Singapore must be tougher on firms that treat security as value-add service