COI Report – Part V
Page
189 of
425 31 INTRODUCTION TO THIS PART 597. In this Part, the Committee presents its further findings in respect of TOR
#2, establishing how IHiS and SingHealth responded to the Cyber Attack. This Part
follows on from Part IV above, and covers events that took place after CSA was informed of the Cyber Attack on the evening of 10 July 2018. Whereas the incident response till this point was conducted by IHiS alone, the response thereafter was a combined and concerted one,
involving a range of parties, including CSA, IHiS, SingHealth, MOH, and MCI.
598. Three main topics will be covered in this Part. First, the joint investigation and remediation efforts by IHiS and CSA’s National Cyber Incident Response Team (“
NCIRT”); second, the public announcement on the Cyber Attack and efforts for patient outreach and
communications by SingHealth; and third, the additional measures taken by CSA in its capacity as the national cybersecurity agency.
32 JOINT INVESTIGATION AND REMEDIATION BY IHIS AND CSA 32.1 Setting-up of War Room and sharing of information with CSA 599. On the night of 10 July 2018, CSA deployed the NCIRT to jointly investigate the incident with IHiS, and to implement measures to contain the attack. After the NCIRT was deployed, IHiS provided a detailed oral briefing on the evening of 10 July 2018, informing the NCIRT of their findings to-date.
600. The NCIRT was deployed onsite from 10 to 20 July 2018 at the War Room at Connection One.
During this period, daily meetings were held for the
NCIRT and IHiS to share findings. In the course of investigations, IHiS also provided the NCIRT with the relevant forensic
artefacts and information, including forensic images, memory dumps, and proxy and network logs. CE,
CSA recognised that IHiS’ response during
this period was competent, responsive and cooperative.
