Mr. Dang Tung Son, Deputy General Director of CMC Telecom, talks about the current state of cyber security in Vietnam.

■ Public attention has recently been focused on a Vietcombank customer losing VND500 million ($22,125) after following a link to a malicious website. As a software solutions provider, do you think she is solely to blame? 

CMC Telecom recognizes that there are gaps in cyber security, which hackers use in their attacks. These gaps can come from the carelessness of individual customers or from the cyber security at banks. We can’t assign blame but it’s clear that in addition to the customer’s loss the bank also suffered major damage. At the moment I think that assessing the damage is more important than apportioning blame.

The hacker used an international exchange to transfer VND200 million ($8,984) to Malaysia, which Vietcombank cannot retrieve. The amount, however, doesn’t reflect the real damage.

In a hack on Bangladesh’s central bank in February it lost $951 million. This was several months ago but the lessons are never out of date. As well as the money, the central bank also lost the trust of enterprises and the country saw its reputation tarnished. The central bank governor had to resign over the incident. It also affected the Rizal Commercial Banking Corporation (RCBC) in the Philippines, who received an $81 million transfer from the hack to distribute to a foreign currency service company and other organizations. The international banking community and financial institutions then began to ask questions about security and anti-money laundering activities in the Philippines.

In Vietnam this year we have seen similar cases, such as TPBank successfully fighting off hackers attempting to steal $1.3 million in April and the Vietcombank customer’s case in August. Information security has clearly gone beyond borders and become an international issue.

■ What security gaps are there in Vietnam?

According to CMC Telcom’s figures for May, about 90 per cent of officials store their private information and office emails on their smartphone. Smartphones, however, have open source software.

Therefore, hackers can easily penetrate smartphones and attack the private information of users and enterprises. About 30 per cent of these 90 per cent of officials have security software on the smartphones.

Vietnamese users often use apps and software that aren’t copyright versions. These apps and software harbor viruses and malware. This presents the ideal conditions for hackers to penetrate into the information systems of enterprises.

Figures from the IDC Group for 2014 show that enterprises using non-copyright software and apps can lose up to 73 per cent of important information. About 55 per cent of attacked enterprises cannot recover their database after the server is damaged following an attack. Customers of these enterprises may possibly be infected by viruses and malware.

If people use copyright software and apps the security gaps are often fixed by frequent updates and they are better protected from viruses and malware. Vietnamese enterprises also often lack the capacity to train their own IT teams.

■ How would you comment on the security situation at Vietnamese enterprises?

Experts from Kaspersky Lab evaluated that Vietnam is in the group of countries facing the most risk from malware and the use of non-copyright software.

Vietnam is in eleventh place globally in terms of cyber security risk, which is much greater than in regional countries such as Malaysia, Singapore, and Thailand. About 87 per cent of Vietnamese are concerned about cyber security risk but only one-third use information security solutions. And these are at the most basic level.

■ What would you advise Vietnamese enterprises and individuals do to improve information security?

Security is a special area and there is no such thing as absolute safety. No solution can protect 100 per cent of enterprises and organizations from viruses and cyber attacks. The more rapid the development of technology, the more hacker tricks there are.

Enterprises need huge investments in IT human resources, fixing cyber security gaps and updating security solutions to synchronize their security systems. Being equipped with good security tools has to go together with optimizing cost. We suggest leading security solutions from IBM and Microsoft.

Many enterprises in the US, Canada, and Japan use outsourcing for their security services. In doing so they can utilize global systems and be updated with new technology at an optimized cost. I would recommend that Vietnamese enterprises not only strengthen their IT human resources and enhance their basic investment in IT security systems but also use outsourced security solutions.

VN Economic Times