STACK Developer Conference 2022

14 Nov

15 Nov

16 Nov

17 Nov

Singaporeans’ love for the internet is undeniable. According to a 2020 study, almost 90% of the population uses the internet, with an average time spent of 8 hours a day. With such a high internet penetration rate, providing a good web browsing experience to consumers is paramount. What are some of the factors contributing to a good digital experience? In terms of usability, the website must be readily available, load quickly and is easily searchable, so as to deliver its intended outcome to users of all demographics and abilities in a simple and efficient manner. At the same time, as we strive towards becoming a more inclusive society, web accessibility is also becoming a major priority, to make sure that a person with disabilities or physical limitations has equal access to the content like the rest of the online community. Over the years, the Whole-of-Government Application Analytics (WOGAA) has developed services to help agencies have a better grasp of how their digital services are performing, as the Singapore government strives towards the Digital Government Blueprint’s goal of becoming a digital-to-the-core Government that serves with heart. In this presentation, we hope to shed more light on how WOGAA helps to drive agencies to achieve excellence in areas such as usability, digital service availability and web content accessibility. This includes initiatives such as the Digital Service Awards, which provides positive reinforcement to motivate public officers to improve their digital services, as well as the Digital Service Dashboard, incorporating a set of KPIs to nudge agencies to achieve service excellence in areas such as Web Accessibility and Search Engine Optimisation. As Steve Jobs once said, If a user is having a problem, it's our problem. We hope that service owners recognise that usability is a shared responsibility among all stakeholders of a product, and through this presentation, audiences can learn about best practices and gain useful tips on how to better leverage WOGAA to improve their digital services to benefit their end users.

Mr Seah Ming Shu

Data Scientist, GovTech

View Profile

In an increasingly manpower-lean operating environment, it is essential to design and develop applications that are resilient and minimise manpower efforts to monitor and mediate service interruptions. Application requirements have changed and escalated drastically over the past decade and more so with the advent of cloud. A fail-safe app development will need to employ techniques and methodology from multiple disciplines. For example, there is a plethora of different frameworks and approaches to building resilient applications: 1. System Reliability Engineering (SRE). This seeks to take a data-driven approach, with feedback for continuous improvement decisions. 2. DevSecOps with SHIP-HATS. This seeks to have a holistic approach to chain the activities from development, security to operations so that there are no gaps left behind to achieve a quality system that is ‘fail-safe’ to security vulnerability. 3. Architecture approaches such as Reactive architecture seek to be responsive, elastic, resilient, and message-driven. 4. Build compliant and cost-effective solutions by moving up skill levels in cloud adoption maturity with Containerisation, serverless solutions to minimise maintenance overheads, and IaC for automation maximisation. 5. Importantly, how do we align to WOG-level SGTS services, and direction including authentication – WOG AD/AAD/CAM, GTBA. 6. And, there is of course what I would call ‘common sense’ – foundations of computer science that are irrespective of the technologies that will be employed to build resilience of systems; such as the handling distributed transactions, respecting what constitute global state. In this talk, we seek to un-tangle the different approaches, which are all correct because they come from different stakeholder’s perspective. But how do we tie them together? What are the practical practice-able things that can be done to achieve ‘Fail-safe application development’? This is what this talk will share and will be interesting to seek feedback from practitioners from the audience in the session.

Mr Tan Pow Hwee

Director, Systems and Programmes, GovTech

View Profile

In 2021, cyber criminals impersonating OCBC Bank through text messages successfully scammed hundreds of Singaporeans of their life savings. In May ‘22, the FBI reported up to $43 billion dollars of business losses to cyber criminals due to similar social engineered attacks between 2016 and 2021. Instead of a spray and pray method where the same attack is sent to multiple users, cyber criminals are now pivoting to highly targeted social engineered attacks. They attempt to gain your trust by impersonating someone you already know or trust - your manager, your colleagues etc. They then aim to trick you into executing the cyber attack, be it running malware, providing your credentials or sending money to a fake bank account. However, legacy security solutions that have defended us against cyber threats are built on brittle rules and threat intelligence feeds - this lends them to perform poorly against these zero day, hyper targeted attacks. In order to solve these emerging threats, one would need a completely new approach - we propose that a behavioral detection engine with modern ML techniques would deliver a solution with both higher recall and precision. In place of building lists of known bad entities, we propose first building profiles of what is considered normal within user environments. Machine Learning models trained to detect deviations against this baseline understanding of normality are then capable of differentiating attacker vs safe user behavior with a higher level of accuracy. I am a founding engineer at Abnormal Security, a next-gen Email Security startup. I’ve spent the last four years building this behavioral detection engine that aims to detect all types of malicious emails, especially socially engineered email attacks (e.g. sending a Fake Invoice while impersonating a Vendor). In my proposed talk, I will discuss the unique parameters of modern cybersecurity attacks in relation to machine learning, particularly the adversarial nature of the problem and how it shows up in data and model performance. Using the email security problem as an example, I will then discuss the requirements of a robust threat detection system, describing how both ML and software systems are required to solve cyberthreats in different time horizons. I will then focus on our machine learning stack, discussing how we incorporate the behavioral detection approach with our feature aggregation engine, the various components of ML solution and their various results.