Don’t push cybersecurity burden onto consumers, says MCMC committee

CYBERJAYA: Companies providing digital services must take greater responsibility to safeguard users from cyberthreats, say industry experts.

With cybercrime becoming more sophisticated, experts say tech companies cannot simply shift the burden of security onto consumers.

MCMC Online Harms and Information Security Committee chairman Derek Fernandez said security should not be an afterthought.

He criticised companies that operate digital platforms but refuse to take responsibility when users fall victim to cyber threats.

“If you slip here at the MCMC building because of water on the floor, you can sue MCMC.

“So why don’t these companies take responsibility when their platforms expose users to risks?” he said during a discussion held at the BlackBerry Cybersecurity Centre of Excellence here on Monday (March 10).

Fernandez said businesses should proactively integrate security measures into product design instead of reacting only after problems arise.

“When you push a new technology, understand that criminals will exploit it. You need to think ahead – how can I protect my users? Build and design safety into the system,” he said.

Citing cashless payment systems as an example, he said users sometimes have no choice but to use digital transactions but companies fail to guarantee security or provide compensation when fraud occurs.

“Since they pushed the technology onto us, they must also protect us,” he said.

He said the regulatory framework must evolve to hold companies accountable for failing to protect users.

Jonathan Jackson, senior director of strategic technical solutions at BlackBerry APAC, said cybercriminals now can launch attacks with minimal user interaction, making traditional security measures inadequate.

“Zero-click attacks are a major threat. These can lead to data theft, remote control of devices, spyware deployment and even ransomware,” he said.

Despite the rise of encrypted messaging apps, Jackson said even notable platforms are vulnerable.

“Attackers can access conversations, even on supposedly ‘end-to-end’ encrypted apps. Your metadata, communication records and personal details can be mined and exploited,” he cautioned.

David Wiseman, vice-president of secure communications at BlackBerry, highlighted how even a single phone number is enough for cybercriminals to infiltrate a user’s device.

He added that cell phone tapping services are now available on demand, further complicating digital security

“With just a phone number, a threat actor can intercept and listen to every call, read all SMS messages, access real-time metadata and track device location,” said Wiseman.

Source: The Star