Fraud Remains the Leading Cause of Cybersecurity Incidents in Malaysia

Malaysia recorded 10,772 cybersecurity incidents in 2019, according to the General Incident Classification Statistics 2019 published by the Malaysia Computer Emergency Response Team (MyCERT). The total covers the range of incidents reported to CyberSecurity Malaysia over the year and is higher than the figure for 2018. It does not include the number of breaches organisations suffered during 2019.

Fraud dominates the figures

Fraud was again the largest category, with 7,724 reported cases, close to 70% of the total. That works out to almost 500 fraud reports a month and an increase of nearly 20% on the year before. The rise suggests that more organisations and individuals are falling victim to online fraud, a category that takes in phishing emails such as business email compromise, as well as malware.

Organisations have been taking steps to strengthen their security, yet fraud remains a persistent problem. Phishing is the form employees most often fall for, whether by being taken in by a scam or by having their email accounts taken over by criminals.

Employees are frequently described as the weakest point in an organisation's security, and the numbers bear that out. A company can buy the best protection available, but staff who keep visiting unauthorised sites or browsing for personal reasons put themselves and the whole organisation at risk.

Malaysian employees are generally told to stay away from websites unrelated to their work. Many agree to the rule and then connect their own phones to the company Wi-Fi to browse non-work sites anyway. Because those devices are unprotected, this creates security problems, and malware can pass from a personal device onto the office network and reach company information.

Business email compromise is the other worry. Staff should make a habit of checking the sender's address before replying to a message, particularly one that involves money. There have been many cases of criminals impersonating an employer's profile and persuading staff to make or transfer payments online.

Intrusions and unreported cases

A large number of intrusions was also reported in 2019. The count fell slightly from 2018, but the figures show attackers are still finding ways into organisations. Keeping security protection current, with every recent patch applied, is the answer here: in most cases an organisation suffers an intrusion because its defences have not been updated with the latest patches and are left vulnerable.

CyberSecurity Malaysia continues to teach organisations why cybersecurity matters. Some incident types declined, but intrusions and fraud remain at worrying levels. The MyCERT report also counts only incidents officially reported to it. The real number of victims could be far higher, since many people and organisations prefer not to report what happened to them, which is a problem in itself.

What organisations can do

Companies need to make sure staff understand how dangerous suspicious links and emails can be. One approach is to test employees, watch how they respond to suspicious links and train them on the results. Organisations should also try to gain visibility over personal devices on the company network, and where possible either make sure those devices are protected or keep them off the network altogether.

Staff who are easily won over by cheap deals and offers that seem too good to be true are the ones most likely to be caught by cybercriminals, and the losses that follow fall on their organisation too.