This afternoon, March 27.3, the Department of Information Security (Ministry of Information and Communications) sent an official dispatch to securities companies on strengthening network information security for information systems.
Many investors with trading accounts at VNDIRECT Securities Company are sitting on fire after the system was hacked and unable to trade.
According to Mr. Tran Dang Khoan, Deputy Director of the Information Security Department, in recent times, a number of securities company systems have had network information security incidents and caused serious damage to businesses. securities, causing confusion and affecting confidence in the safety of stock exchanges in Vietnam in particular and the financial market in general.
Carrying out the function of state management of network information security, the Department of Information Security requests securities companies to review and organize the implementation of network information security assurance for information systems within the scope of information security. management, with main tasks.
Accordingly, securities companies need to organize reviews, inspections, and assessments to ensure information security of information systems under their management and immediately deploy measures to overcome risks and vulnerabilities. , weaknesses in information systems, especially customer account management information systems, serving online stock transactions. This must be completed before April 15.4.
In addition, securities companies review and organize the implementation of information security assurance according to the level specified in Decree No. 85/2016/ND-CP of the Government on ensuring information system security according to levels and Circular 12/2022/TT-BTTTT of the Ministry of Information and Communications.
Comply with legal regulations and enhance information system security by level, especially organize statistics and classify information systems under management; Develop a plan to implement and complete regulations to ensure information system security by level (according to monthly progress); Ensure 100% of operating information systems must have the information system security level approved no later than September and fully implement the information security assurance plan according to the approved level proposal dossier. approved no later than December 9.
Organize effective, substantive, regular and continuous implementation of information security work according to the 4-layer model, especially improving the capacity of the monitoring layer, professional protection and continuous maintenance , stabilize connection and share information with the National Cyber Security Monitoring Center (Department of Information Security); Prioritize the use of cyber information security products, solutions and services produced or technologically mastered by Vietnamese enterprises.
Hunt for threats, promptly detect signs of intrusion
In addition, securities companies need to develop incident response plans for information systems under their management according to the provisions of Circular No. 20/2017/TT-BTTTT of the Ministry of Information and Communications regulating on coordinate and respond to network information security incidents nationwide; Implement a plan to periodically back up systems and important data to promptly restore in the event of a data encryption attack and report incidents to the Information Security Department according to regulations; Join the national network information security incident response network.
Periodically perform threat hunting to promptly detect signs of system compromise. For systems that have detected serious security vulnerabilities, after fixing the vulnerabilities, threat hunting should be immediately performed to determine the possibility of previous intrusion.
Check and update information security patches for important systems according to warnings from the Information Security Department and relevant agencies and organizations; Periodically inspect, evaluate, and review to promptly detect information security holes and existing weaknesses in the system.
The Information Security Department requests companies to organize reviews, appoint focal points to exchange expertise and report implementation results to the Information Security Department before April 15.4 for synthesis and reporting to competent authorities.
