MAS Issues New Rules to Strengthen Cyber Resilience of Financial Industry
Singapore, 6 August 2019… The Monetary Authority of Singapore (MAS) today issued a set of legally binding requirements to raise the cyber security standards and strengthen cyber resilience of the financial sector. The Notice on Cyber Hygiene sets out the measures that financial institutions must take to mitigate the growing risk of cyber threats.
2 The Notice will make compulsory key elements in the existing MAS Technology Risk Management (TRM) Guidelines
- establish and implement robust security for IT systems;
- ensure updates are applied to address system security flaws in a timely manner;
- deploy security devices to restrict unauthorised network traffic;
- implement measures to mitigate the risk of malware infection;
- secure the use of system accounts with special privileges to prevent unauthorised access; and
- strengthen user authentication for critical systems as well as systems used to access customer information.
3 Financial institutions have 12 months to put these measures in place before the requirements come into effect on 6 August 2020. Mr Tan Yeow Seng, Chief Cyber Security Officer, MAS, said, “Cyber threats in the financial sector are growing as a result of an increased digital footprint and pervasive use of the Internet. The financial sector needs to remain vigilant and ensure that defences are able to counter varied and evolving threats. Good cyber hygiene can go a long way in protecting financial institutions from common types of cyber incursions. These fundamental and essential measures can be implemented by all financial institutions regardless of size or system complexity.”
4 MAS had sought feedback from the public in September 2018 on the proposal to make this suite of cyber security measures into legally binding requirements. Financial institutions generally welcomed these measures and provided some suggestions regarding implementation of the requirements. These include:
a) focusing on strengthening user access to systems that store or access customer data; and
b) allowing more time
The Police and MAS have jointly commenced investigations into a 43-year-old woman and 34-year-old man, who are the Director and Compliance Manager of Samlit Moneychanger Pte. Ltd. respectively, for their suspected involvement in Samlit carrying on a business for a fraudulent purpose and suspected failure to comply with various obligations as a licensed payment services provider.
MAS has published a consultation paper to seek feedback on proposals to reduce the amount of information collected by financial institutions from their clients for selected insurance policies, when recommendations are made based on the Basic Financial Planning Guide (Guide).
MAS and Bank Negara Malaysia have jointly launched the real-time payment systems linkage between Singapore’s PayNow and Malaysia’s DuitNow.