Experts question Malaysia’s readiness for sustained cyberattacks

Malaysia’s defences may cope with isolated cyberattacks, but security experts have questioned its readiness for prolonged attacks across several sectors, citing gaps in coordination and recovery capabilities.

Cybersecurity practitioner and adjunct professor Murugason R. Thangaratnam said preparedness varied despite the framework established by the Cyber Security Act 2024 to protect National Critical Information Infrastructure (NCII). He said sustained attacks would challenge coordination, specialist staffing and recovery capabilities in ways Malaysia had not rehearsed.

Former CyberSecurity Malaysia chief executive officer Datuk Dr Amirudin Abdul Wahab proposed a 90-day cyber resilience audit covering critical national systems. The assessment would examine whether attackers could cross between networks, interrupt operations or compromise systems needed for recovery.

Amirudin said Malaysia had built an important foundation through its agencies and frameworks, but laws, institutions and security technology alone did not establish operational readiness. He warned that disruptions could spread between interdependent sectors, with banks relying on telecommunications and telecommunications depending on energy.

Cybersecurity professional Dr Mohamed Anwer Yusoff pointed to incidents including September’s attack at Tanjung Pelepas Port, which briefly disrupted terminal operations, and an attack on Tabung Haji that prompted a temporary suspension of services. He also cited the reported compromise of public LED screens in Kluang, Johor.

Anwer said readiness should be judged by how quickly intrusions are detected, damage is contained, essential services are maintained and operations are restored within acceptable timeframes.