COI Report – Part IV
Page 175 of 425
also of the view that it was “not a reportable security incident”, “as it was not
conclusively shown that the deletion had been malicious”. It also appears that the attendees at the meeting were discussing whether this was a scheduled clearing of logs or a manual clearing for malicious purposes, despite knowing that the domain administrator’s account was “constantly being used to clear the logs”, and that it was “already compromised even before Citrix breach.”
554. While Wee had these concerns and the relevant IHiS staff were present, he did not voice his concerns or seek clarification. Ultimately, no decision was made at the meeting to escalate the matter to the SingHealth GCIO, Benedict.
28.3 Raising the matter to Clarence Kua and Serena Yong
555. Sometime in the morning of 9 July 2018, Serena happened to meet Clarence, and informed him that there were issues with the SCM system,
and asked that he find out more, in his capacity as the Applications Service Lead for
SingHealth.
34
At around pm, Clarence called Henry, his point of contact for issues relating to the SCM system. Henry directed Clarence to the Security Team, knowing that they were looking into the matter.
35
Clarence then called Wee and arranged to meet him at IHiS’ offices at ConnectionOne. It appears that separately, after the pm meeting, Ernest and Wee had discussed the matter and decided that they would consult Clarence.
556. Wee met with Clarence in person at around 5.00 pm, before inviting Ernest to join them. Ernest briefed Clarence on the events of June and July 2018, including the queries run on the SCM database on 4 July 2018, the failed attempts It appears that by around 6 July 2018, Woon Lan had some knowledge of issues concerning the SCM system – hence her request to Ernest on 6 July 2018 to meet Ernest the next day. Based on Serena’s evidence, Woon Lan had told Serena on 8 July 2018 about an issue involving the SCM system. Evidence has not been led on how Woon Lan had come to know of the issue, or the precise extent of her knowledge. Based on the surrounding circumstances, it appears likely that prior to 9 July 2018, Woon Lan and Serena only had a very vague idea of what the issue was about. Henry has explained that around half an hour before Clarence contacted him, Ernest and Wee had called him to arrange fora meeting on 10 July 2018 to understand how the SCM application works.
|
