Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	279/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 275 276 277 278 279 280 281 282 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

COI Report – Part VIIPage 351 of 425

COI Report – Part VII
Page 350 of 425

43.2.3
A written protocol for the remediation of audit findings must be
established
1013. There were serious gaps in the way audit findings are remediated by IHiS, as evidenced by the problems with the remediation action plans arising from the FY IT security audit on H-Cloud which included network penetration testing. These problems can be summarised as follows a) There was no consideration of whether audit findings applied across Clusters and remediation steps should also been taken across Clusters. b) At IHiS staff-level, remediation was stated to be done when it was not actually done or not done thoroughly. No verification was conducted byline management. c) There were misunderstandings with GIA on what the remediation measures were to entail, and when they were supposed to be completed. d)
CSA found that several of these vulnerabilities were present during the Cyber Attack, and could have been exploited by the attacker.
1014. Witnesses from IHiS’ senior and line management who testified before the Committee acknowledged these failings, and put forward suggestions on how the audit remediation process could be improved.
1015. Lum, as the supervisor of the staff who had failed to take steps to comply with the requirements under the audit remediation plan for password complexity and administrator credential issues, stated that he would ensure that such important tasks were verified personally by him or a designated person in future such that the audit findings would be properly addressed and closed.

COI Report – Part VII
Page 351 of 425

1016. Leong Seng testified that a) Since April 2018, IHiS has setup a centralised audit liaison team to pool all audit issues from all audit reports from all Clusters. The reports are maintained in a shared platform with all audit issues being tracked. The GIA has access to this shared platform so that everyone is looking atone common list of audit issues. There will be a service management team (inside the Delivery Group) to handle audit management and be the single point to do the overall tracking of the response to the audit issues. b) For specific audit findings, the Infrastructure team of the respective Cluster to which the finding related would come up with a remediation plan and deadline. That team has to execute the plan accordingly. The other Cluster Infrastructure teams (in respect of which the audit finding was not specifically made) would plan measures as well if the finding is relevant to their Cluster. c) The Infrastructure Services group is organised in a matrix manner, with a horizontal Cluster Infrastructure Lead, and vertical Tower Leads for specific domain competency areas of system management, security management, end-user and network. The Tower Lead would ensure that issues surfaced by an audit on anyone Cluster is propagated to the other Clusters. The Tower Lead would ensure harmonisation and standardisation of the way the Clusters remediated and put in place measures. A similar structure applied to the Applications group. The Tower Leads would drive the efforts to remediate issues within their respective competency areas in a standardised manner, but the specific remediation plans and plan timings would be planned by the horizontal Cluster Leads.
1017. At senior management level, based on Benedict’s evidence, there appeared to be processes in place for surfacing audit findings and escalating problems with remediation. We note that in the case of the GIA’s FY audit on

Download 5.91 Mb.

Share with your friends:

1 ... 275 276 277 278 279 280 281 282 ... 329