Tech – Cybersecurity Engineer: AI-Assisted Triage & Auto-Malware Analysis

Intern Scope: Update and Automate the Configuration Management Systems (CMS) Background: - With the recent hype on unauthorised remote connections to agencies, there will be a push to strengthen the visibility of the IT assets in CPIB. - Existing PMOC IT Security – Product Registry is outdated and has not been updated since 2019, due to laborious manual entry into the SharePoint. The change management process is disconnected from the PMOC Product Registry. The management of the product registry for each project is at the vendor/AFMs level, each vendor has their own unique format for product registry. Plan: Short-Term - Update the existing product registry by collating the information across Projects and Infrastructure Long-Term – Develop a roadmap, evaluation, and procurement plan to automate the Configuration Management Systems (CMS) (i.e., via tools such as SolarWinds Network Configuration Management Software, scripts) Establish Fully Automated Malware Analysis Capability in CPIB via Cuckoo Sandbox Background: - Currently, An AV scanner farm can defend against accidental attack. For targeted attack, it is not sufficient. Possible attackers who targeted Singapore Government Agencies are likely Advance Persistence Threat (APT), making signature and heuristic based AV Scanner farm less effective (i.e., polymorphic malware, fileless malware, packing & obfuscation. It is challenging when the outcome of the AV Farm is non-conclusive. The use of online automatic malware analysis site (e.g., VirusTotal.com) is not advisable for restricted and above information, typically in CPIB. During incident response, more timely information is needed to help eradicate and contain the malware spread effectively. Thus, reducing the risk of loss of sensitive-high information from the Agency. Plan: Short-Term – Building a Cuckoo Sandbox as a pilot based on the endpoint device image. Long-Term - Building a Cuckoo Sandbox based on key system environments. Provision of Security Test Tools for self-help and integration to CPIB’s Security Dashboard and CMS Background: - Currently, the Security Test outputs for all systems are manually copy to CPIB’s Security Dashboard to monitor the progress. Failure to remediate on time without Risk Acceptance is an audit finding. - There are cases when the vendor remediations are not comprehensive, the re-test by the security vendor will be wasted. Plan: Short-Term – Setup security testing tools (i.e., Burp Suite, Nessus) for vendor to self-help. Only when they are confident that their remediated is complete, will CPIB send in the security tester to validate as independent tester. Doing so will save time, resource and more likely IM8 Compliant. Long-Term – Integrate the security tools output to CPIB’s Security Dashboard and CMS. This will reduce manual effort and provide single source of truth for security status.