Chapter 2 WWW.TARGET.SG Featured Topic CASE STUDY ON DDOS REMEDIATION Cooperating with Foreign CERTs What Happened? In 2019, the web portal of a local financial institution suffered a DDoS attack. The public-facing server that was connected to this portal experienced a spike in web traffic and was brought down. It was later determined by SingCERT and the local telecommunications service providers that the web traffic originated from overseas. Responding Swiftly to Cybersecurity Threats and Vulnerabilities Featured CASE STUDY Topic Post-2018 SingHealth Incident Preventing cybersecurity incidents starts from the identification of threats, and protection of key assets from attacks posed by such threats. In this regard, the Singapore Computer Emergency Response Team (SingCERT) scans for vulnerabilities and analyses the risks that they pose, and recommends appropriate mitigation measures that businesses and members of the public can take to protect themselves. Actions Taken Following the incident, a Committee of Inquiry (COI) was convened to investigate the events and contributing factors leading to the incident. The COI made 16 recommendations to enhance the capabilities of CII Owners (CIIOs) across Singapore’s CII sectors to deter, detect, respond to and recover from cybersecurity incidents. Given the transnational nature of cybersecurity threats, SingCERT exchanges information proactively with other Computer Emergency Response Teams (CERTs), both foreign and local, for a more comprehensive cybersecurity situational awareness and early warning of emerging threats. Such tight cooperation and links have allowed us to deal with the threats more efficiently, especially as some of the threats originate from outside of Singapore, and require assistance from foreign CERTs to mitigate. CSA’s participation in several regional forums has also helped to expedite this process further. These recommendations aimed to: Follow-up Action Knowledge sharing among international cybersecurity communities is pivotal to strengthening international cooperation in cyberspace. CSA approached our partners from foreign CERTs and relevant hosting providers for further assistance. The coordinated efforts from all parties subsequently led to the prompt takedown of the C&C servers that were responsible for the DDoS attack. 28 1. Strengthen organisational structure 2. Raise staff cybersecurity competencies 3. Improve system and data protection Asia Pacific Computer Response Team (APCERT) APCERT cooperates with CERTs SingCERT hosted the 17th and Computer Security Incident APCERT Annual General Meeting Response Teams (CSIRTs) to and Conference in Singapore, ensure cybersecurity in the Asia themed “Fostering a Safer Pacific region. Cyberspace through Partnerships and Collaboration”, from 29 On 31 July 2019, the APCERT September to 2 October 2019. Cyber Drill was held with the Over 100 participants from the theme “Catastrophic Silent APCERT community attended Draining in Enterprise Network”. the conference, which was held The drill served as a platform to in conjunction with the Singapore test and evaluate the response International Cyber Week (SICW) capabilities of leading CERTs/ 2019, the region’s leading CSIRTs within the region in conference for cybersecurity. responding to actual incidents The chosen theme complemented and issues. As a member of APCERT’s efforts in bringing the APCERT Drill Working together CERTs/CSIRTs, industry Group, SingCERT participated professionals and academia to as an Exercise Controller and discuss cyber issues and capacity conducted the drill with fellow building measures to create a safer CERTs/CSIRTs. and more secure cyberspace. SINGAPORE CYBER LANDSCAPE 2019 4. Enhance security checks on systems 5. Improve incident response processes Background In June 2018, SingHealth fell victim to an APT group. The incident was the most serious data breach in Singapore to date, with the personal particulars of 1.5 million patients and the outpatient prescriptions of about 160,000 of them illegally accessed and copied. Prime Minister Lee Hsien Loong’s records were specifically and repeatedly targeted. CSA’s NCIRT was deployed on site to work with Integrated Health Information Systems (IHiS) — the IT agency serving the public healthcare sector including SingHealth — to carry out joint investigations and remediation. CSA and IHiS took swift measures to contain the threat and prevent recurrence of the incident. The CIIOs have been implementing these recommendations progressively since early-2019. As of end-March 2020, six sectors have completed implementation of both priority and additional recommendations. Other sectors have implemented measures for between 80 to 90 per cent of their CII. Sector leads have to strike a balance between maintaining their CII systems’ availability, reliability and safety, together with the implementation of relevant cybersecurity measures. Thorough testing has to be conducted on CII systems after the implementation of the relevant measures to ensure their serviceability. In addition, both implementation and testing have to be completed within certain time periods to ensure the continuous delivery of essential services. However, CIIOs are committed and target to complete the majority of the implementation by end-2020. 29