New banking rules for financial services to strengthen cyber security
All financial services and e-payment firms in Singapore must, from yesterday, follow a new set of central banking rules to better mitigate technology risks in the wake of a recent cyber attack which impacted organisations around the world.
The Monetary Authority of Singapore (MAS) now requires all financial institutions to assess the suppliers of their technology vendors.
In a typical assessment, suppliers may be asked to prove that their software is rigorously tested and they do not use unsafe programming practices.
Suppliers may also be asked to reveal their security measures and how often they monitor cyber risks.
The updated guidelines apply to all banks, payment services firms such as GrabPay and Singtel Dash, as well as brokerage and insurance firms.
Mr Vincent Loy, assistant managing director of technology at MAS, told The Straits Times that using an external vendor which may in turn procure third-party tools brings significant risks to banking systems.
"Unknown third-party suppliers are what MAS is most worried about... Financial institutions that do not allocate sufficient financial resources may be more open to unknown third-party suppliers," he said.
The hacking of Texas-based SolarWinds, a leading provider of IT management software, had subjected hundreds of thousands of firms and government entities around the world to risks.
SolarWinds' IT management tools are common components in the products of many large vendors including Microsoft, FireEye and Cisco Systems.
An assessment of third-party suppliers was previously not required under the MAS Technology Risk Management (TRM) guidelines, although due diligence on technology vendors was a must.
The screening of component suppliers is now clearly spelt out in the revised TRM guidelines, which cover a wide range of topics to help firms fend off and recover from cyber attacks and system failures.
The guidelines elaborate on the mandatory requirements set out in the MAS TRM notice, which carries a fine of up to $100,000 for non-compliance under the Banking Act.
In the case of a continuing offence, a further fine of up to $10,000 daily may be levied.
Get The New Paper on your phone with the free TNP app. Download from the Apple App Store or Google Play Store now
