CHAPTER 2 TARGET.SG FEATURED TOPIC STRENGTHEN GOVERNMENT ICT SYSTEMS To build a secure and resilient Smart Nation, the Government’s approach to cybersecurity is underpinned by two key principles. First, we adopt a ‘defencein-depth’ strategy, with multiple layers of cyber defence to impede attackers. These layers of defence cascade from the perimeter to within the systems. Given enough time and resources, sophisticated and determined attackers may eventually find their way into the system. The layered defence approach will enable security teams to detect any breach and respond swiftly. Second, we enhance our system defence on three fronts – People, Processes and Technology. In terms of People and Processes, the Government is developing a stronger cybersecurity culture across the Public Service, as well as CSA also coordinated national efforts to mitigate the risk of a similar attack affecting other Critical Information Infrastructure (CII) systems, by sharing threat intelligence with CII owners and instructing them to undertake relevant security measures. tapping on technology to support its IT staff and automate cybersecurity tasks, such as patch management. In terms of Technology, the Government will continue to build up the defence and resilience of its systems, while implementing measures to better detect and respond to cyber threats. 1 The Government can more effectively defend our systems if we involve the global and local communities of cyber defenders to identify vulnerabilities and strengthen the Government’s ICT systems. For example, the Government Technology Agency of Singapore (GovTech) and CSA are partnering local and overseas cybersecurity communities on a Government Bug Bounty Programme (GBBP) to help search and uncover vulnerabilities in our system. also implemented for IT systems in other unaffected public healthcare clusters (National Healthcare Group and National University Healthcare System) on 22 July 2018. The Government also paused the rollout of new Government ICT systems from 20 July to In view of further malicious 3 August 2018. During the activities detected on the pause, a review of its existing SingHealth network on 19 July cybersecurity measures was 2018, Internet Surfing Separation conducted. Although there was (ISS) was temporarily imposed no evidence of Government ICT on SingHealth’s IT systems on systems being compromised in 20 July 2018. As a precautionary this attack, additional measures measure, temporary ISS was 24 RECOMMENDATIONS MADE BY THE COI INTO SINGHEALTH on critical Government systems were introduced to detect and respond more quickly to cybersecurity threats. SingHealth began contacting the affected after the Government announced the news of the cyber-attack on 20 July 2018. Concurrently, SingCERT also issued advisories on precautions that organisations and members of the public could take, in anticipation of potential opportunistic attacks. The COI made 16 recommendations relating to strategic and operational measures to strengthen the cybersecurity posture of SingHealth and IHiS. These recommendations are generally applicable to all organisations responsible for large databases of personal data. Some key actions that all organisations must consider implementing are as follows: 2 Include cybersecurity as part of the organisation’s risk management, with deliberations and decisions on balancing cybersecurity and trade-offs (e.g. cost, operational requirements) based on unique business considerations (e.g. patient safety in the case of the public healthcare sector) managed at the senior level of leadership. 4 Provide all staff with training to build awareness on the best cyber hygiene practices, and cultivate an organisational culture where cybersecurity is everyone’s responsibility. 5 Adopt multiple defences, such as encryption, firewalls and robust dataaccess practices, to layers of security measures, to better prevent, detect and respond to cyber incidents. 3 Train and equip all staff to recognise and respond to cybersecurity incidents, and to report these incidents in a timely manner. 6 Carry out comprehensive and regular checks and audits to identify gaps in the design of and compliance with policies, processes and procedures, and to ensure that these gaps are remedied according to plan. Develop cyber incident response plans for various scenarios, and test and update them regularly by conducting realistic exercises and simulations. 25