Malaysian expert: Protecting digital data must go hand in hand with digital transformation
VOV.VN - As Vietnam accelerates digital transformation, develops electronic archives and strengthens data sovereignty, the shift from paper-based to electronic records should be treated as a matter of national information security rather than simply a document digitization exercise.
Associate Professor Dr. Saaidal Razalli Bin Azzuhri, deputy head of the Faculty of Computer Science and Information Technology at the University of Malayashared his views on the challenges of protecting digital data in a media interview in Kuala Lumpur. Security, he added, should be built into every stage of the digitization process from the outset.
Addressing the development of digital archives for government agencies, Azzuhri said locating servers within national borders is necessary but not sufficient to ensure full control over data.
The key issue is where the servers are located, who controls the data, who holds the encryption keys, who has access to the system, and which legal jurisdiction governs the service provider.
For highly sensitive archives, Vietnam should not rely entirely on foreign-controlled cloud service providers, he stressed. However, this does not mean rejecting international technology. Major technology companies can still provide computing capacity, artificial intelligence, data analytics and services for systems handling less sensitive information.
According to Azzuhri, a tiered approach offers an appropriate solution. Under such a model, highly sensitive government data would be stored domestically, operate under Vietnam's jurisdiction and use encryption keys managed by the Vietnamese government. Foreign service providers should not have direct access to original data or hold core administrative control over such systems.
For less sensitive data, Vietnam can work with international cloud service providers, provided strict requirements are imposed on data location, control of encryption keys, audit capabilities, remote access restrictions and incident notification mechanisms.
Azzuhri pointed out that one of the biggest risks in developing digital archives is underestimating the threats that emerge during data migration. Once paper records are digitized, electronic data can be copied, searched, altered, leaked or destroyed rapidly if adequate safeguards are not in place.
He noted that vulnerabilities often lie not in the primary data files themselves but in supporting components such as optical character recognition (OCR) data, metadata, search indexes, temporary files, backups, access logs and copies created by storage service providers. Even when the original records are protected, these supporting files can become sources of sensitive data leaks if not properly managed.
The University of Malaya expert also said access control is a major challenge in digital environments. While access to records in traditional archives is limited by physical constraints, in electronic systems a compromised administrator account or a weak password can expose large volumes of data. Government agencies should therefore implement robust identity management, multi-factor authentication, least-privilege access controls, encryption, continuous monitoring and audit logging.
On ensuring data integrity, Azzuhri went on to say that digitized records must include mechanisms to verify authenticity and detect any unauthorized changes. This requires technologies such as hash values, digital signatures, timestamps and mechanisms to track the history of data processing. Security, he added, should not be treated as a post-digitization measure but integrated throughout the entire lifecycle, from scanning and storage to access, processing and eventual deletion.
Azzuhri stressed that absolute security does not exist in cybersecurity. Countries, including Vietnam, can benefit from global technologies while maintaining control over data of strategic importance. The priority, he said, is to build the capacity to protect and restore data sovereignty.