Cybersecurity in Thailand: Protecting against Emerging Threats in a Connected World (ft.BDMS Group 2 (BNH Hospital and Samitivej Hospitals Group) and Thonburi Bamrungmuang Hospital )

security in Thailand. This conversation took place during the 44th edition of the ASEAN innovation business platform Thailand's Conference and Exhibition held at the Grand Hyatt Erawan with Dr Polawat Witoolkollachit AIBPAdvisory Board Member hosting the discussion, along with Togio, Prakorn Chayanuwat, Group Data Protection Officer and Head of Data Governance, PDPA compliance and DPO privacy office from BDMS Group 2- BNH hospital and Samitivej Hospitals Group, together with Dr Thitipong

Nandhabiwat, Chief Executive Officer from Thonburi Bamrungmuang Hospital , on the current state of cyber security in Thailand.

life now. Now we want to move on. What would I want to ask doctor, Dr Thitipong first, about, what do you think about the Thailand's cyber, cyber threat landscape? What's going on? What what you're thinking about? This is a effect to your business, or effect to the match, the whole system of the Thailand?

outsource to other vendors. So supply chain vulnerabilities is also one of the risk that you have to actually make sure that you take a look closely, because many of the data breaches, all those cyber attack also can happen through the vendors. And there have been previous incident in Thailand that also happened to some other manufacturing in just this year, and also even like ransomware, you know, all those phishing mail also happens in every industry, including healthcare

as well. That's pretty normal, but I also would like to maybe think of looking into some other new areas, because currently we have technologies like internet of things, especially in medical healthcare area, we have what we call medical Medical Internet of Things, internet or medical things, IOMT. So that's part of our life. We can actually have some of the equipment at home.

You know, even, like, well, like, for example, simple one is smart watch that you have, but some people even have, like, blood pressure device at home that link to your iPhone, you know, your iPad, your Android devices, and when you actually consult doctor online through telehealth platform. Those devices send data to the doctor through the platform. There could be some weak security in those devices that can be, you

know, a loophole there. And also, another trend that I would see is that there's something like crypto jacking, you know, like where hackers, cyber criminals, target your computer, using your computer resources, and then they just use that to mine cryptocurrency without you knowing it. So that's what we that's currently being seen in Thailand, for sure.

currently, we busy. We still have some of the, I think it's still happening in some I want to add to be step back on about this amount is like your DPO of the of the be approved

a small size thing. Nonetheless, today, I am not going into it the way that you have heard previous speakers this morning, from some other conference videos about cyber security and threat scheme and all these data which is happening. But thank you, from doctor, from your point of view, that medical Internet of Things and all these vendors problems we have, I mean, Zoom posts there, what I tell you is an unspoken trend spoken words that we fully are aware but we're talking about

it. But before I answer, can I see some hands? How many people in this room actually in IT management? Okay, that's a whole lot. How many people in here are actually digital marketing responsibility at your organization? You have the one of the biggest risks at your organization. Currently, the threat to your organization is from your digital marketing department, not department.

Digital Marketing Department being one of the most crucial department you need to manage in order to make profit company, right? So you use similar data, and your marketing teams are everywhere, using tools to

customers. So you have customer data management solution, and then you have your data, and it's take a wild guess, you probably have the volume silos not connected, and you probably don't have an actual evidence process that govern them, let alone data access, right management, management, so there's issues right there, not technical, but that issue is exposing you to security risk. So for my first set of answer, I

would say the trend. There's so many trends you heard from elsewhere, but today emphasize the use of data within your organization by your previous, sorry, where your multiple department that previously worked in manual, and now they're transforming from a local servers, local application to cloud that now you're interoperability with some other companies, partner. You got loopholes in there, everywhere.

So this trend you're not really talking about, but thinking about it in terms of the breaches, it happens across all sector, department, but specifically in Hector, we in basically every, every single corner within our environment. So if you take a look and scan up your whole enterprise architecture of yours, everywhere, so there's risk management is needed to start

over email. No, you know full well, you're not supposed to do

Doctor, new doctor. And also in the IT, I saw many of the of in some of the marketing, like, like Mr. Bucha, they don't care about the data. They didn't regarding to the law they want to sell. Sell is a because we want to do the sale right, okay? We want to make it alive. So I think that the law and the regulation is one of the we have to concern. I want to the opinion about the launches and legislation now that's a conference.

us here in Thailand. In fact, we look to folks in Singapore for privacy management. They quite well. I don't know who they learn it from, maybe from Canada, from the Europe, but here in Thailand, Personal Data Protection Act we call GDPR, or

copied too well. So much so that some reality of it make it challenging for us to ensure compliance in terms of practice with provision act now, the challenges with data protection, data management and expectation of law, first of all, big organizations in Thailand across all sectors. And I answer this with no scientific evidence data

to prove you otherwise. But if you go on tv.com, or LinkedIn or any job that is a job recruitment post, you'll see job posting for data protection officer and privacy advisor, Director of Information Security with just that fact, I can tell you that here in Thailand, most organizations still don't have in place an expert on this is number one sought after in the market within IT, When compared to Enterprise Architect, as well as purely director or CISO, that's what you like to call

chief information officer. So the challenge is this a lack of local expertise. You can't hire a lawyer from the UK or European countries. Come over to any other countries in Asia and start telling companies, oh, you need to do this to be compliant of Europe or here in Thailand, to manage privacy and information security. You need to understand your business context. There's always exceptions and loopholes and all of these relationships. You can't lawyer work as management

system specialist. You can make a legal person work as a compliance enforcer as well as a business analyst. So your company need to groom people internally or at regularly, seek someone locally who know business and landscape well. And maybe we can, from a CEO point of view, in terms of recruitment for these rural hospitals?

And so with the PDPA and Cyber Security Act, we've been face just recently, only a few years, I think, like 2019 for PDPA, right? 2020 or something, actually, 2020 pa at 2009 Cyber Security Act, and many of the Thai companies, so still lacking in the. You know, expertise just on what and in the really beginning, and I'm pretty sure some other company is still

doing it. I used to be also Data Protection Officer, because we were looking the board was asking, who's the right man internally, has to know a little bit of legal and no business operation and be good in IT background. Something falls under me. So I have to take this DPO well. And I would say at that currently, there are many of the companies that still they do consultation right for for you, and then as DPO for you as well, but you can groom your own

people. That would be best, because you don't want outsiders to know what's going on about your business, because they're not gonna be with you for, I mean, like in 20, years, but your employee probably gonna be like, much longer. So I yeah, I had to maybe, you know, try to you just grow. Yeah, your your people by consultation coming in or send your people to different, various session that we conducted, I think, pretty much almost every month we have something with PDPA, right?

Yeah, every day also, some Yeah, so maybe next to that also, huh?

come from. CEO, you know, saying that, hey, we will raise you, give you bonus, something like that, this and that, and yeah, so pretty much you you also need to create something like phishing simulation, you know, in within your company, make it fun, entertaining, gamification, drop quizzes, those kind of thing you need to do that you know, like, I'm very sure twice a year, it's something that you didn't need to do okay

here, I did some homework. So I'm in this group chat, in the live chat with you know different, different organizations, C level management, IT people, data protection, officers, and a question which is, what's the challenge regulations and how do we foster culture of adoption of cybersecurity and risk management, of this theme that we hear today, I got quite very interested from a few C levels and C so within that group line, one of the answer was, citizens are overriding their CO privacy

values. They're the values of advantages that providing them benefit or pricing some additional perks sacrifice. Data

to get those curves. So looking back at challenges with regulation externally from station, the government has something to do to Ernest among citizens, why they worry about their personal data and here in Thailand, back to question the landscape, because so much problem here with all these protocol center calling you and then tricking you into offering them $2 million I could never understand why. Why would someone want $2 million but learning the schemes that these criminal use, you can easily

fall for it. So with that test, the phishing email test, yes. Victim from my boss three years ago, I admit this trick, and you know why I did it? Exact same. Just answer. There was value in it. He said, If you respond within the end of business day today, you will be considered for something in management. So I, as a good employee, I'm not gonna wait for everyone to answer this. I was the first victim. Yeah, if you give to $80

all employees. As a healthcare providers, we're not a fan of anything that would cause patient safety issues, anything, whether it is personal data breach or slippery FLOOR and FLOOR, and our aging patients fall down, crack the hips, dirty bathroom, whatsoever, patient safety is very close to everyone's heart, and therefore our quality management team and decided that the culture has to be based on very short words that can stick with everyone. So we came up with this, stop the

line. Stop the line, as in, if that you see there's a risk coming from this thing. Stop doing what you're doing, and then reflect. And then you go into all these process where you have policy and work instruction to reveal the problems, and then curve before it happened. It is such common sense, but we are so busy advancing to do better, so much so that you forget all

these little common sense. So we implement of the line, and it's working very well, so well that my office first ring a bit too often that I need to counter, manage it a to automatically create awareness or give them answer without having them to call my office. So we'll start working on proactive communication. Work with one stop shop, and you know, staff can go and take a look whether or not what they do is reach out the laws or not, get it or not.

These problems have happened before, and can they resolve it with the same way? So, you know things, things are being being done at the moment, but first of all, the mind the company culture.

could happen. I know, like Mr. Con say that the call center, that they've some, give more than 5 million US to the to the call center. I don't know why, but I know in in the term of it, I am doctor, something I can default liar for the nation they must believe I take wine for to do this. But in that, because we are in the cyber world, so you have the smartphone, the. That mean that you have the back in your in your pocket. So, suka,

do you turn firm? Now, I think they have an elector do this, because I'm firm, more than a 50,000 to do the face shaking before, I think in next few years we do we face about the cyber farm, about to the face shaking. I think because they are so smart. So

good. Then we, we seem to have, like, fishing coming in all the time, you know, and that even we create awarenesses, but it's taking, still risky, for our key to to get, like, maybe 100 fishing meals a day. So if you have good cyber security in every area, and then that helped reduce, reducing the risk quite a lot. And I've been trying to educate, you know, a few people, even the board, my board, that, hey, this investment that we make, we have to invest, say, 10, 20 million. You cannot think

of ROI, turn on investment. It's not okay. So

start for the so. So I think the top, the top manager, or even the I think the middleman also the import for this too. So we are we now be facing with, with the well, what do you think I will do the last agenda of this? About it, what kind of tool or what kind of tackling we want to come first?

So I tell him, I told him that you're indirect or tangible for investment, and having in place an augmented security protocol and solution will save you so much when breach happens, that breach has happened to you, you're going to end up paying for investigative firms to come in and recoup, recover your system for being like a telecommunication provider if They were to be attacked one business day where yours is not being continued will crash your

stock price so fast. So I think that one sentence might see or my CFO pretty quickly. Listen to this

Right answer is, in the framework of cyber security management, i. Everyone is aware, the whole national institute of standard technology from the US, who appeared to be the Godfather cybersecurity management ISO differently, I mean international organization anyway, shortage you have, I did detect, protect, respond, and then recover. Most of the investment is being done the first three so it should be from identify, know your risk, start matching them, detect them, and

then you protect them. Certainly you need to invest in those. And there are so many solutions, the previous vendor on the those solutions so that right there next room, you need to speak to

them. The second part that C level and strategy key organization are not paying so much attention the response, and that's where it's going to start going out really, when you cannot control that internally, and when do business continuity plan in place, not just from business service point, but from your IT point of view, your BCP plan isn't something that's on tabletop and it's a playbook, and you just sit and then you don't Practice and you don't exercise your business

continuity plans, your recovery plan, your response can have to be strong, and one need to consider investment in having those mechanisms. It doesn't, for me, invest in the tech options. Some solution will help. Solution in cyber security market will help you to present threat data proactively so you can know arms has gone, and you'll need technology for that.

But if you don't have an actual BCP plan and mechanisms and a team of people that being called emergency at 2am and you convene your friends say, Hey, we got midnight. I want to be doing now at two in the morning. Hopefully someone on your will unplug everything, first, play the network and then go from there. But if you don't have these kind of actions in place, and those involved are not well at first, you're not unplug that terminal fast math before it's into your

platform. Anything to add? Just,

currently what you have. Because maybe even, for example, my hospital, I be heavily invested in cyber security, like close to 100 and already, but not enough. Because current cyber security, you know, like all those hackers, they're getting Smarter Every Day, and evolving so fast and the the new kind of, you know, like tricky, tricks seem to come out, and we can't seem to protect we correct what we heard. So you have to do the

assessment. And maybe if you can do it twice a year, it would be good, because then you know that Ho, you still have both calls here. And then you can more on this equipment, these services, which are that's why I always open to hearing more from people with the technology. So it can, yeah, but still cannot ensure 100% securities. I try my best.

knows my credentials. Write off everything correct, first name, last name, my actual nickname. They know exactly what he right now, and you know who they were pretending to be. They were to be the this company asking me for my personal information so that they can serve me a parking here. What I'm telling you is I just. Know victim, but then I learned from the email and exercise years ago to start questioning, because Singapore, but a person speak Thai, they're

questionable. And Fauci, who is a staff on the event management team, really wanted to take care of me and email me like how she has been emailing me all these along, trying to secure my time to come here. So what I'm trying to share with folks in cyber security were focused on risk do still come from humans, and this is how that doctor felt. Tricks. You know, when you're busy, when they call me, you know, I was in a boardroom in a meeting, and I was very busy, so I tried to end

that call quick. What do you need? How can I help you? Oh, you need and then the minute they say, Ah, Mr. I will send you a link on your phone. Just need to click, and then you just submit your car license plate, and then we'll take care of it at the hotel for five star service I know better now. think cyberspace issue is quite important, because we must address often, more frequently, I can say, because think about cyber security, is it different

perception? For example, they must say that, if we just love 1% of security, I think the security is a is difference? For example, if, the doesn't that was one, one door. It is who decides the cyber 200% is not only 1% of the area we lost. So the survivor is all on and law for this, but you must address this before for me to buy me, I practice, I do the prevention for prevention is cheaper. It takes time to take a look of

effort. So I think most to the men on this stage, they believe that this prevention is very important. So where we finish our panel, and we want to have the question from please, please join us.

other exercises. You know, the old traditional way is you have your management, team managers and whoever take annual tests, but brings small, minimal impact on the BCP. So unplanned tasks, plan and unplanned events served really well on this

their BCP, as well as the CEO. I my experience for the BCP is quite tough for for to to educate the CO to understand what need to decide when we're starting the BCG plan, for example, I have one event that our Main Street for about two hours. So I have to try that we, we will be the city, or we we want, or we have to fake it for four hours, because when we start the BCP, the process take nine hours. So that was also money to to dig in. But we have to educate the HO, educate the

body. What does it pretend of the BCP pen? And all the students say that we have to practice often, but I frequently practice to realize them. They educate them for the plan of the end of survival cyber security.

and Technology Group. I want, I want to share story here in Thailand, set up a pretty, pretty good standard in moving forward with cyber security management and awareness and national standard levels, but it has issues. So bank balance don't control all the banks directly, but they have this guideline set of rules that they

must abide by. All the banks will execute those compliance differently with different technologies, meaning the work breakers and this work instructions that they have to work with other counterparts deal different mechanisms. So in terms of issues that the banking industry in Thailand has take, has taken a much bigger step than many other degrees, inter security and private, and they need to do that, because our

money is with them, right? So the banking industry to get together and do even better. Don't wait just for the Bank of Thailand to tell you what need to be done the bank have, because every day that SMS is coming in, I have to disc my Wi Fi first and then check what's going on off of my data. You know, it really scared me now, with all this cyber security scam from center here in Thailand, is too overwhelming. Personally, I don't think

banking industry enough. Only one bank far came out and say we're not sending you SMS anymore, but, but I still receive SMS from your bank, not from your corporate. It comes from your agent at a local brand reminding me to pay my ho loans. And so far, I can download the app sometime. I'm a little confused, so I don't know if that is still true. So came back. You still need to tell your your branches, send me a personal with a link to be too scary just to share that closing.