Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	9/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 5 6 7 8 9 10 11 12 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

Key Finding 5: While our cyber defences will never be impregnable, and it maybe difficult to prevent an Advanced Persistent Threat from
Executive Summary viii C. RECOMMENDATIONS BY THE COMMITTEE

Executive Summary vii

Key Finding #4: The attacker was a skilled and sophisticated actor
bearing the characteristics of an Advanced Persistent Threat group

The attacker had a clear goal in mind, namely the personal and outpatient medication data of the Prime Minister in the main, and also that of other patients. The attacker employed advanced TTPs, as seen from the suite of advanced, customised, and stealthy malware used, generally stealthy movements, and its ability to find and exploit various vulnerabilities in
SingHealth’s IT network and the SCM application. The attacker was persistent, having established multiple footholds and backdoors, carried out its attack over a period of over 10 months, and made multiple attempts at accessing the SCM database using various methods. The attacker was a well-resourced group, having an extensive command and control network, the capability to develop numerous customised tools, and a wide range of technical expertise.
Key Finding #5: While our cyber defences will never be impregnable, and
it maybe difficult to prevent an Advanced Persistent Threat from
breaching the perimeter of the network, the success of the attacker in
obtaining and exfiltrating the data was not inevitable

A number of vulnerabilities, weaknesses, and misconfigurations could have been remedied before the attack. Doing so would have made it more difficult for the attacker to achieve its objectives. The attacker was stealthy but not silent, and signs of the attack were observed by IHiS’ staff. Had IHiS’ staff been able to recognise that an attack was ongoing and take appropriate action, the attacker could have been stopped before it achieved its objectives.

Executive Summary viii

C. RECOMMENDATIONS BY THE COMMITTEE
15. The Committee’s TORs also include recommending measures to (i) enhance the incident response plans for similar incidents (“TOR #3”); (ii) better protect SingHealth’s patient database system against similar cyber attacks
(“TOR #4”); and (iii) reduce the risk of such cyber attacks on public sector IT systems which contain large databases of personal data, including in the other public healthcare clusters (“TOR #5”). The Committee’s recommendations on these TORs are set out in Part VII of the main report.
16. The Committee makes sixteen recommendations, comprising seven Priority Recommendations and nine Additional Recommendations, all of which have been explored and examined in great detail.
17. The seven Priority Recommendations include strategic and operational measures to uplift the cybersecurity posture of SingHealth and IHiS, and steps must betaken to implement these Priority Recommendations immediately. The nine Additional Recommendations relate to other specific concerns raised in the course of this Inquiry, including technical, organisational, training, and process- related issues. The measures, which are similarly aimed at uplifting the cybersecurity posture of SingHealth and IHiS, must be implemented or seriously considered.
18. All sixteen recommendations are made in respect of TORs #3 and #4, and apply equally to TOR #5. They range from basic cyber hygiene measures to more advanced measures which maybe more relevant after a certain level of cybersecurity maturity has been attained by the organisation.
19. While some measures may seem axiomatic, the Cyber Attack has shown that these were not implemented effectively by IHiS at the time of the attack. For
IHiS, SingHealth, and other organisations responsible for large databases of personal data, getting the fundamentals right is a necessary and vital step in building cybersecurity competencies and the ability to counter the real, present, and constantly evolving cybersecurity threats.

Download 5.91 Mb.

Share with your friends:

1 ... 5 6 7 8 9 10 11 12 ... 329