Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	154/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 150 151 152 153 154 155 156 157 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

COI Report – Part IVPage 181 of 425

COI Report – Part IV
Page 180 of 425

on the problem so that the response can be very firm and aggressive”, because
“[u]nless management is involved at a functional level, at an operational level,
these calls cannot betaken i.
571. Under the SIRF, Kim Chuan is responsible for reporting security incidents to CSA. In the case of unauthorised access to the SCM database, which is a CII system, CSA would have to be alerted verbally within 2 hours. Under the SIRF, Kim Chuan was also responsible for reporting security incidents to Bruce,
MOHH, and MOH.
572. No steps were taken by Kim Chuan or Bruce to escalate the matter further on the night of 9 July 2018 itself. The Committee notes that the information provided to them at this stage was very brief, hence both their evidence that they were each unable to determine at the time whether this was indeed a security incident. At the same time, however, even the limited information provided would have indicated that there was unauthorised access to the SCM database.
573. On the facts, Bruce fixed a conference call for pm the next day (10 July 2018), and the understanding was that a decision on escalating the matter would only be made then. Eventually, the matter was reported to CSA at pm on 10 July 2018.
574. The Committee is of the view that, knowing the urgent reporting obligation fora suspected Category 1 incident, Bruce and Kim Chuan should have acted with more urgency, instead of only convening the meeting on the afternoon of the next day.

COI Report – Part IV
Page 181 of 425

29 EVENTS OF 10 JULY 2018
29.1 Discovering that the queries did result in data being returned
575. On the morning of 10 July 2018, members of IHiS management, including Serena, Clarence, Woon Lan, Henry, Hann Kwang and Teresa met at
ConnectionOne to continue their discussion on the events of 4 July 2018. At am, they were joined by Kim Chuan.
576. While discussions were ongoing, Henry decided to run one of the queries to double-check whether any data would be returned from the database. He was shocked to discover that the query did in fact result in data being returned – this was contrary to Kelvin’s earlier representation that no results were returned – and he informed those present at the meeting.
577. Kim Chuan directed the team to ascertain the number of records retrieved from the SQL queries. At the time, the team estimated that there were around
600,000 records retrieved, and they found that the SQL queries could have been run since late June Separately, Kim Chuan was also informed that one of the logins to a Citrix server could be traced to at least one compromised PC in
SingHealth.
37 578. By this point, Kim Chuan “thought that it could bean APT attack, and
that the incident could be categorised as Category 1”.
However, he did not inform CSA of this immediately as the conference call with Bruce and Benedict was scheduled at pm that same day, and Kim Chuan felt that it was important for Bruce to be briefed and be able to assess the situation and facts.

37
Kim Chuan does not state which Citrix server this is, but in the circumstances, this must be a reference to Citrix Server 2.

Download 5.91 Mb.

Share with your friends:

1 ... 150 151 152 153 154 155 156 157 ... 329