” Mr Koh.

But the sophisticated actors at work in the UNC3886 attack meant forensic investigations were much harder, requiring more people and resources.

“Instead of just checking at the first level, we have to deploy more people, better-trained people to check at the second and third level, to see exactly what they have done, where they have gone,” he said.

“Sometimes even at the third level of checking, we are not able to determine it because they have been quite meticulous in cleaning up after themselves.”

Mr Koh said he was particularly proud of how well multiple agencies cooperated at the high tempo of a live cybersecurity operation.

“Working together is the first level of challenge. Working with a deep level of integration and trust is, I think, a second level of achievement, and for us to be able to do this at operational tempo in response.

“Only less than a handful of countries would be able to do this,” he said, calling it the culmination of more than 10 years of work.

THREE LESSONS

He will continue to represent the country internationally and develop thinking in digital security and related areas, such as quantum computing.

Asked about the incidents he has encountered over the years that most changed his view on Singapore’s cybersecurity risk profile, he cited three.

Although not an attack, the CrowdStrike outage in 2024 caused a “catastrophic technical failure” for users in Singapore who used the firm’s systems.

The crash forced manual check-ins at Changi Airport and led to more than 100 flights being delayed, while also affecting gantries at some public housing car parks.

This brought home the importance of having resilient systems, said Mr Koh.

“We tend to see cybersecurity as a technical issue … but actually, the CrowdStrike incident showed us that there’s only so much you can do technically.

“You have to ask yourself: if the technical (side) does fail, then from a business perspective, from an individual perspective, are you resilient? Can you manage without it?”

In 2021, an attack against oil pipeline operator Colonial Pipeline triggered snaking queues and fears of fuel shortages in the US.

This unsophisticated ransomware attack changed the perception that only attacks by states or state-linked actors, thought to have more resources at their disposal, can have significant consequences, said Mr Koh.

And in the 2020 SolarWinds attack, hackers infiltrated the software supplier’s systems and injected hidden code into software updates. These were later rolled out to SolarWinds’ customers, including in the US government.

Singapore was not targeted, but the supply chain attack clearly showed how vendors who are compromised can affect main users, said Mr Koh.

Cybersecurity has been a demanding and challenging domain to work in, requiring diverse skillsets, he reflected.

“It is an exciting space because we may tend to think that we go in after the fact and sort of dust for fingerprints and see what happened,” he said.

“But in the case of both SingHealth and in the case of Operation Cyber Guardian, both instances were live operations. And by live operations, it means that actually you’re fighting with the ‘enemy’ in the digital space.”