Regulation Overview
The Singapore Government is reaffirming the importance of data security while “seeking the views of industry and global experts to recommend a slate of technical measures to strengthen data safeguards.”
The announcement was made by the Public Sector Data Security Review Committee, which was convened by Prime Minister Lee Hsien Loong in March 2019. The Committee completed its work in November 2019 and the Public Sector Data Security Review Committee (PSDSRC) report contains five key recommendations for the public sector, which when implemented would:
- Effectively protect against data security threats and minimize the occurrence of data incidents;
- Detect and respond to data incidents swiftly and decisively, and learn from each incident; (c) Build data security competencies and inculcate a culture of excellence around sharing and using data securely;
- Build data security competencies and inculcate a culture of excellence around sharing and using data securely;
- Raise the accountability and transparency of the public sector data security regime; and
- Put in place the organizational structures to sustain a high level of security, and to be adaptable to new challenges.
The Committee’s recommendations will address existing gaps and build a resilient data security regime as technology advances, systems become more integrated, and risks become increasingly multi-faceted.
The in-depth investigations of the IT systems revolve around five agencies that deal with high volumes of sensitive data:
- Ministry of Health Health
- Sciences Authority (HSA)
- Health Promotion Board (HPB)
- Central Provident Fund Board
- Inland Revenue Authority of Singapore
The Government targets to implement the measures in 80 percent of Government systems by end of 2021. The timeline for the remaining 20 percent which involves systems that are complex or require significant redesign is end-2023. In the interim, agencies will put in place appropriate measures to manage the relevant data risks.
Recommendation Descriptions
1.1: Reduce the surface area of attack by minimizing data collection, data retention, data access and data downloads.
- Collect and retain data only when necessary
- Minimize the proliferation of data to endpoint devices
- Access and use data for the task at hand
1.2: Enhance the logging and monitoring of data transactions to detect high-risk or suspicious activity.
- Enhance logs and records to more accurately pinpoint high-risk activity and assist in response and remediation
- Detect suspicious activity and alert the user or stop the unauthorized activity automatically
1.3: Protect the data directly when it is stored and distributed to render the data unusable even when extracted or intercepted.
- Render data unusable even if exfiltrated from storage
- Partially hide the full data
- Protect the data during distribution
1.4: Develop and maintain expertise in advanced technical measures.
1.5: Enhance the data security audit framework to detect gaps in practices and policies before they result in data incidents.
1.6: Enhance the third-party management framework to ensure that third parties handle Government data with the appropriate protection.
The Committee has also identified six advanced technical measures, which are not sufficiently mature or readily integrate for widespread implementation:(i) Homomorphic Encryption; (ii) Multi-party authorization; (iii) Differential Privacy; (iv) Dynamic Data Obfuscation and Masking; (v) Digital Signing of Data File; and(vi) Secured File Format.
