Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

The necessity of keeping your server updated: OrangeTee & Tie 

necessity of keeping your server updated
Keeping your server updated is crucial for mitigating security risks, resolving software issues, and enhancing the overall performance of the server.

The necessity of keeping your server updated: OrangeTee & Tie 

In the contemporary digital world, it is of utmost importance to regularly update your servers to ensure the safety and integrity of your systems. Overlooking server updates can render them as defenseless as if they were left completely unprotected.

Updating servers is crucial for mitigating security risks, resolving software issues, and enhancing the overall performance of the server. Frequent updates aid in safeguarding your servers from potential threats like unauthorized access, data breaches, and malware attacks.

Ignoring updates might jeopardize your organization’s confidential information and vital systems. In the case of OrangeTee & Tie, the consequences of neglecting server updates became apparent when their systems were compromised, causing the Organisation to pay a whopping S$37,000 financial penalty. 

Frequent updates aid in safeguarding your servers from potential threats like unauthorized access, data breaches, and malware attacks.

April 17: Breach of Protection Obligation of OrangeTee & Tie 

On August 4, 2021, the PDPC contacted OrangeTee & Tie after receiving information that a threat actor had managed to exfiltrate databases in the Organisation’s possession. These exfiltrated databases are believed to contain personal data. 

OrangeTee & Ties is a real estate enterprise based in Singapore and has been in operation since 2000. It maintains 4 servers, namely: the Production Web Server, the Production Database Server, the Development Web Server, and the Development Database Server. 

The Production Web Server and the Development Web Server were internet-facing in that they were directly accessible from the internet. The personal data of employees and customers of the OrangeTee & Ties were stored on the Production Database Server and the Development Database Server. But these personal data had not been encrypted, and these databases ran on software that was not updated. 

Investigations reveal that the Organisation received a ransom demand email from an organisation which identified themselves as ‘ALTDOS’. The threat actor claimed that they had been hacking the Organisation’s network since June 2021 and had stolen “hundreds of databases” containing sensitive information. 

In the same email, the threat actor demanded a ransom of 10 Bitcoins for the safety and non-disclosure of the exfiltrated databases. Having not received the demanded ransom, ALTDOS carried out a Distributed Denial-of-Service attack which brought down the Organisation’s network.

OrangeTee & Tie engaged a private forensic expert to ascertain the cause and extent of the Incident. It was found that the threat actor had carried out certain web-based attacks and exploited vulnerabilities on the Web Servers to successfully exfiltrate databases from the outdated Database Servers. With this, OrangeTee & Tie breached the Protection Obligation of the PDPA.

For breaching the Protection Obligation under the PDPA, OrangeTee & Tie was made to pay a whopping financial penalty of S$37,000.

What can we get from this case?

An outdated server is as if they were left completely unprotected. Without updating your server, it will not have the essential security updates which could block the sophisticated and up-to-date methods that bad actors use. 

Ignoring updates might jeopardize your organization’s confidential information and vital systems.

How a DPO can help prevent this from happening

Your appointed DPO can work with you on your PDPA compliance, ensuring that there will be policies in place to make sure that the handling of personal data is PDPA compliant. This includes promptly responding to the PDPC with their queries to expedite the investigations and prevent a harsher penalty from the Commission. 

A Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organisations comply with the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance as it is the officer responsible for maintaining the positive posture of an organisation’s cybersecurity.

DPOs complement organisations’ efforts to ensure that the organisation’s methods of collecting personal data comply with the PDPA. It also ensures that policies are set in place to make sure that there will be no instances of data breaches in the future.

Don’t wait any longer to ensure your organisation is PDPA compliant. Take our free 

3-minute PDPA Compliance Self-audit checklist now, the same “secret weapon” used by our clients to keep them on track. Upon completion, we will send you the results so you can take the necessary action to protect your customers’ data. Complete the free assessment checklist today and take the first step towards protecting your customers’ personal data.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us