SingHealth COI: IHiS’ systems were built for business efficiency instead of security, says CSA chief

While IHiS has done well in implementing technological advances to a large healthcare system, it did not pay enough attention to potential cyber threats arising from tech adoption, says Cyber Security Agency chief David Koh.

Read more at https://www.channelnewsasia.com/news/singapore/singhealth-cyberattack-coi-ihis-systems-csa-chief-10929274

By Fann Sim @FannCNA

14 Nov 2018 02:44PM (Updated: 14 Nov 2018 02:50PM)

Ricky Lim

During his testimony, Mr Koh said that Integrated Health Information Systems (IHiS) – Singapore’s central IT agency for the healthcare sector – had a “relatively low level” of security oversight.
Employees who worked on cybersecurity were embedded in the service delivery group instead of having their own reporting line, he added.
These two points led him to believe that the senior management of IHiS had little line of sight of cybersecurity issues.
--

Ricky Lim
CISSP do give the knowledge.
But implementing all the security knowledge in a highly complex IT infrastructure that cut across all IT domain is a challenge and not many can do it.

Imagine putting all the above security recommendation and implement it on the below IT domain without causing disruption to the IT operation SingHealth-wide.

If I am not wrong, I have come across many IT infrastructure - that did not implement all the above security recommendation - even though they have CISSP and many other certifications around.
Like · Reply · 1m

Like · Reply · 1m

Ricky Lim

Mr Koh recommended that IHiS adopt a “defence-in-depth” approach when developing or upgrading their systems and networks.
----
Posted on :- PROTECTION OF PUBLIC WEB SERVICE AND WEB ACCESS

Posted on:- 20 Jul 2018

Ricky Lim

Eg. of "Defense in Depth" :-

The above measures are recommended on top and above the below:-
(Assuming that all traditional security measures are put in place like firewall, segregration of web, apps, database, network IPS, host IPS, WAF - web application firewall, vpn ipsec, digital cert, encryption, authentication, directory service, desktop security features like personal firewall, anti-virus, latest security patches etc that have undergone security posture assessment such as BYOD, port authentication, secured shell for admin management, ssl etc have been put in place).

Like · Reply · 1m

Ricky Lim

“Given that the core mission of the delivery group is to provide IT services to the different clusters, security-related workstreams might be overlooked in favour of service delivery objectives,” Mr Koh said.
Mr Koh also said stronger, multi-layered security mechanisms should have been in place around IHiS’ “crown jewels” - the electronic medical records of all SingHealth patients.

It would be similar to the measures taken to protect a physical space such as a bank, he said, adding that that these instincts should be ported over when dealing with cyberspace.
“Like a safe in a bank, privileged access to these records should have been behind closed doors, only accessible to a tightly-controlled group of people
---
Posted on:- 20 Jul 2018

Ricky Lim
Based on what i know, many institutions IT security is still not yet up to mark.

Only very critical IT infra are of highly secured states.

SingHealth are private sectors - that are beefing up into a highly secured states.

Other than banks and some financial institutions -- many private sectors IT infra are still susceptible to APT types of attack.

High cost to beef up the IT infra is one issue.
2nd issue are skillsets.
Like · Reply · 1m

Like · Reply · 1m · Edited

Ricky Lim

A cyber-equivalent of tripwires, surveillance cameras and alarms should have been in place to monitor access, and to look out for suspicious activity,” he said.
=======================================================================

Ricky Lim
Posted on:- 20 Jul 2018

Protecting IT resources to minimise hacking are not that scary.

2. Proactive security incidents and event management of all critical information infrastructure using SIEMs whereby online real-time will trigger alarms and alerts the moment when stealth hacking occurs. Even stealth reconnaissance, the beginning of hacking by probing through network discovery, tcp port scanning, icmp ping, traceroute etc will be picked up.

Ricky Lim
Recommending measures to enhance "incident response plans",
---
(1) Put Singhealth under CII (Critical Information Infrastructure Plan).
- Install SIEM & agents and agentless to Singhealth network infrastructure.
- Install Central logger to collect all syslog and security log.
- 24x7x365 security monitoring
- SMS, email alert for security incidents and events.

Like · Reply · 1m · Edited