Taiwan Fosters Top Talent to Upgrade National Cybersecurity

A+ A- go back


Interview with Lee Yuh-jye, Deputy Executive Secretary of the Board of Science and Technology, and Chien Hung-wei, Director of the Department of Cyber Security, Executive Yuan
 

Earlier this year, computer giant Acer suffered a REvil ransomware attack that exploited a vulnerability in the company's Microsoft Exchange server and demanded a ransom of USD$50 million (approximately NT$1.425 billion). Acer has not been the only victim—both CPC Corporation and Formosa Plastics Group, two key energy companies in Taiwan, have also been targeted within the past few years. With the continued sophistication of modern-day hacking and concealment methods, cyber security has become a serious national security issue. Taiwan's "Cyber Security is National Security" strategy is a call for the formulation of anti-hacking tactics to be elevated and executed at the national level. The construction of cyber security infrastructure has been in progress nation-wide since 2001. To date, five phases have been carried out, resulting in the comprehensive improvement of Taiwan's cyber defenses. To ensure the security of the country's digital data and communication in the face of fiercer attacks, the Executive Yuan proposed the National Strategy for Cyber Security Development Program, which also serves as a key foundation for national cyber security policies. The program additionally aims to create a national-level joint cyber security system that will enhance protection mechanisms, strengthen the growth of independent cyber security industries, and cultivate top-tier cyber security talent.


Extensive Joint Cybersecurity Builds a Safe and Reliable Digital Country

The COVID-19 pandemic has had a profound impact on work and lifestyles worldwide. New media technology such as online meetings, online courses, and IoT have become mainstream, but each has its own hidden cyber security risks. According to Symantec’s 2017 "Internet Security Threat Report," Taiwan was ranked as having the highest levels of identity theft in Asia and the fifth-highest in the world. Microsoft reported in 2020 that the incidence of malware attacks in the Asia-Pacific region was significantly high, measuring 1.6 times higher than the global average. In comparison, Taiwan's incidence rate was 1.2 times higher than the global average. KPMG International Limited's latest "2021 Taiwan Enterprise Cyber Security Survey" additionally revealed that 50 large domestic enterprises in Taiwan scored only a C for network protection. This indicates that company servers are vulnerable to attacks by even everyday hackers.

In light of such statistics, the Taiwanese government is currently executing the sixth phase of the National Cyber Security Program of Taiwan (2021-2024) with the goal of establishing Taiwan to be a safe and smart country. This will be achieved through three major policies: turning Taiwan into a hub for cyber security research and training in the Asia-Pacific region, constructing a basic cyber defense network, and promoting a public-private partnership to create a safe cyber environment. Chien Hung-wei, Director of the Department of Cyber Security, Executive Yuan stated, "The Department of Cyber Security (DCS) was established in 2016, but it began the National Cyber Security Development Program (NCSP) as early as 2000. Throughout the years, many countries have realized that an established network infrastructure lacking in proper cyber defense mechanisms is just as vulnerable to hackers mining for classified information." 

Setting up anti-hacking mechanisms has been a long-term endeavor in Taiwan. To-date, a total of six phases have been implemented. The Phase 1 Mechanism Program (2001-2004) entailed the construction of cyber security protection systems and the complete classification of cyber security responsibilities in government agencies. The Phase 2 Mechanism Program of (2005-2008) comprised of fortifying the capabilities of the aforementioned systems by establishing the National Security Operation Center (NSOC). Phase 3, referred to as the Phase 3 Development Program (2009-2012) focused on enhancing system response capabilities and upgrading report and response mechanisms. The Phase 4 Development Program (2013-2016) enhanced joint-defense monitoring mechanisms for cyber security protection management and intelligence-sharing mechanisms. The Phase 5 Development Program, referred to as the National Cyber Security Program of Taiwan (2017-2020), included the enactment of the Cyber Security Management Act and the completion of a national cyber security united defense force. To continue enhancing Taiwan’s cyber security defense capabilities, the Phase 6 Development Program will further implement measures to create a smart nation that is both safe and resilient.

With the political and economic situation of the US-China trade war, the threat of state-sponsored hackers, and internal theft of key technology, Lee Yuh-jye, Deputy Executive Secretary of the Board of Science and Technology (BOST), believes that hackers are becoming smarter in order to reap illegal benefits. This trend has had severe ramifications for corporate and national security, which have suffered from cyber-attacks such as malware, ransomware, and drive-by downloads. The demand for protection for 5G, IoT, AI, and industrial innovation continues to rise. As a result, this has propelled the formation of the cyber security industry and the development of cyber security services and products. Lee pointed out that rather than simply providing subsidies, the government will form a dedicated cyber security research center to coordinate relevant policymaking and forward-looking research.


Cyber Security Guides Industry Growth

The annual growth rate of the global cyber security industry market in 2020 exceeded USD$101.6 billion (approximately NT$2.84 trillion). Taiwan's cyber security industry has been even more undaunted by the pandemic's effects. With a working population of over 8,900 people, the output value of the industry has reached NT$55.2 billion. By 2025, over 10,000 people are projected to invest in the industry, driving output value past NT$78 billion. In reference to these estimates by the Industrial Economics & Knowledge Center (IEK), Chien stressed that the industry has become increasingly structured following the approval of the Cyber Security Industry Development Action Plan in 2018. The government has also acted to promote industrial development, expand domestic demand for cyber security products, and promote industrial test standards. To date, 325 products and services from 52 businesses have received approval, leading to increased product placements and industry momentum. The government, in one such instance, has assisted the industry by including cyber security products in joint supply contracts for all levels of government.

Chien believes that the Five Plus Two Industry Innovation Plan and DIGI+ have guided industries towards digitization. However, if this is not matched with an equally robust cyber security foundation, then the results will be but a house built on sand. As such, President Tsai Ing-wen hopes to promote the cyber security industry in order for it to be integrated into all six core strategic industries. Of the six industries announced by the National Development Council in 2021, the cyber security industry has received approximately NT$8.755 billion in investments, accounting for 7.74% of the funding for the Six Core Strategic Industries Program. Subsidies have been prioritized for core industries to take inventory and introduce necessary cyber security solutions and other related forward-looking technology such as 5G and semiconductors. The development of international-level cyber security solutions in emerging fields (e.g. AIoT and medicine) will also be given higher priority. 

Lee commented that cyber security received little attention in the past and that there are different levels of cyber security: While the general public is likely more concerned about their personal data, the government as well as enterprises use a more macro perspective to view cyber security. What requires protection for them is primarily information and confidential files located in computer network transmission networks and storage servers. The current market for Taiwan's cyber security industry does not compare to that of the semiconductor industry. However, in light of international trends and the ever-growing number of threats and cyber-attacks, it is clear that Taiwan cannot solely fixate on output value. The government must build upon existing cyber security infrastructure to consolidate its defenses, expand the scope of talent cultivation programs, and spur the growth of the cyber security industry. Only then can Taiwan become a smart, cyber-secure country.


Boosting Industry-University-Academia Partnerships to Raise Top Talent

Attracting high-level talent from around the world and cultivating independent innovation and research capabilities are central to the development of the cyber security industry. In response to the demand for cyber security talent, the Executive Yuan has requested various government agencies and departments to allocate resources for creating a suitable environment for cultivating talent. The innovative model of industry-university collaboration has been a highlight in these efforts. The Ministry of Science and Technology (MOST) and the Ministry of Education (MOE) have gathered cyber security teaching faculty from domestic universities and colleges to systematically cultivate in-demand talent. Two years since then, the measures have successfully connected universities and industries.

Chien emphasized that the Executive Yuan has established the Center of Excellence for Cyber Security in order to drive the digital upgrade of domestic industries, promote forward-looking research, and cultivate an abundance of top-tier talents. The goal is to transform Taiwan into a base for high-caliber cyber security talent and technological innovation in the Asia-Pacific region. Sufficient teaching and research resources will be provided in order to fortify the training of Taiwan's top talent and the capabilities of forward-looking cyber security research. In order to attract talent, MOST and MOE have collaborated to increase staff and teaching resources for cyber security in higher education. The most immediate effects have been seen in the provision of generous salaries to invite first-class domestic and international cyber security competition teams, teachers, academic talent, and other high-level researchers to instruct cyber security courses. This has encouraged more frequent exchange between colleges and universities, exemplary talent, domestic and foreign industries, and academic research institutions. With the support of the MOE, four universities (National Taiwan University, National Yang Ming Chiao Tung University, Tsinghua University and National Sun Yat-sen University) have established five departments dedicated to the study of cyber security.

Lee pointed out that although demand is high in the cyber security market, Taiwan is facing a talent shortage. The country cannot continue to rely solely on a singular talent training channel or on traditional education, as it will run the risk of widening the gap between knowledge and practice. Modern-day cyber security education requires collaborations between multiple channels including education, private certification training programs, government-sponsored vocational training, and on-the-job education in various industries. In 2018, the Executive Yuan established the Art of Cyber War Academy, where private training units are subsidized to strengthen the capabilities required by enterprises to offer practical training for cyber security talent. The government is additionally recruiting top-tier talent from around the world, cultivating power for independent innovation and research, and aims to establish a demand-oriented cyber security personnel training system to train high-quality talent. Lee used hackers as an example—though they may not necessarily have an educational background in cyber security, their intelligence, creativity, and ambition more than compensates for this gap. Similarly, cyber security talent do not necessarily need to receive traditional education in the field, however they must possess basic skills and knowledge of information and cyber security, years of practical experience, and the ability to improve upon existing technology.

Regarding the future of Taiwan’s cyber security industry, Lee stated, "Taiwan's political and economic situation makes it a global hotspot for cyber security. As a result, it possesses adequate cyber security intelligence. Combine this with a well-developed ICT industry and a large pool of talent, and it becomes clear that Taiwan has an inherent advantage in developing a cyber security industry." The government encourages national task force-oriented research, promising key core research, and R&D results with market potential to engage in technology transfer or establish new startup companies. Since Taiwan’s edge in ICT and semiconductor manufacturing is unparalleled, the country's cyber security industry is certain to reach global status.


Taiwan Rises to be Key Global Hub for Cyber Security Industries and Talent

Although the pandemic has accelerated Taiwan’s digital transformation and information dissemination, it has also brought cyber-attacks of growing complexity. This has led to a surge in the demand for cyber security by national enterprises. To date, the government has supported the establishment of 25 startups, including 11 groups of white hat hackers such as HITCON, TDOH, HackerSir, and UCCU with great results. The startups will soon be provided with regulatory sandboxes to streamline product R&D. The provision is expected to facilitate product maturation and promote cross-domain industry partnerships. The Center of Excellence for Cyber Security exists not only to further the industry, but also to support the fight against cybercrime by advancing cyber security protection and, more importantly, elevating the quality of research and training. For Taiwan, situated in an important geographical location and vulnerable to cyber-attacks, the center serves as a decisive research facility dedicated to cyber security. The Executive Yuan is supplementing cyber security manpower through the five-year Information Security Incubation Program. The program is both a blueprint for the intensive cultivation of cyber security excellence and one of the most important promotion projects by the Center of Excellence for Cyber Security. From 2021 to 2025, NT$1.636 billion will be invested to complete the construction of four major development mechanisms that will create a national-level cyber security taskforce: Cyber Security Research, Cyber Security R&D, Cyber Security Practice, and Cyber Security Management.

During this year's CYBERSEC Conference, President Tsai Ing-wen remarked that as the world enters the 5G and AIoT generation, Taiwan will move towards national-level digital transformation and develop the country’s six core strategic industries. The government is expected to establish a digital development department in 2022. The department will integrate industries relating to telecommunications, information, cyber security, networks, and communication. It is also expected to establish a special cyber security government agency to enhance the protection of critical infrastructure and core databases. Other measures include strengthening organizations, implementing legal systems, cultivating talent, and supporting related industries. Government and private sector partnerships are greatly anticipated to bolster the domestic cyber security industry, expand its international presence and enhance Taiwan's cyber security defenses to support global demands. The Taiwanese cyber security industry will evolve into a trillion-dollar industry and quickly rise to become a world hub for cyber security industries and talent.

Go Back