(PNA photo by Joan Bondoc)
MANILA – Government agencies can ward off cyberattacks with rigorous risk assessments, advised an official of the Cybercrime Investigation and Coordination Center (CICC).
Assistant Secretary Mary Rose Magsaysay, CICC Deputy Executive Director, said during a Senate inquiry on Tuesday that the risk assessments should include revisiting government agencies' engagements with their cybersecurity vendors, as well as the conduct of data classification.
"Ang pagtingin po ng kanilang mga service level agreement between sa mga vendor nila at sa kanila ang magpapakita kung sino ‘yung nangangalaga ng mga impormasyon, kung 'yung vendor ba o sila. Pero at the end of the day, sila talaga ‘yan kasi sila ang nag-a-acquire ng services (The review of the service level agreements between the vendors and the agencies will show who handles the information, if it is the vendor or them. But at the end of the day, it should be them [agencies] because they are ones who acquired the services)," Magsaysay said.
"Then magkaroon po ng data classification para alam nila kung ano 'yung pwede nilang i-share o hindi pwedeng i-share sa public and sa vendor nila (Then do data classification for them to know what to share or not to share to the public and to their vendor)."
Magsaysay said the Department of Information and Communications Technology (DICT) is ready to guide other government agencies to determine their status in all levels of cybersecurity.
The inquiry, conducted by the Committee on Science and Technology chaired by Senator Allan Peter Cayetano, is in response to Senate Resolution 811 filed by Senator Mark Villar, seeking to investigate the breach of the Philippine Health Insurance Corp. (PhilHealth) system on Sept. 22.
PhilHealth's database was hacked through the Medusa ransomware, which infected 72 workstations and the e-claims, member portal, and collection systems.
To contain the issue, the agency resorted to a temporary shutdown of its website and implemented the manual processing of services.
It was followed by another hacking of the Community-Based Monitoring System of the Philippine Statistics Authority and the website of the House of Representatives.
The Senate likewise recorded several attempts to hack its website.
Senate Majority Leader Joel Villanueva commended their Information Technology team for the immediate heightening of its perimeter firewall.
"We will coordinate and monitor with the secretariat to make sure that the institution’s cybersecurity remains airtight. As I’ve said before, there is a need to beef up the government’s cybersecurity, given that the rise in cyberattacks is a threat to national security, as well as compromises the lives and livelihoods of millions of Filipinos," Villanueva said in a statement.
CIF for DICT
Some senators said they want to provide the DICT with confidential and intelligence funds (CIF) to be used in strengthening the country's cybersecurity and hunting down cybercriminals.
Senator JV Ejercito expressed concern that the DICT's budget for cybersecurity was slashed from PHP600 million in 2023 to PHP300 million in 2024.
"Itong cybersecurity, mga hacker, ito na ‘yung modern-day nating mga kalaban eh. Everybody can be victims, lalo na ‘yung mga (In cybersecurity, hackers, they are our modern-day enemies. Everybody can be victims, especially the) vulnerable ones, and this time, our government agencies," Ejercito said.
Senator Sherwin Gatchalian said the CIF should be used by the DICT to procure equipment.
He said cybersecurity awareness among government agencies should be increased, as well as the capability of their personnel.
"Make sure that our websites are protected and not linked to critical information like for example, ‘yung mga 201 file or biodata ng mga empleyado. Dapat merong firewall na hindi nila mapapasukan (the 201 files or biodata of employees. There should be a firewall so it would not be penetrated)," he said during the hearing.
Higher risk level
Magsaysay said DICT would need funding support to strengthen the country's cybersecurity.
"So, ang pag-set up po niyan, which is digitally secured, ay nakatalaga sa pangangalaga ng DICT. So, pagka hindi po natin sila binigyan ng confidential funds, ibig sabihin nun pinipigilan natin ang pagkakaroon ng secured connectivity kasi po ang proactive stance, ang pagbabantay ng cybersecurity ng buong Pilipinas ay nasa kanilang shoulders po (Its setup, which is digitally secured, is part of the DICT's mandate. If we do not provide them with confidential funds, that means we are hindering them from providing a secure connectivity because the proactive stance, handling the cybersecurity of the entire Philippines, is on their shoulders)," she said.
Magsaysay emphasized that the CICC budget is reserved for emergency purposes, such as solving cybercrimes.
She explained that if the DICT fails to boost the country's cybersecurity because it lacks funding, cybercrimes would become more rampant.
DICT Undersecretary Jeffrey Ian Dy told the panel that out of about 25,000 cyberthreats they monitored in 2022, approximately 5,700 came through, mostly web defacement incidents.
House website taken down again
Meanwhile, House Secretary General Reginald Sagun Velasco on Tuesday said the House’s official website was taken down again due to new suspicious and unusual activities.
“We regret to inform the public that the official website of the House of Representatives has been voluntarily taken offline once again. Despite our recent security enhancements, we have detected suspicious and unusual activities that necessitate further scrutiny,” he said in a statement.
Velasco said the action has been taken as a precautionary measure to double-check and reinforce the cybersecurity measures they have undertaken and to ensure no vulnerabilities remain.
“Our primary concern is to guarantee the safety, integrity, and reliability of our digital platform for the citizens we serve,” he said.
The House website was hacked on Sunday and was restored at around 7 p.m. Monday.
“We understand the inconvenience this might cause and appreciate the public's patience and understanding as we work diligently to address these concerns. Our commitment to transparency and open communication remains unwavering, and we will provide updates as soon as we have more information,” Velasco said. (with reports from Zaldy De Layola/PNA)
