Read more at https://www.channelnewsasia.com/news/singapore/internet-separation-should-have-been-implemented-teo-chee-hean-10558584
(Updated: )
Ricky Lim
Internet surfing separation “could and should have” been implemented in the public healthcare system, just as it had been done in the public sector, according to Deputy Prime Minister and Coordinating Minister for National Security Teo Chee Hean.
---
Posted on :- 20 Jul 2018
Ricky Lim
This sounds like an Advanced Persistent Attack (APT) - by hijacking a legitimate workstation through remote access, steal the password (at least the administrator password of the database) and do a sweeping copies of the database for eg. via SQL.
SingHealth network infrastructure that run independently seems to be independent from the Ministry - and may lack the security rigour of the more protected IT infra.
Like · Reply · 1m · Edited
---
Posted on :- 20 Jul 2018
Ricky Lim
This sounds like an Advanced Persistent Attack (APT) - by hijacking a legitimate workstation through remote access, steal the password (at least the administrator password of the database) and do a sweeping copies of the database for eg. via SQL.
SingHealth network infrastructure that run independently seems to be independent from the Ministry - and may lack the security rigour of the more protected IT infra.
Like · Reply · 1m · Edited
Ricky Lim
He disclosed that front-end devices at SingHealth were capable of thwarting “ordinary, run-of-the-mill” attacks. They had existing antivirus and anti-intrusion software that could keep out “many of such attempts”.
Internet surfing separation “could and should have” been implemented in the public healthcare system, just as it had been done in the public sector, according to Deputy Prime Minister and Coordinating Minister for National Security Teo Chee Hean.
If those steps had been taken, the "cyber kill-chain" for the hacker would have been disrupted and the surface area exposed to the attack would have been reduced, Mr Teo added.
However, the Internet-linked workstations used by thousands of users from the medical and academic community provided a large “attack surface” for the “sophisticated and persistent intruder”, he said.
Mr Teo revealed that the intruders managed to circumvent security barriers in the "intermediate layer that manages and screens user requests from the outer user layer to access IT database servers".
As a result, the attacker was able to gain access into a segment of the database and obtain and exfiltrate the data to overseas servers, Mr Teo said.
---
Posted on:- 20 Jul 2018
Ricky Lim
Protecting IT resources to minimise hacking are not that scary.
1. IT design to segregate back-end oob (out of band) mgt from front end internet fronting (in band) will definitely minimise internet hacking attack of such scale. The reason being, front end (in-band) is internet facing, out-of-band (back end) is segregated from front-end (inband) - and when hackers attack from front-end (in-band) - it cannot get into the back end (out-of-band) as the front end network is separated from back-end network. Breaching the front probably may get access to one or the most a few transactions --- but will not be able to do a mass copy of data - using backend admin with powerful rights.
2. Proactive security incidents and event management of all critical information infrastructure online real-time will trigger alarms and alerts the moment when stealth hacking occurs. Even stealth reconnaissance, the beginning of hacking by probing through network discovery, tcp port scanning, icmp ping, traceroute etc will be picked up.
3. APT advanced persistence threat or maybe dlp (data loss protection) protection can be put in place to filter known, unknown, zero day attack, virtual patching and sandbox unknown but anomaly threat.
4. 2 FA authentication for administrator to be installed for login before allowing management of network device, software, database. Hackers may be able to steal the admin id and password, but without 2FA, hackers cannot administer and manage network device, edit software, access data in database.
5. Remove all remote access by hardening and removing or shutting down all remote access capability to all network devices, software and database. Lockdown and identify dedicated jump host to administer all network devices, software, database by local access workstation or virtual machine that are securely protected. Any other workstation that are not identified as jump host for administration are not allowed to manage and administer supervisor function over the network devices, software and database. Remote management must be disallowed. By doing so, hacker compromising a weak front end workstation will not be able to mass copy the database - as it is not a dedicated jump host and will not be allowed to do so - also a security alarm and alert will be triggered to the sms and email to administrator that can quickly respond to the hacking.
6. Encryption of data storage, encryption key management and encryption of database maybe required. This ensure that even when the data is mass copied by the hackers, the data are encrypted and hackers will take a hard time to decrypt the data.
The above measures are recommended on top and above the below:-
(Assuming that all traditional security measures are put in place like firewall, segregration of web, apps, database, network IPS, host IPS, WAF - web application firewall, vpn ipsec, digital cert, encryption, authentication, directory service, desktop security features like personal firewall, anti-virus, latest security patches etc that have undergone security posture assessment such as BYOD, port authentication, secured shell for admin management, ssl etc have been put in place).
All these will prevent the singhealth APT hacking.
Reply · 1d · Edited
Like · Reply · 1m
Ricky Lim
Most important, ensure that in-band (front-end) network must not be routable to the out-of-band (back-end) network.
Ensure this mistake must not be made - else 佛都保不到你。。。。。
Like · Reply · 1m
Internet surfing separation “could and should have” been implemented in the public healthcare system, just as it had been done in the public sector, according to Deputy Prime Minister and Coordinating Minister for National Security Teo Chee Hean.
If those steps had been taken, the "cyber kill-chain" for the hacker would have been disrupted and the surface area exposed to the attack would have been reduced, Mr Teo added.
However, the Internet-linked workstations used by thousands of users from the medical and academic community provided a large “attack surface” for the “sophisticated and persistent intruder”, he said.
Mr Teo revealed that the intruders managed to circumvent security barriers in the "intermediate layer that manages and screens user requests from the outer user layer to access IT database servers".
As a result, the attacker was able to gain access into a segment of the database and obtain and exfiltrate the data to overseas servers, Mr Teo said.
---
Posted on:- 20 Jul 2018
Ricky Lim
Protecting IT resources to minimise hacking are not that scary.
1. IT design to segregate back-end oob (out of band) mgt from front end internet fronting (in band) will definitely minimise internet hacking attack of such scale. The reason being, front end (in-band) is internet facing, out-of-band (back end) is segregated from front-end (inband) - and when hackers attack from front-end (in-band) - it cannot get into the back end (out-of-band) as the front end network is separated from back-end network. Breaching the front probably may get access to one or the most a few transactions --- but will not be able to do a mass copy of data - using backend admin with powerful rights.
2. Proactive security incidents and event management of all critical information infrastructure online real-time will trigger alarms and alerts the moment when stealth hacking occurs. Even stealth reconnaissance, the beginning of hacking by probing through network discovery, tcp port scanning, icmp ping, traceroute etc will be picked up.
3. APT advanced persistence threat or maybe dlp (data loss protection) protection can be put in place to filter known, unknown, zero day attack, virtual patching and sandbox unknown but anomaly threat.
4. 2 FA authentication for administrator to be installed for login before allowing management of network device, software, database. Hackers may be able to steal the admin id and password, but without 2FA, hackers cannot administer and manage network device, edit software, access data in database.
5. Remove all remote access by hardening and removing or shutting down all remote access capability to all network devices, software and database. Lockdown and identify dedicated jump host to administer all network devices, software, database by local access workstation or virtual machine that are securely protected. Any other workstation that are not identified as jump host for administration are not allowed to manage and administer supervisor function over the network devices, software and database. Remote management must be disallowed. By doing so, hacker compromising a weak front end workstation will not be able to mass copy the database - as it is not a dedicated jump host and will not be allowed to do so - also a security alarm and alert will be triggered to the sms and email to administrator that can quickly respond to the hacking.
6. Encryption of data storage, encryption key management and encryption of database maybe required. This ensure that even when the data is mass copied by the hackers, the data are encrypted and hackers will take a hard time to decrypt the data.
The above measures are recommended on top and above the below:-
(Assuming that all traditional security measures are put in place like firewall, segregration of web, apps, database, network IPS, host IPS, WAF - web application firewall, vpn ipsec, digital cert, encryption, authentication, directory service, desktop security features like personal firewall, anti-virus, latest security patches etc that have undergone security posture assessment such as BYOD, port authentication, secured shell for admin management, ssl etc have been put in place).
All these will prevent the singhealth APT hacking.
Reply · 1d · Edited
Like · Reply · 1m
Ricky Lim
Most important, ensure that in-band (front-end) network must not be routable to the out-of-band (back-end) network.
Ensure this mistake must not be made - else 佛都保不到你。。。。。
Like · Reply · 1m
No comments:
Post a Comment