Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019
Part V – Incident response after 10 July 2018 TABLE OF CONTENTS – PART Vb b31bbINTRODUCTION TO THIS PART. 189 32 JOINT INVESTIGATION AND REMEDIATION BY IHIS AND CSA ... 189 32.1 Setting-up of War Room and sharing of information with CSA ................. 189 Ascertaining the queries run and data exfiltrated ........................................ 191 Containment measures implemented ........................................................... 192 32.3.1 Resetting the Kerberos Ticket Granting Ticket account ................................. 192 32.3.2 Changing of passwords across all healthcare clusters .................................. 193 32.3.3 Cleaning-up of network-based IOCs, instituting of firewall rules, and reloading of Citrix servers .............................................................................. 194 32.3.4 Disabling of PowerShell on endpoints ........................................................... 194 Heightened monitoring of IT network and implementation of Internet Surfing Separation on 20 July 2018 .......................................................................... 195 33 THE PUBLIC ANNOUNCEMENT AND PATIENT OUTREACH AND COMMUNICATIONS ............................................................................................. 196 33.1 The public announcement ............................................................................ 196 Patient outreach and communications ......................................................... 197 33.2.1 Identifying the patients who should be contacted ........................................... 197 33.2.2 Modes and content of communications. 198 33.2.3 Operationalising the outreach and communications efforts, and the role of SingHealth and IHiS staff ............................................................................... 200 33.2.4 Guarding against deliberate falsehoods and phishing risks .......................... 202 33.2.5 Patient satisfaction ......................................................................................... 203 Assessment of SingHealth’s incident response ............................................ 203
