The Personal data Protection Commission of Singapore announced a new undertaking this week. The incident that led to the investigation was a ransomware assail on a medical entity, and findings included that the entity had left RDP open and had weak login credentials, among other concerns. The undertaking was to acquire them to harden their security; no monetary penalty was involved. background The Personal Data Protection Commission (the Commission ) received a data breach notification on 7 February 2020 from StarMed Specialist centre Pte Ltd ( StarMed ), informing that ransomware had infected single of its servers and encrypted a database containing 373 patients personal data. The personal data consisted of the name, NRIC number, date of birth, gender, electrocardiogram data and treadmill stress test data. It was established that StarMed had not implemented the necessary security measures at the time of the incident. a Remote Desktop Protocol ( RDP ) Port had been left open, which likely enabled the unauthorised access to the database. In addition, both the server and database had weak login credentials and passwords. Remedial Actions After the incident, StarMed disabled the RDP Port and all public facing connections on the firewall. It also formalised its internal password sops into a written word policy. Additionally, StarMed rolled out several group-led IT security enhancement initiatives, including the implementation of a secured wide-area network and cybersecurity protection suite. StarMed will also continue to bolster faculty awareness on cybersecurity issues through further training at its Cyber Security consciousness workshops, conducted by an external cybersecurity consultant. task The charge considered the circumstances of the case and accepted an project from StarMed to improve its compliance with the Personal data Protection act 2012. The project was executed on 12 October 2020 (the Undertaking ). The project provides that StarMed was to: (a) review password policies relating to StarMeds servers and IT equipment storing personal data; (b) critique appendage of login hallmark on StarMeds servers and IT equipment storing personal data; (c) retrospect the need for an alert system in the event of multiple failed account login attempts to StarMeds server and IT equipment storing personal data, including logging such attempts; (d) once the charge approves the proposed implementation plan, comply with every obligation band out in the implementation plan; (e) appoint individuals of sufficient authorisation to oversee compliance with the task and to describe the status of submission to the Commission; and (f) supply a status report to the Commission at a time requested by the Commission confirming whether StarMed has fulfilled each of the specific measures mark out in the implementation plan. StarMed has since provided the Commission with the status account referred to at para 5(f) above. The Commission has reviewed the matter and determined that StarMed has complied with the terms of the Undertaking. Please click�here�to view the Undertaking. Source: Personal Data protection commission of Singapore
