Securing Your Most Critical Digital Assets.
SiberKASA Aspirations
SiberKASA is a initiative by CyberSecurity Malaysia exclusively to develop, empower, sustain and strengthen cyber security infrastructure and ecosystem in Malaysia to combat the growing complex and sophisticated cyber threats and cyber attacks. This is an effort to ensure continued development of cyber security solutions and make avail  CyberSecurity Malaysia’s products and services to industries and individuals in the country.
We Have Solution
For Every Cyber Security Problems
CyberGURU is a dedicated platform for nurturing
information security practitioners and advancing cyber
security professional development through a wide
range of competency-based training programmes and
certifications. The platform also promotes knowledge
sharing by engaging leading industry experts,
academicians, and policymakers, while fostering both
local and international collaborations.
CyberGURU offers a diverse portfolio of competency
and professional certification courses tailored to meet
the evolving demands of the cyber security landscape.
These include training tracks ranging from
fundamentals to advanced certifications in areas such
as Incident Handling, Digital Forensics, Security
Assessment, Cryptography, Common Criteria, and
Security Management.
Behavioural Competency Assessment (BCA) for
information security personnel is an instrument that
assess the behavioural elements that contribute to a
culture of high performance, which can be observed
through people’s actions and behaviours. Utilizing
psychometric science and methods, BCA can effectively
complement other forms of testing; offering unique
and essential insight into individual performance at
work and strengthen professional excellence in
information security industry.
Vulnerability Assessment and Penetration Testing
(VAPT) is a critical service provided to both public and
private organizations to identify and address security
weaknesses within their IT environment. This
comprehensive service involves a detailed assessment
of the system to uncover vulnerabilities and potential
entry points that could be exploited by cyber threats.
SPA identifies security vulnerabilities within an
organisation based on internationally recognized
standards, including OWASP, OSSTMM, and PCI-DSS to
help prevent breaches, reduce the impact of any
incidents, and protects organisational reputation.
CyberSAFE® (Cyber Safety Awareness for Everyone) is a
public awareness program developed by CyberSecurity
Malaysia to educate and empower the general public
on the importance of cybersecurity and to promote a
safer digital environment for all.
Visit CyberSAFE®: L.I.V.E Galeri to experience various
CyberSecurity services for educational and awareness.
Rent the space for your own technology networking
events
A national certification scheme designed to strengthen
Malaysia’s cyber security capacity and capability by
recognising and certifying qualified personnel. The
framework is aligned with international standards,
including ISO/IEC 17024 for personnel certification,
ISO/IEC 9000 for quality management processes, and
ISO/IEC 27001 for information security management
CSIRT Consultancy offers specialized expert services to
organizations in the areas of people, processes, and
technology. This consultancy creates tailored
implementation plans to help develop and establish a
CSIRT within organizations. Additionally, the service
provides Incident Handling and Network Security
training, job attachments, and professional
memberships with FIRST, APCERT, and OIC-CERT.
Consultancy service to help organisations to build or
enhance their cyber incident response plan strategy.
Digital Forensics Quality Management System Expert
Consultation
Identifies security weaknesses in mobile applications,
devices, and operating systems and evaluates risks
such as data leaks, insecure APIs, weak authentication,
and malware.
Provides Manage, Detect & Response (MDR) services
that monitor, analyze, detect, and protect against
potential cyberattacks. The service covers endpoints
such as servers, workstations and laptops.
Technology Security Assurance (TSA) is a national
scheme initiated by CyberSecurity Malaysia (CSM). It is
an assurance where ICT products are evaluated based
on Mandatory Security Functional Requirements
(MSFRs) developed by the Information Security
Certification Body (ISCB).
Information Security Management Consulting provides
expert guidance to organizations in protecting and
preserving the confidentiality, integrity, and availability
of their information and information systems through
the implementation of an Information Security
Management System (ISMS) in accordance with the
ISO/IEC 27001 standard.
Tailored Information Security Management related
services designed to address ISO/IEC 27001
requirements e.g., determination of ISMS scope, risk
assessment, implementation of controls and general
information security assessment.
A web-based assessment tool that helps organizations
assess their data privacy governance, readiness, and
compliance, and identify implementation gaps, based
on the ISO/IEC 27701 Privacy Information
Management System (PIMS).
DPGP is an evaluation and testing for ICT / IoT product
or application, based on data protection requirements
outlined in Malaysia’s Personal Data Protection Act
(PDPA) and international best practices. It also aligned
with relevant ISO data privacy standards. DPGP
evaluates how a product manages personally
identifiable information (PII) throughout its lifecycle,
including the functional roles involved, to guarantee
strong privacy protection for the product.
DPIA assists organizations access the potential impacts
on privacy of processes, information systems,
programs, software modules, devices, or other
initiatives that handle personally identifiable
information (PII). It also identifies necessary actions in
order to treat privacy risk. The DPIA is developed
based on ISO/IEC 29134 Guidelines for Privacy Impact
Assessment.
Evaluates exposed assets of an organization, including
networks, systems, and applications, to identify and
prioritize vulnerabilities that could be exploited by
attackers. This proactive approach helps mitigate risks
by addressing weaknesses before they are exploited.
Continuously tracks online footprint of an
organization, including publicly accessible systems,
leaked data, and potential vulnerabilities, to
understand how adversaries might target them. It
enables organizations to stay ahead of threats by
monitoring and mitigating exposure in real-time.
Detects, analyses, and responds to cybersecurity
threats in real-time by monitoring network traffic for
malicious activities. It quickly blocks or mitigates
threats, reducing response time, minimizing human
error, and strengthening overall security resilience.
Identify vulnerabilities and test their exploitability to
assess potential impact of an attack. This analysis
provides actionable insights to address weaknesses
and strengthen overall security posture.
Lebahnet, based on Honeypot technology, provides
valuable insights into network trends and malicious
activities, supporting MyCERT in incident handling and
advisory services. Honeypots are systems designed to
simulate legitimate sites, luring malicious software by
appearing vulnerable. This approach allows
cybersecurity researchers to detect, monitor, and
counteract malicious activities by analysing actions
during the intrusion phase and examining attack
payloads.
Phishing Assessment is designed to test the awareness
of staff within an organization by sending simulated
malicious emails. The goal of this assessment is to
evaluate the overall responsiveness of staff to phishing
attempts and directly measure their compliance with
internal policies and procedures.
Mobile application assessment to ensure mobile
applications meet the established required
cybersecurity criteria.
PJuRA helps organizations assess their data protection
practices against both local and international privacy
laws. This structured assessment identifies risk
exposure across different legal jurisdictions and
highlighting potential compliance gaps. By
understanding these risks, organizations can
strengthen their data protection measures and build
greater customer trust by demonstrating their
commitment to data security and privacy.
A service that validates and verifies the security
properties of a blockchain and smart contract
applications. With this, businesses gain insight into
their overall blockchain and smart contract security
posture, as well as the ability to address any potential
flaws in their blockchain-based solutions or
applications.
Evaluation and testing of ICT products and Protection
Profiles (PP) using the Common Criteria Methodology
(based on ISO/IEC 15408 and ISO/IEC 18045) for
certification under the MyCC scheme.
IPSA is a security functional testing and/or
vulnerability assessment and penetration testing
service for ICT products
PTSP ensures penetration testing service is delivered
by local cyber security consulting companies that are
meeting the requirement set by CyberSecurity
Malaysia
We provide expert consultancy services for the
development of ISO/IEC 17025 laboratories to offer
Common Criteria evaluation services.
The scheme is based on the ISO 22301 international
standard for organization that envisions for resiliency.
It helps to plan an effective business continuity
management to protect against, reduce the likelihood
of, and ensure business recovers from disruptive
incidents. This is parallel to the national requirement
towards creating a resilient National Critical
Information Infrastructure (NCII) .
A security validation and analysis service that includes:
- Cryptanalysis of cryptographic algorithms to assess their security strength.
- Conformance testing of cryptographic algorithms against a standard document.
- Evaluation of the randomness characteristics of a random number generator.
- Cryptographic S-Box Testing checks the strength of encryption's core to ensure they resist code-breaking.
MySEAL establishes requirements and guidelines for
trusted cryptography products in Malaysia, aligning
with the National Cryptography Policy to achieve
cryptographic sovereignty and support cryptographic
science; it provides a list categorizing algorithms into
AKSA (Existing Cryptographic Algorithms) and AKBA
(New Cryptographic Algorithms), with comprehensive
evaluation criteria overseen by a committee led by
CyberSecurity Malaysia, marking a significant
milestone since Malaysia's National IT Agenda in
pursuing information security fundamentals.
CyberSecurity Malaysia operates a Federal Information
Processing Standard (FIPS) Publication 140 testing
laboratory that provides independent technical
services in the field of cryptographic algorithm testing
and verification testing of cryptographic module
software and hardware.
Gain a competitive edge with our FIPS 140-3
Cryptographic Training, designed to provide in-depth
knowledge of cryptographic module validation in
alignment with ISO/IEC 19790 and ISO/IEC 24759
standards.
The CSM27001 Scheme supports the National Security
and Public Safety pillar under the Economic
Transformation Program (ETP) by enhancing the
resilience of both the National Critical Information
Infrastructure (NCII) and the broader industry.
Additionally, the scheme contributes to the Catalyst
for Industry Growth pillar by enabling ISO/IEC
27001-certified organizations to benchmark
themselves against global standards, there by
enhancing their competitiveness in the international
market.
ISO/IEC 27701:2019 is a privacy extension to ISO/IEC
27001. The goal is to enhance the existing Information
Security Management System with additional
requirements in order to establish, implement,
maintain, and continually improve a Privacy
Information Management System. The standard
outlines a framework for Personally Identifiable
Information Controllers and PII Processors to manage
privacy controls to reduce the risk to the privacy rights
of individuals. ISO/IEC 27701 is intended to be a
certifiable extension to ISO/IEC 27001 certifications.
MyCV is a national scheme for validating and certifying
the Cryptographic Module Validation (CMV) and the
Cryptographic Algorithm Validation (CAV) services
based on ISO/IEC 19790 and ISO/IEC 24759 standard
and also to supports Dasar Kriptografi Nagara (DKN) or
National Cryptoraphy Policy (NCP) implementation.
Evaluation and testing of products developed and
operated on cloud computing platforms, managed by
Cloud Service Providers (CSP) for Platform as a Service
(PaaS) and Software as a Service (SaaS).
Cloud security audit services for cloud computing
platforms, managed by Cloud Service Providers (CSP)
for Platform as a Service (PaaS) and Software as a
Service (SaaS), based on the security requirements
stated in ISO/IEC 27017 and ISO/IEC 27002.
Rental of ISO 17025 Accredited testing facilities,
equipment and resource to the public and private
organizations to conduct cybersecurity evaluations or
testing in a controlled environment.
MyCC Scheme assists in raising the quality and
competitiveness level of Malaysian ICT products,
benchmarked against global Common Criteria
requirements.
A focused security evaluation conducted on individual
computing systems (hosts) within a network. These
hosts can include servers, workstations, laptops, or any
other network-connected devices with an operating
system. The assessment aims to identify security
vulnerabilities and misconfigurations specific to each
machine.
A focused security evaluation conducted on individual
computing systems (hosts) within a network. These
hosts can include servers, workstations, laptops, or any
other network-connected devices with an operating
system. The assessment aims to identify security
vulnerabilities and misconfigurations specific to each
machine.
CyberDrill is an activity conducted to assess an
organization's cyber capacity by evaluating its ability to
detect and respond to security incidents. This follows a
defined methodology and is executed using various
tools and infrastructure provided by CyberSecurity
Malaysia. During the simulated cyber drill exercise,
organizations' readiness is tested based on their
existing cyber security incident response procedures,
allowing for the identification of areas for
improvement.
CyberDiscovery is a specialised cyber forensics service offered to both individuals and private organizations. It is designed to address concerns related to Electronically Stored Information (ESI) as digital evidence, particularly within the context of civil litigation. The service focuses on uncovering critical information and provide clear, defensible answers to support legal proceedings.
CyberDiscovery offers the following services:
- Onsite Evidence Collection and Preservation Secure acquisition and safeguarding of digital evidence from electronic devices and storage media, ensuring chain-of-custody compliance.
- Evidence Examination and Analysis In-depth forensic analysis of collected data to identify, interpret, and reconstruct relevant digital activities.
- Expert Witness Testimony Provision of qualified forensic experts to present findings and opinions in court, supporting legal arguments with professional credibility.
CyberDiscovery upholds the highest standards of integrity, confidentiality, and forensic best practices, delivering reliable and court-admissible results.
To assist organization by providing solution, proactive
and responsive steps to eradicate and remediate
security threats and vulnerabilities (Root Cause
Analysis).
MyCyberSecurity Clinic (MyCSC) offers trustworthy and convenient data recovery and data sanitization services, ensuring that all data is handled in a safe, secure, and confidential manner.
- Data Recovery Services: Designed to retrieve data from digital storage media that are damaged, failed, corrupted, or otherwise inaccessible. Our expert team uses advanced techniques to maximise the chances of successful recovery while maintaining data integrity.
- Data Sanitization Services: Provide organisations with a reliable solution for the secure and permanent deletion of data from storage devices that are being retired, upgraded, or repurposed. This helps prevent data leakage and ensures compliance with data protection policies.
Our services are aligned with industry best practices to support your organisation’s data lifecycle management needs with confidence and peace of mind.
Deep-dive technical support for complex or escalated
incidents.
Analysis of system/network logs to detect anomalies and
the root cause of incidents.
Creation of tailored response procedures for various incident types.
I'm an organization with a unique need.
Everyone Else Has Claims. We Have Proof. Read our case study.
What client say about us
CyberSecurity Malaysia has proved itself again to be one of the most efficient and effective government organization that spurs cyber security awareness among Malaysians and SMEs as to be as par with worldwide level of preparedness (in cyber security). We adore CyberSecurity Malaysia's multi-talented teams that adhere to adapt and adopt latest technologies to overcome the becoming- more complex cat-and-mouse situation in cyber security while keeping it the simplest way to implement and educate cross- vertical industries in Malaysia. Kudos to CyberSecurity Malaysia, and we hope to see more and continuous endless support from CyberSecurity Malaysia to Malaysians as a whole.
Nurazam Malim
CEO, Twistcode Technologies Sdn Bhd
CEO, Twistcode Technologies Sdn Bhd
The ProximaX Sirius blockchain was certified by Cybersecurity Malaysia under Cryptographic Algorithm Conformance testing. It's a great assurance to both the users of the Sirius blockchain and clients of ProximaX that the Sirius blockchain adheres to Malaysian national and international standards and practices.
Joe Chai
Solutions Architect, ProximaX
Solutions Architect, ProximaX
Ready to elevate knowledge and strengthen defense?
Talk to our cyber security expert.