• Home
• GOVERNMENT CXO
• E-GOVERNMENT
• CITIZEN ENGAGEMENT
• TAX AND REVENUE MANAGEMENT
• GOVERNMENT PROCUREMENT
• GREEN GOVERNMENT
• GOVERNMENT DATA MANAGEMENT
• GOVERNMENT SECURITY
• GOVERNMENT CLOUD
• GOVERNMENT ANALYTICS
• GOVERNMENT GIS
• CONNECTED GOVERNMENT
• DIGITAL INCLUSION
• EDUCATION IT
• HEALTHCARE IT

Government Security, Technology

Keep vigilant in a complex threat environment

By Jianggan Li | 8 May 2009

Las week, a hacker claimed to have seized and encrypted 8,257,378 patient records and a total of 35,548,087 prescriptions from the Virginia government network. He demanded a US$10 million ransom for the access to the ‘only copies’ of these sensitive data.

Photos

View photos

Related Articles

• A roadmap to managing costs and the environment
• HK varsity builds collaborative environment
• Meeting SLAs in Virtual Data Center Environments

Related Categories

• GOVERNMENT SECURITY
• TECHNOLOGY

From this Section

• NEWS

Two months ago, the entire blueprint of US Marine One – the presidential helicopter, was discovered by a peer-to-peer file-sharing monitor in a server in Tehran, Iran. It turned out that the highly confidential file was from a government defence contractor – one of their employees downloaded a peer-to-peer application without knowing what was being shared.

Also in March, it was reported that a Taiwanese hacker intruded into the computer of a Chinese State Council official and stole highly sensitive documents about Chinese Premier’s annual Report.

“Information security is a dynamic environment,” says Benjamin Teh, Director for Southeast Asia at the network security company Fortinet. “You can never get 100 per cent security but you need to constantly evolve your provisions to protect your data.”

He says many government agencies in the region still only have antivirus and firewall, which are not enough in today’s threat environment.

“Information can be leaked in many ways, thus every possible channel of network communications should be monitored to prevent leakage from happening,” he comments. “You need to have visibility over the entire network, not just the endpoints.”

That close control should be applied especially to port 80, which is allowed by most organisations as it is the port for HTTP communications. According to Teh, the chat function allowed in HTML (such as Gtalk and Facebook chat) is one avenue where information is often leaked – and although many organisations have banned instant messaging applications, their tools are not quite capable of disabling chat over HTML protocol without affecting normal use of the web.

And port 80 is also where most malware slips through the firewall defences. “Most antivirus applications have been focusing too much on email, while malware from the web is a bigger threat,” Teh comments.

Teh also reminds that whatever internet security companies are capable of doing, so are the bad guys.

While painting a seemingly scary landscape, Teh points out that governments in Asia can learn a lot from their counterparts in the United States, where the new administration has dedicated a lot of resources to cyber security.

“Not only does President Obama have a very detailed cyber security plan, he also hired a national cyber security advisor,” without naming specific countries, Teh says such a high level but in-depth commitment on security has not been seen in the recent moves of many Asian governments, including some high profile projects.

With governments having increasingly sophisticated online infrastructure to do things better, there will be many security threats which have not really been on the list of governments’ priorities,” he says that governments need to keep vigilant.