Asia Pacific organisations face rising cyberattacks and AI-driven threats. Lim Hsin Yin, Vice President of Sales, ASEAN, Cohesity, explains three steps to build resilience and protect data from breaches.
A specter is haunting the Asia Pacific region – the specter of data breaches.
The region saw the highest year-on-year increase in cyberattacks last year, according to the International Institute for Strategic Studies (IISS). The think tank found that the region’s 1,835 attacks per organisation per week was 47% higher than the global average of 1,248.
According to a recent PwC study, the number of mega breaches – those that cost between US$1 million and US$20 million – experienced by Asia Pacific organisations rose considerably in the past three years. A 2024 report also revealed that 41% of organisations across Asia Pacific experienced at least one data breach over the past year.
The consequences of data breaches are costly. Besides the financial impact, breaches also damage brand reputation, customer confidence and operations – leading to losses of both real and potential business opportunities.
We only have to look back to 2024 when cyber incidents hit the headlines and disrupted operations, underscoring the fragility of cyber resilience across the region. For example, following a cyberattack against multiple Indonesian government services in June, officials revealed that the bulk of affected data had not been backed up. In September 2024, Mobile Guardian – a digital platform used in Singapore’s secondary schools – suffered a significant cyberattack that exposed student data.
With the increased sophistication of Artificial Intelligence (AI) capabilities further enabling cybercriminals, these cyber-risks are only going to escalate. Sure enough, that’s what 60% of Asia Pacific respondents told PwC, saying they expect Generative AI could pave the way for devastating cyberattacks within the next year.
A three-step mitigation method
There are proactive steps organisations can take to mitigate the likelihood of being a target and victim of cyber incidents. It is clear that recovering from a cyberattack is not the same as recovering data following a power outage. That’s because cybercriminals explicitly try to stop that from happening – doing everything to reinfect victims’ systems and maintain their hold over stolen data.
Although the risk will differ across industries, preventing data loss hinges on being proactive. That is hard work, which is likely why 69% of organizations told Cohesity they paid a ransom despite two-thirds of them having do-not-pay policies.
To bolster resilience in the face of cyberattacks or breaches, organisations can consider the following steps:
1. Creating a digital jump bag, which is essentially a virtual toolkit designed to help teams quickly address and resolve security incidents. It typically includes a laptop with pre-configured security tools, external drives for backups, portable Wi-Fi hotspots for Internet access and tokens for multifactor authentication. The jump bag may also include mobile phones if employees believe their devices have been compromised. In addition, it will have forensic tools, antivirus, network security tools, scanners, log analyzers and backup/recovery software. It is crucial that the jump bag include contact lists, system architecture maps and cheat sheets for fast action, as these are often forgotten during incident response plans. Similarly neglected but important are things like passwords for critical systems or even a copy of Active Directory. Services such as VPN access and tools for real-time event monitoring should also be part of the kit.
2. Having an isolated, ready-to-use clean room environment during threat investigation is critical. In line with industry best practices, it is essential to have a set of product capabilities and workflows that organizations can use to maintain business continuity while minimising recovery time. The design can be segmented into three stages that allow organisations to prepare for the scope of a cyberattack and recover clean data into production. This will provide a trusted foundation for incident recovery while augmenting investigations and reducing the potential of secondary attacks.
3. Training employees and removing all assumptions from an incident response plan is the third and most important step. Building a plan on assumed conditions or outcomes can create blind spots, which may result in a failure to meet specific organisational needs in the face of an actual cyberattack. Assuming nothing and verifying everything ensures the organisation is prepared and precise when faced with an attack, and this should be supplemented with comprehensive employee training.
Resilience is a mindset
Recovering from cyberattacks and ransomware can be challenging. Cybercriminals are constantly on the hunt, driven by financial gain, to breach systems and steal data. The primary goal should be to restore operations quickly while safeguarding both data and the brand’s reputation.
There are established best practices that can help prevent data loss and streamline the investigation process. By grounding incident response plans on concrete facts and data, the organisation can ensure it remains strong, adaptable and future-ready for challenges.
Simply put, by building confidence in your response strategy, you’ll be better equipped to recover without having to pay a ransom. It may require some effort, but the more prepared you are, the smoother the recovery process will be.
