Prof. Ainuddin Wahid Abdul Wahab, Centre of Research for Cyber Security & Network (CSNET), Universiti Malaya.
Prof. Dr. Ainuddin Wahid Abdul Wahab of the Centre of Research for Cyber Security & Network (CSNET), Universiti Malaya, is featured in The Sun on 27 July 2026 in the article "Khairul Aming Data Leak Raises Questions Over Companies' Ability to Detect Insider Access", following the alleged unauthorised disclosure of the influencer's personal telco account details.
Beyond After-the-Fact Audit Trails
Prof. Ainuddin argues that organisations should not rely solely on audit trails that identify who accessed customer records after an incident, they need monitoring systems capable of detecting and responding to suspicious activity before confidential information is disclosed. The question is not simply whether someone holds valid credentials, but whether there is a legitimate operational reason to access a customer's records.
"It is like a bank employee who only needs to verify a customer's name but is nevertheless given access to the person's account balance and entire transaction history," he tells The Sun.
Least Privilege and Automatic Alerts
He recommends that companies adopt the principles of least privilege and segregation of duties, so employees can only access information necessary for their roles, with automatic alerts triggered whenever sensitive or high-profile accounts, particularly those of VIPs and celebrities, are accessed, flagged for immediate review.
"Security teams should be able to verify immediately whether an account had been accessed for a genuine customer service matter or an authorised work assignment," he says, adding that regular audits should identify unusual access before it escalates into a public issue.
The full article, written by Faiz Ruzman and also featuring Assoc. Prof. Dr Zubaile Abdullah of Universiti Tun Hussein Onn Malaysia, is available at The Sun.
The feature is part of CSNET's continued public engagement on data protection and enterprise security practices in Malaysia.