Later this year, the Cyber Security Agency of Singapore (CSA) will launch a separate code of practice for cloud environments. It will lay out the cybersecurity requirements governing the secure deployment, operation, and management of critical information infrastructure systems hosted on cloud, said Mrs Teo.

Earlier this year, CSA wrote to boards and senior leadership of all critical information infrastructure owners to review their cybersecurity in light of artificial intelligence-enabled threats.

At the time, Senior Minister of State for Digital Development and Information Tan Kiat How said that the letter from CSA sets out clear expectations on what the review should include.

In its letter, CSA said the organisation's review should look at whether its current cyber risk assessment takes relevant account of AI-enabled threats, as well as whether visibility over critical systems, internet-facing assets, privileged access, cloud services and third-party dependencies remains sufficient.

It should also consider whether vulnerability management, patching, monitoring and incident response arrangements are fast enough, and if its use of AI is appropriately governed.

Organisations should also look at where AI can be used to augment current cybersecurity operations.

Other than requiring owners of critical information infrastructure to strengthen board and senior management accountability for cybersecurity, the updated code requires owners to attain Cyber Trust Mark Level 5 certification to elevate their cybersecurity posture, said CSA in a separate press release on Wednesday.

Owners must maintain oversight of the systems that connect and communicate with the critical information infrastructure to improve cybersecurity risk management, and develop a comprehensive cybersecurity exercise plan to ensure a coordinated and effective response to related incidents, said the agency.

They also must have robust management measures to maintain network architecture, including network management monitoring and detection management, CSA said.

The agency will work with owners of critical information infrastructure to deploy threat detection systems across their network segments to detect malicious activities, it added.

While these measures are focused on owners of critical information infrastructure, the risk does not stop at the organisation, said Mrs Teo.

Like a misconfigured internal system, a compromised vendor or partner can also be a vulnerable entry point, she added.

Announcing the launch of a sandbox focused on using AI for cybersecurity, Mrs Teo said CSA will partner vendors to pilot AI-enabled security operations across Singapore’s critical infrastructure.

“We intend to share the learnings from the pilot with the wider community of cyber defenders. This will boost capabilities in the entire ecosystem, and not just the organisations with the resources to experiment,” she added.