Fortinets cyber security technology help organizations comply with the requirements of the Cyber Security Act and Personal Data Protection Act

Information Technology Press Releases Tuesday October 1, 2019 15:37
Bangkok--1 Oct--Communication Arts

Thailand has been rapidly responding to digital transformation to achieve the 4th industrial revolution as other parts of the world. On 27 May 2019, the Cyber Security Act of Thailand B.E. 2562 (2019) ("CSA") was published in the Government Gazette; therefore, it has been in effect since then. The Personal Data Protection Act (PDPA) has drawn various concepts from the EU General Data Protection Regulation (GDPR) and will come into effect next year. A one year transition period has been granted to companies and government agencies handling personal data to comply with key provisions of the Act. Therefore, the organizations in Thailand should comprehend the importance and find the ways to comply with these 2 Acts.

The main objective of the CSA is to secure national security in cyberspace, governing both public and private sector databases and information. CSA has applied the standards and guidelines of National Institute of Standard and Technology (NIST) to establish Cybersecurity Framework for cybersecurity privacy needs in Thailand in 5 core functions as follows:

1) Identify
2) Protect
3) Detect
4) Respond
5) Recover

Dr. Rattipong Putthacharoen, Senior Manager, Systems Engineering at Fortinet Thailand reveals that such Cybersecurity Framework provides the private sector organizations with a structure for assessing and improving their ability to prevent, detect and respond to cyber incidents. How to comply with the 5 Core Functions, the organizations need advance Security Fabric Platform from Fortinet. It is the first open architecture approach to security that dynamically adapts to and secure the IT infrastructure under Fabric-Ready Partner eco-system collaboration. Security Fabric Platform is broad (so as to have wide visibility of entire digital attack surface), integrated (so the protection covers across all devices, networks and appliances) and automated (the operations and response will be driven automatically by Machine Learning technology.)

Here are the 5 Functions and suggestions from Fortinet how to comply with them:

Organizations must develop an understanding of their environment to manage cybersecurity risk to systems, assets, data and capabilities. To comply with this Function, it is essential to have full visibility into your digital and physical assets and their interconnections, defined roles and responsibilities, understand your current risks and exposure and put policies and procedures into place to manage those risks.

Fortinet suggests at least to use the FortiToken and FortiNAC in order to identify and assess users; FortiInSight and FortiSIEM for asset and risk management purpose; FortiClient and FortiNAC for vulnerability assessment activities; next-generation firewall FortiGate, FortiAnalyzer and FortiManager for risk assessment and governance purposes.


Organizations must develop and implement the appropriate safeguards to limit or contain the impact of a potential cybersecurity event. To comply, the organization must control access to digital and physical assets, provide awareness education and training, put processes into place to secure data, maintain baselines of network configuration and operations to repair system components in a timely manner and deploy protective technology to ensure cyber resilience.

Fortinet proposes to use FortiGate as security gateway and FortiDDos, FortiMail to protect the mail system, FortiWeb to protect web applications, FortiClient as well as FortiProxy and the advance threat technology FortiSandbox to detect Zero-day attacks. To protect cloud environment, Fortinet has developed Fortinet-hosted services as SaaS type; namely, FortiSandbox Cloud, FortiMail Cloud, FortiWeb Cloud, and FortiCASB services. Moreover, Fortinet extends the on-IaaS security services with leading Infrastructure as a Service providers including AWS, Microsoft Azure, Oracle Cloud Infrastructure and Alibaba Cloud.


Organizations must implement the appropriate measures to quickly identify cybersecurity events. The adoption of continuous monitoring solutions that detect anomalous activity and other threats to operational continuity is required to comply with this function. The organization must have visibility into its networks to anticipate a cyber incident and have all information at hand to respond to one. Continuous monitoring and threat hunting are very effective ways to analyze and prevent cyber incidents in ICS networks.

In order to identify the unknown zero-day threat, Fortinet proposes FortiDeceptor and FortiSandbox appliances. Besides the FortiSEIM and FortiAnalyzer installed at Security Operation Center (SOC) help keeping and analyzing digital traffic log, that the organization shall supply once being asked.


Should a cyber incident occur, organizations must have the ability to contain the impact. To comply, the organization must craft a response plan, define communication lines among the appropriate parties, collect and analyze information about the event, perform all required activities to eradicate the incident and incorporate lessons learned into revised response strategies.

For endpoint detection response, Fortinet deploys FortiClient to perform activities to remedy the situation such as stop the users from opening the malicious file; and uses FortiNAC to quarantine the infected user and devices. Besides, FortiSIEM, FortiAnalyzer and FortiManager help analyzing computer log and making notifications automatically. With Fortinet's latest Security-Defined Network technology, the connection and communications among security appliances and networking appliances; such as FortiGate, FortiSwitch and FortiAP are improved.

Fortinet can help organizations to restore any capabilities or services that were impaired due to a cybersecurity event on case by case basis.

The Personal Data Protection Act imposes high penalties for non-compliance. For example, it is punishable with administrative fines (up to THB 5 million), criminal penalties (imprisonment up to one year and/or fines up to THB 1 million). Therefore, Fortinet urges all entities to immediately assess the internal personal data governance and start taking action for compliance. The road to full compliance with the PDPA could involve the engagement from all departments and deploying advance security technology.

Fortinet is confident the Security Fabric Platform which is composed of sensitive data protection; including Data Loss Protection, Access Control, Data Integrity and Data Exposure. All the said features are embedded in Fortinet's solution both Security as a Service (SaaS) type for on-premise protection and Infrastructure as a Service (IaaS) for cloud-environment protection. The involved appliance shall be FortiToken, FortiNAC, FortiWeb and FortiClient. The right approach for the company should be customized to fit the size and the business operation of each entity.

Latest Press Release

Huawei Recognized as a January 2020 Gartner Peer Insights Customers# Choice for Wired and Wireless LAN Access Infrastructure

Huawei, a leading global provider of information and communications technology (ICT) infrastructure and smart devices, is excited to share that they were named a January 2020 Gartner Peer Insights Customers' Choice for Wired and Wireless LAN Access...

Digital Technology is Driving Tennis Experience Beyond the #Golden Era#

Inclusion, access, experimentation and the social element will be key drivers as Tennis ushers in a new Era Tennis Radar: The Next Big Era, a report by the Infosys Knowledge Institute (IKI), the research and thought leadership arm of Infosys (NYSE:...

Zyxel joins elite ranks with 20-Year Award for security from ICSA Labs

Zyxel Networks, a leader in delivering secure, AI- and cloud-powered home and business solutions, was presented with a rare 20-Year Award for Excellence in Information Security Testing (EIST) from ICSA Labs . The Taiwanese company became one of only five...

Huawei Accelerates the Development of the HMS Ecosystem in Anticipation of the 5G Era

Huawei Consumer Business Group (BG) today hosted the Product and Strategy Virtual launch in Barcelona, Spain, during which it announced a series of new 5G products and strategy, as well as the latest progress of Huawei Mobile Services (HMS) and HUAWEI...

Huawei Builds a Solid Foundation for the Intelligent World 2030 with New Connectivity, Computing, Platform, and Ecosystem

Mobile World Congress (MWC) Barcelona 2020 has been cancelled due to the coronavirus outbreak but today, Huawei held its global Industrial Digital Transformation Conference. It was held via live streaming connecting guests from across the world including...

Related Topics