SingHealth hack demonstrates the need for Secure-Data-as-a-Service in today’s cyber-threat landscape, says BOHH Labs

The recent Singapore health data hack that compromised confidential data – including the details of Singapore’s Prime Minister, Lee Hsien Loong – should serve as a reminder to both individuals and organisations that any lapse in cyber defence renders an organisation seriously vulnerable. This is according to Simon Bain, CEO of BOHH Labs.

Reports suggest that hackers managed to gain access to Singapore’s largest healthcare institution, SingHealth, and access the personal profiles of 1.5 million patients. The incident reinforces the need for a proactive cyber security approach which finds a balance between business productivity and innovation. This needs to occur alongside everyday business operations to minimise the security of a company’s data and confidential information. In response, Bain argues that attacks like this will continue to occur, unless organisations find a way to minimise business risk and disruption while innovating secure digital products for their customers.

Bain commented: “SingHealth is just the latest in a long line of companies to have fallen victim to a data breach, and this hack highlights how difficult it is for institutions to stay completely protected. There is a massive market for stolen data, which has driven a huge initiative from security experts to focus on the safety of their clients’ data – yet despite best efforts breaches are still regularly occurring.

“Yet another breach, let alone one on a government body, should tell us that something in our security approach is broken. Governments hold data sensitive in their databases, such as Protected Health Information (PHI), Personally Identifiable Information (PII), meaning they become viable attack targets. This is what happened to SingHealth. To mitigate this growing threat, there must be a new approach to data security.

Deploying a Secure-Data-as-a-Service (SDaaS) solution that acts as a layer between the user/application and the back-end data store, enables protection of all stored data, no matter where it is located. It does this by uniquely providing field level security, removing these fields from the source, storing the encrypted data and separately, without changing the underlying database structure or using a keystore to manage the encryption keys. By doing this organisations are removing not only the hacker threat to the data, but also the more prominent insider threat.

“We must focus our security efforts on the data itself, both at rest and in transport, this includes protecting it at foundation level. Given that a business will easily spend millions to protect access to data, it would only make sense to secure the data itself as it comes through and sits in your database. Many believe this happens with encryption, but there is a flaw – current database systems can encrypt stored data, but methodologies such as Data Masking, Homomorphic Encryption, TDE and others use keystores are leaving gaps in access. This means that anyone (human or machine) that has access to the system at any administration level generally also has access to the plain unencrypted data and leaves a come get me sign.

“By putting the security focus on the data itself, not just where it comes from, but where it is stored or being transacted to, it enables better protection for both external and internal threats that organisations desperately need to keep sensitive information protected.” Bain concluded.