Five steps in Indonesia’s cyber battle plan
By Medha Basu and Yun Xuan Poon
Interview with Lieutenant General (ret) Hinsa Siburian, Head of the National Cyber and Encryption Agency (BSSN), Indonesia.
The battle is on, and protecting citizen data is the priority. “Data is a new kind of wealth, which can even be considered as a more valuable asset than oil,” says Lieutenant General (ret) Hinsa Siburian, Head of the National Cyber and Encryption Agency (BSSN).
How can Indonesia protect this invaluable resource and ensure it doesn’t fall into enemy hands? GovInsider spoke to Hinsa to find out five key strategies behind Indonesia’s cybersecurity plan.
1. National Security Operation Center
Hinsa’s agency will set up a National Security Operation Center (NSOC), which will be responsible for coordinating national cybersecurity operations. “The establishment of the NSOC is an attempt by the BSSN to develop a protection system and establish a shared situational awareness regarding the state of cybersecurity in Indonesia,” Hinsa says.
SOCs are a common tool for governments to share cyber intelligence and respond quickly. The Centre will monitor the safety of cyberspace by keeping an eye out for anomalous traffic, processing cyberspace complaints, and working with community incidence response groups. It will also be crucial to protecting Indonesia from cyber attacks from more advanced nation-states, says Hinsa. He highlighted cyber warfare as one of the main threats facing the country.
2. Cyber response team within government
It would be terrible if a hacker managed to shut down an entire ministry. This is a particularly prominent concern in Indonesia, where government agencies are common targets of cyber attacks, according to The Conversation.
BSSN set up the Government Computer Security Incident Response Team in 2018 in response to this, Hinsa says. The Team oversees and supports cybersecurity measures in central and local government agencies.
Agencies can report cyber incidents on its website. The Team will then help to investigate the incident and support the agency’s recovery.
It also works to build the public sector’s capacity for handling threats. The Team conducts cybersecurity drill tests and workshops and publishes blog posts on its website to share how it resolves issues such as spam emails.
3. Covid-19 cybersecurity recommendations
Cybercrime numbers have soared during the pandemic. BSSN released a list of four recommendations to ensure organisations protect their networks sufficiently, Hinsa shares.
The first of these focuses on protecting remotely-accessed networks. It advises security teams to monitor all activities within a network, to not give users unnecessary access rights, and to make multi-factor authentications compulsory.
Next, security personnel should test how much traffic their servers can bear. This will help organisations to continue providing digital services during the pandemic.
Third, organisations need to educate employees on remote working safety measures so every node along the chain understands the risks.
Fourth, security teams should be ready to adapt their security incident response plan to the changing conditions in the work environment, Hinsa says.
4. Build skills
BSSN will prioritise cybersecurity skills training in the next year, Hinsa says. It takes BSSN at least six months to fill cybersecurity positions, Director of Digital Economy Protection Anton Setiawan told CNN Indonesia, pointing to the skills gap. “We continue to strive to encourage human resources, not only human resources at BSSN,” he added.
Indonesia is working with other nations to boost its cyber defence capacity. In 2018, it announced partnerships with Australia and the UK to share national cyber strategies and build skills.
"We can never really predict what kind of cyber threats we will face, but surely they will be more challenging. We must work with more developed countries, so at least we can adopt their technology and ensure the best security," said former head of BSSN, Djoko Setiadi.
Indonesia will also strengthen its cyber research capabilities in the next year, Hinsa says. “BSSN is determined to realise independence and technological sovereignty of the cyber and cryptography space,” he adds.
5. A central national data centre
BSSN claims that a new centralised national data centre will be more secure than holding data in local data centres, and intends to take on an overarching data stewardship role. The country currently has 121 data centres belonging to a variety of ministries and local governments.
Each of these centres hold sensitive data, including citizens’ personal information, and health and financial data, pointed out Glen Duncan, associate research director for data centers at IDC. “Indonesia must be prepared to face the threat of cyber crimes which includes the abuse of data,” Hinsa says.
A centralised national data centre will allow the government to implement standards across government agencies, Hinsa believes. It is expected to be ready by 2023, announced Minister of Communications and Informatics Johnny Plate.
Cybercriminals are a tireless adversary. Indonesia intends to coordinate national cybersecurity responses and arm people with cyber knowledge to take the bad actors down.