Thailand targets security gaps as it prepares for disruptive cyberattacks

Thailand’s National Cyber Security Agency (NCSA) is pressing operators of critical infrastructure to repair known security weaknesses and tighten login safeguards as it prepares for cyberattacks that could disrupt essential services. It is sharing intelligence and risk evaluations with the National Security Council (NSC).

Maj Gen Teerawut Wittayakorn, NCSA’s deputy and acting secretary-general, said the country continues to face cyberthreats. He considered a large-scale, state-sponsored attack aimed at provoking military conflict involving Thailand relatively unlikely, but said preparations were still needed for serious interruptions to telecommunications, energy and vital government systems.

The NSC uses NCSA’s technical findings alongside assessments of other security risks when deciding whether to increase national alert levels. Its planned meeting will address cyber risks, infectious diseases that are emerging or returning, terrorism, and crises affecting energy and food.

Teerawut said urgent warnings about PHP security flaws began going to relevant organisations on Oct 21, with a deadline for reporting remedial progress. PHP is widely used in Thai web applications and older systems. Some ageing systems cannot receive security patches because their vendors have stopped supporting them.

For affected systems, NCSA has devised interim configuration changes intended to prevent exploitation without disabling essential functions. It also offers detailed technical guidance where specialist staff are unavailable and is encouraging infrastructure operators and sector-specific emergency response teams to use multi-factor authentication.

NCSA also monitors suspicious reconnaissance and attempted breaches with energy-sector response teams and operators, including power plants. Annual national cybersecurity exercises test how prepared critical infrastructure organisations are.