Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	66/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 62 63 64 65 66 67 68 69 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

15.2 Lack of monitoring at the SCM database for unusual queries and access
COI Report – Part IIIPage 75 of 425 219. Mr David Koh, Chief Executive of CSA (“CE, CSA

COI Report – Part III
Page 74 of 425

the SCM database, a CII, to the H-Cloud, and accompanying migration of the
SCM front-end application from the SGH Citrix servers to H-Cloud Citrix servers, was not seen as a major change meriting review of network architecture and connectivity.
15.2 Lack of monitoring at the SCM database for unusual queries
and access
217. From 26 June to 4 July 2018, the attacker ran queries on the SCM database, including bulk queries. The attacker was able to do so unchallenged because of alack of monitoring at the SCM database for unusual queries and access in at least two respects. a) First, there were no existing controls to detect bulk queries being made to the SCM database. While bulk queries are not uncommon as they are used for generating reports, the queries run by the attacker were anomalous in a number of ways. However, without controls in place to detect bulk queries and to identify anomalous queries, the the attacker was able to retrieve large amounts of data undetected. b) Second, one of the applications used by the attacker to query the
SCM database was not a program that was legitimately used in the
IHiS environment, and was not installed by IHiS on the SGH Citrix servers. This reveals a gap that was exploited by the attacker, namely, that there were no controls in place at the time of the attack to detector block any queries to the SCM database made using illegitimate applications.
218. In the course of proceedings, the Committee has heard evidence on database activity monitoring (“DAM”) solutions available on the market which could address some or all of the three gaps highlighted above. DAM was not implemented by IHiS at the time of the attack.

COI Report – Part III
Page 75 of 425

219. Mr David Koh, Chief Executive of CSA (“CE, CSA”), stated in his evidence that at the time of the attack, DAM was not common in the healthcare sector, but was common in both the security sector, and the banking and finance sector. Based on this, counsel for IHiS has submitted that the lack of DAM should not be viewed as an “inherent weakness” in SingHealth’s network architecture, in light of the prevailing security posture in the healthcare sector at the time of the attack. The upshot of IHiS’ submissions on this point is that it was not unreasonable for IHiS not to have implemented DAM at the time.
220. As discussed in the course of proceedings, the reasonableness of IHiS’ conduct in this respect is not in issue. What the Committee is concerned with is in (i) identifying the contributing factors (i.e. the lack of monitoring at the SCM database for unusual queries and access, (ii) identifying whether there was anything that could have been done better to address the vulnerability (i.e. implementing DAM, and (iii) the reasons, if any, why such steps were not taken.
221. It is in respect of this third issue that CE, CSA’s evidence becomes relevant. The Committee notes that CE, CSA goes onto state in his evidence that the security and banking and finance sectors are “(sectors) where database
monitoring is commonly in place because of the mindset of the network
designers”. The Committee is inclined to accept the Solicitor-General’s view that the lack of security measures at the database-level to monitor for unconventional querying and access demonstrates that the need for such measures was not part of the consciousness of the network designers and operators for the SCM system at the time of the Cyber Attack.

Download 5.91 Mb.

Share with your friends:

1 ... 62 63 64 65 66 67 68 69 ... 329