Mobile Guardian breach: Who is responsible for backups?

On August 4th, a global cybersecurity breach affected Singapore’s education system. Around 13,000 students from 26 secondary schools were blindsided when the Mobile Guardian app was wiped out by a hacker.  
The breach happened the night before many were set to sit for their preliminary examinations. 
Students, hoping to squeeze in one final revision, were shocked when they opened their school-issued iPads and Chromebooks to find four years’ worth of notes and worksheets missing.  
Anyone familiar with Singapore’s rigorous education system can imagine the sheer panic that set in, as several students told CNA journalist Ang Hwee Min.
Hwee Min came on the Deep Dive podcast to share with hosts Steven Chia and Crispina Robert how some students had complained about pain points involving the app. 
So what goes into the procuring of an IT system and who should ensure failover processes are in place? May Chng, chief operating officer and co-founder of Flexxon, emphasises that while routine back-ups are important, the pressure should not fall solely on individuals.
She joins chair of SGTech Cyber Security Chapter and CEO of Athena Dynamics Ken Soh to discuss the need for proactive technological solutions to reduce the burden on people to stay constantly vigilant.
Here’s an excerpt from the conversation:
Crispina Robert:
So I want to talk about the failover processes. May, we were talking about this before we started recording, and you were saying that it’s almost like a castle, right?
Your cybersecurity is like the moat. You make sure that the bad actors don’t cross and climb over your walls. So one of the things that came up in this was that the (students) were at complete mercy (of the app). That means the notes wiped out, (and) then they start crying, saying, “Oh my god, I’m going to fail,” because there was no backup. 
Steven Chia:  
That was a user problem. No backup. 
Crispina:
No, but if you’re a young kid … 
Steven:
I back up my stuff every other day at least. When I walk into my kid’s room, (I ask), “Did you back up your computer?” because (my daughter will) come to me saying, “Oh, it’s not working.” I’m like, “Did you back up?”
Crispina: 
Are we very disciplined about backing up?
Steven:
Once you’ve been hit, you will become a convert. 
May Chng:
So in this case, Steven has a very strong feeling about backup because he thinks this is very important. That’s how he takes back control. But on the other hand, that’s where the third party comes in to say that (they) have the solutions in place to safeguard (data).
Crispina:
See, that’s the thing. Whose role is it? If I’m using your product, then you should help me right?  
Steven:
Crispina:
I think you are not typical; I don’t do backups that often. 
Steven:
Maybe because I’ve done so much tech stuff, I’ve come to realise that things always break down. Nothing is ever 100 per cent. 
Crispina: 
So whose job is it? In Mobile Guardian’s case, is it the school’s job to say, “Everybody back up?” 
May:
Steven:
Like car rental, did you pay for the extra excess? 
May:
So the package that you purchase, what is the criteria, the requirement, and the service maintenance that you pay for? 
Find more episodes of Deep Dive here.
A new episode of Deep Dive drops every Friday. Follow the podcast on Apple or Spotify for the latest updates.
Have a great topic for us? Drop the team an email at cnapodcasts [at] mediacorp.com.sg