NEWS
Strengthening ICT supply chain resilience is everyone’s business
December 13, 2021 2:22 p.m.
By Genie Sugene Gan, Head of Government Affairs, Asia-Pacific, Kaspersky
NotPetya, WannaCry, ShadowPad, and Sunburst may or may not be household names, but these malware, and many more, have unleashed significant harm on the world.
Recently, one such instance of malware was used to attack an IT services company based in Dublin, which supplies security software to scores of large cybersecurity contractors. Working through the company, hackers infected hundreds of its clients worldwide with ransomware, and demanded USD 50,000–5 million from each business in exchange for the decryption key.
Earlier this year, another attack hit an American IT software company, and subsequently infiltrated nine U.S. federal agencies, including the Office of the President, and the Treasury and Commerce Departments.
What these attacks have in common is their modus operandi: hackers targeted software vendors or IT companies to gain backdoor access to their clients’ systems, infecting hundreds and thousands of systems in one go.
This is perhaps how “supply chain” got its name – each part of the process stream is inevitably linked to another. When one part gets affected, a domino effect soon follows.
The Problem
ICT supply chain cyberattacks are on the rise – the European Union for Cybersecurity estimates a four-fold growth in attacks in 2021 compared to 2020. The risk is compounded as vulnerabilities can be introduced at any phase of the ICT life cycle: from design – through development, production, distribution, acquisition and deployment – to maintenance.
The impact of these breaches is also set to grow, given the increasing interconnection of IT systems across organizations, sectors and countries. In a 2019 survey by Gartner, 60% of organizations reported working with more than 1000 third parties.
Upon successful infiltration, cybercriminals enjoy free rein to conduct cyber espionage, steal data and intellectual property, or extort money through ransomware attacks, which have been on the rise. From 2019 to 2020, the number of Kaspersky users encountering targeted ransomware – malware used to extort money from high-profile targets such as corporations, government agencies, and municipal organizations – increased by 767%.
While the impact on governments and enterprises may feature more prominently, the wider public is not spared. An attack on a grocery chain could force the temporary closure of scores of supermarkets, or a virus may be unleashed on millions of PC users through a software update (as, for example, occurred in the ShadowHammer3+1 attack, which Kaspersky detected and promptly mitigated in 2019). Taking it further, the compromise of systems providing healthcare or public utilities may disrupt the provision of these essential services. And these are the very day-to-day things that affect individuals like you and me.
Early Responses
Recognizing the risks and impact of supply chain cyberattacks, more countries are taking action. Since 2020, national cybersecurity strategies were either released or updated across Asia-Pacific, including in Singapore, Malaysia, Australia and Japan. Other countries, like Vietnam, India and Indonesia, are soon expected to release their own national strategies or implementation details too.
But when it comes to ICT supply chain resilience, the solution is more complex in view of the multitude and range of stakeholders involved. Some governments have intervened, with a focus on protecting the ICT supply chains of Critical Information Infrastructure (CII):
- In 2018, the U.S. Department of Homeland Security established the ICT Supply Chain Risk Management Task Force, a public-private partnership to develop consensus on risk management strategies to enhance global ICT supply chain security. The Task Force has released guidelines on the sharing of supply chain risk information, and risk considerations for managed service provider customers.
- The Australian Cyber Security Centre also published guides this year for businesses to identify cybersecurity risks associated with supply chains, and to manage these risks.
- The Cybersecurity Agency of Singapore announced that it will shortly launch a CII Supply Chain Programme for stakeholders to adhere to international best practices and standards for supply chain risk management.
The Way Ahead
The global nature of ICT supply chains necessitates a stronger, coordinated response at every level.
Globally, countries and International Organizations (e.g., INTERPOL, the UN, ASEAN, Europol) have taken steps to tighten cooperation and share best practices:
- Multilateral platforms – Today, the United Nations Group of Governmental Experts and Open-ended Working Group are platforms that can be used by countries to develop consensus around cyber processes and norms. Conferences such as the UN Internet Governance Forum provide further opportunities to discuss at the working level: in 2020, Kaspersky together with our partners organized a workshop to discuss the need and ways to develop assurance and transparency in global ICT supply chains.
- Bilateral partnerships – Countries around the region, including Vietnam, India, Japan, Singapore, China and South Korea, have committed to MOUs on various aspects of cybersecurity – an important step in making progress domestically and globally.
While each of these platforms plays an important role in building consensus, exchanging knowledge and best practices, and harmonizing standards, moving forward, it is imperative to have more targeted conversations on global ICT supply chain resilience, given the wide-ranging types of actors and impact involved globally.
Nationally, governments must continue to drive nationwide efforts to establish a baseline level of cybersecurity across sectors through laws, regulations, guidelines, training requirements and awareness building. The examples above provide a sense of some of the measures undertaken by governments.
Given the integrated nature of ICT supply chain resilience, there is a particular need to develop core principles (e.g., security-by-design), technical standards and legislative/regulatory frameworks to ensure a consistent level of cybersecurity and accountability across stakeholders. Self-assessment tools can also be published in addition to facilitate implementation.
Individually, everyone is responsible for ensuring our collective cybersecurity. Naturally, businesses that develop products and maintain systems must lead the way.
At Kaspersky, we believe that transparency in the components within and connections across software supply chains is the best way to ensure the integrity and trustworthiness of our digital infrastructure. Our commitment to this principle is evidenced by our Global Transparency Initiative, where, among other things, we:
- Welcome third parties to review our source code. More recently, we made it easier for our partners and the public to understand what is inside our products by providing a software bill of materials – a list of all the components, information about them, and the relationships between them.
- Practice responsible vulnerability disclosure, and have on many occasions, alerted IT companies regarding vulnerabilities in their systems, averting several potentially significant cyberattacks.
Cybersecurity is everyone’s business because our collective cybersecurity is only as strong as that of the weakest link among us. To remain ahead of the game, a holistic approach involving all stakeholders is required. We must look beyond playing catch-up and reacting to cyberthreats. It is imperative to take a long-term approach in designing the cybersecurity ecosystem, which includes building a strong talent pipeline to meet the needs of CERTs, forensic analysis teams, and IT departments, and designing CII that is secure-by-design.
The ideas above are by no means an exhaustive list, but hopefully, they provide an idea of where to begin – together – in view of the long way that lies ahead of us.
NEWS
Rep. Atayde: No ghost projects in QC’s first district
3:30 p.m. October 27, 2025
Quezon City First District Representative Juan Carlos “Arjo” Atayde reiterated that there are no “ghost projects” in his district, following a personal inspection of seven flood control and drainage projects in his district.
“There are no ghost projects with us. There’s no ghost in District One. There’s no basis for claims that these exists. Maybe there’s just a need for proper coordination so information about the projects is accurate,” Atayde said after visiting sites in Barangay Bahay Toro, Del Monte, Project 6, and San Antonio.
Atayde’s visit confirmed findings from the Department of Public Works and Highways (DPWH) Quezon City 1st District Engineering Office, which stated in a September 19 letter that “all projects are verifiable on site,” referring to the seven projects questioned due to alleged lack of coordinates.
According to the DPWH, out of 66 alleged ghost projects reported in the media, only seven were located in Atayde’s district, where all of them were found to be completed or ongoing, with proper documentation, correct coordinates, and photographic evidence.
Verified projects included four flood control structures along Culiat Creek and Dario Creek in Barangay Bahay Toro, rehabilitation of Drainage Road 3 in Project 6, the West Riverside Pumping Station in Barangay Del Monte, and a flood control structure along San Francisco River in Barangay San Antonio.
Atayde said five of the seven projects were completed, while two were suspended due to pending issues.
He also visited two additional flood control projects to assess their status – one completed along Dario Creek and one suspended along Mariblo Creek.
Atayde assured to his constituents that public funds were used properly and allegations of ghost projects are “baseless”.
“The projects are not ghosts – they can be seen, touched, and are beneficial. It looks like Halloween came early for some people,” Atayde said.
He also called on those who accused him of benefiting from these projects to verify their information first.
Atayde emphasized he couldn’t benefit from these DPWH projects as they’re already in the National Expenditure Program (NEP), and he couldn’t unilaterally include them in the General Appropriations Act (GAA) as he’s not a member of the bicameral conference committee.
“We all want to end corruption and jail the corrupt, but we won’t succeed if we punish the wrong people,” the lawmaker said.
He further reiterated the DPWH’s assertion that there are no ghost projects in Atayde’s district.
“The evidence speaks for itself, and the evidence speaks the truth,” Atayde said.
NEWS
COA uncovers more fraud in Bulacan flood control projects, files new reports with ICI
6:30 p.m. October 26, 2025
The Commission on Audit (COA) has submitted four additional Fraud Audit Reports to the Independent Commission for Infrastructure (ICI), exposing further irregularities in flood control projects managed by the Department of Public Works and Highways (DPWH) – Bulacan 1st District Engineering Office.
These reports detail cases of mismatched sites, ghost projects, and the use of substandard materials, leading to significant public funds being misspent.
SYMS Construction Trading
Balagtas River Project (P46.35 million): Despite full payment, no real construction was found at the approved site. DPWH representatives directed COA to a different location where a structure made of unsuitable materials and exposed steel bars was observed. DPWH’s own records showed 0.00% completion.
Maycapiz-Taliptip River Project (P92.59 million): This project was reported as 100% accomplished and fully paid, yet COA found no flood control structure during inspection, labeling it a “ghost project.”
L.R. Tiqui Builders, Inc. and M3 Konstract Corporation (Joint Venture)
Barangay Piel, Baliuag Project (P96.50 million): Satellite imagery revealed an existing flood control structure at the approved site even before the contract began. DPWH pointed COA to an incorrect site, where an existing structure failed to meet project specifications.
DARCY & ANNA BUILDERS & TRADING
Barangay Carillo, Hagonoy Project (P74.11 million): Despite a supposed completion date of October 3, 2024, satellite images and COA’s inspection confirmed no structure was built at the approved site.
In all cases, DPWH-Bulacan 1st DEO failed to provide crucial supporting documents to COA, hindering validation of the projects.
Individuals Held Liable
Several individuals from DPWH-Bulacan 1st DEO have been identified as liable, including District Engineer Henry C. Alcantara, Assistant District Engineer Brice Ericson D. Hernandez, and Planning and Design Section Chief Ernesto C. Galang, along with various project engineers and company representatives from the involved contractors.
Those implicated may face charges under the Anti-Graft and Corrupt Practices Act, Revised Penal Code for malversation and falsification of documents, and violations of COA Circular No. 2009-001 and the Government Procurement Reform Act.
These audit findings will support the ICI’s ongoing investigation into government infrastructure project irregularities. COA Chairperson Cordoba’s directive on August 12, 2025, initiated an immediate audit of all DPWH flood control projects in Bulacan from July 1, 2022, to May 30, 2025. This new batch of reports contributes to the 25 Fraud Audit Reports already submitted to oversight bodies, reinforcing COA’s commitment to transparency and protecting public funds, in line with President Ferdinand Marcos Jr.’s call for accountability. Additional reports are expected as the audit continues.
NEWS
DITO delivers superior network performance, turning digital aspirations into possibilities
8:11 p.m. August 28, 2025
DITO Telecommunity showcased how superior connectivity transforms Filipino digital aspirations into achievable realities during the successful media launch of the telco’s latest campaign, Kaya DITO, held at Manila House, Bonifacio Global City, Taguig.
Built on True 5G standalone technology and as validated by a global leader in mobile analytics and insights, Opensignal, as the Philippines’ Fastest Mobile Network, DITO’s ecosystem proves that the Filipino telecommunity’s demand for seamless network connectivity, value-driven services and unified digital experience aren’t distant possibilities, but today’s basic expectations—this challenges what the telco industry has long normalized.
“For too long, outages, dropped calls, and overpriced data have been treated as normal. Let us say it bluntly: It is not normal. Every Filipino has limitless potential when equipped with the right tools, and the game is now changing since DITO has joined the fray and taken up the cause to disrupt the status quo—to deliver inclusive, next-gen technology to the Filipino people. “Kaya DITO!” is our battle cry to symbolically break that cycle, because we truly believe that Filipinos deserve better,” shared by DITO Telecommunity President Eric Alberto in the event.
The Telco that Truly Takes Care of its Users
DITO’s prepaid solutions eliminate the frustration of wasted data through Level-Up Packs with ViLTE technology, making DITO the primary telco offering unlimited DITO-to-DITO HD video calls and unli mobile calls. Combined with Viber and Prime Video inclusions and flexible data packages with longer validity periods, users can now maximize their every peso without worrying about abruptly expiring data allocations.
The Telco that Offers Value-Packed Postpaid Plans
DITOFlexPlan 888 redefines what postpaid should offer—comprehensive inclusions and generous data at prices that make sense for Filipino budgets. Whether you choose SIM-only or device bundles, these plans prove that premium network performance doesn’t have to break the bank, empowering users to pursue their goals without connectivity compromises.
The Telco that Brings True 5G Home Internet Convenience
DITO WoWFi Pro 365 makes home connectivity effortless with a year-long unlimited connection that works when you need it. Families enjoy the convenience of reliable internet for work, study, and entertainment without the inconvenience of data top-ups and complicated installations; just network performance that simplifies your digital life at home. Just ask any of your relatives and friends who have already ditched ordinary WiFi and jumped onto WoWFi— they will tell you what you’ve been missing out on.
The Telco that Built Everything You Need in One App
The DITO App represents one of the industry’s most comprehensive digital platforms, built from the ground up to handle the entire customer journey. From SIM and load purchase to account management and a wide range of OTT apps, users enjoy complete digital control with custom special offers, DITO Rewards points, and 24/7 customer support—managing everything while earning exclusive benefits.
Rep. Atayde: No ghost projects in QC’s first district
COA uncovers more fraud in Bulacan flood control projects, files new reports with ICI
DigiPlus earns first ASEAN Golden Arrow Award for corporate governance excellence
