Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	236/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 232 233 234 235 236 237 238 239 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

39.3 Penetration testing must be conducted regularly
COI Report – Part VIIPage 289 of 425

COI Report – Part VII
Page 288 of 425

described by management in the design) or Type II report (where the assessment is made over a period of time, and is thus much more detailed and valuable in understanding the actual security controls of the application) was produced. Richard suggested that SingHealth should evaluate the attested or certified security controls provided by its application vendors to ensure that control objectives aligned with SingHealth’s internal security objectives, and should supplement vendor assessment with its own administrative and technical penetration testing of the systems. This would provide improved alignment of risk analysis objectives and may help to identify previously unknown weaknesses or vulnerabilities in applications or services, such as the coding vulnerability in the SCM application.
834. The above recommendations for security evaluation and certification of vendor products would serve as new safeguards in an ever-changing security threat landscape faced with growing risks.
39.3 Penetration testing must be conducted regularly
835. Penetration testing is defined in the CCoP as an authorised process of evaluating the security of a computer system, network or application by finding vulnerabilities attackers could exploit and includes the process of a) gathering information about the target b) identifying possible entry points c) attempting to break in (either virtually or for real and d) reporting the findings.
836. The purpose of performing a penetration testis to verify that new and existing applications, systems and networks are not vulnerable to a security risk that could allow unauthorised access to resources.
837. CSA’s Douglas Mun explained how the coding vulnerability in the SCM application was revealed during a penetration test conducted by CSA on the SCM

COI Report – Part VII
Page 289 of 425

application in July 2018. The H-Cloud network penetration tests conducted by the GIA in FY revealed vulnerabilities and misconfigurations, several of which were present during the Cyber Attack, and which overlapped with CSA’s investigation findings as to the vulnerabilities and contributing factors exploited by the attacker in the Cyber Attack. These are just two tangible demonstrations of the value in conducting penetration tests on critical applications, systems and networks.
838. Indeed, the CIS recommends that “[i]n a complex environment where
technology is constantly evolving, and new attacker tradecraft appears regularly,
organizations should periodically test their defenses to identify gaps and to
assess their readiness by conducting penetration testing”.
71 839. We will elaborate on the following recommendations for the conduct of penetration tests.
39.3.1
Penetration tests must be conducted regularly and following specified
events on all CII, mission-critical and/or internet-facing systems
840. We recommend that penetration tests must be conducted on all CII, mission-critical and/or internet-facing systems a) prior to the commissioning of the system, or any new systems connected to the system b) after any major changes have been implemented to the system, such as adding on application modules, system upgrades and technology refresh, as well as after any system migration and c) in any event, at least annually.
71
CIS Controls Version 7 at control 20: Penetration Tests and Red Team Exercises.

Download 5.91 Mb.

Share with your friends:

1 ... 232 233 234 235 236 237 238 239 ... 329