Defence body warns of data breaches and ransomware attacks, advises staff to follow CERT-In guidelines

(Representative Image)

The Controller General of Defence Accounts (CGDA), which oversees the Defence Accounts Department (DAD) in the Ministry of Defence, recently notified its employees of an increase in data breaches and data leaks from government offices and advised its staff to adhere to an advisory issued by the Indian Computer Emergency Response Team (CERT-In) in order to prevent such cyber threats.

"A rise in incidents of data breach and data leaks affecting data/PCs and emails is being continuously observed in the official environment. Attackers use a variety of techniques to gain access to the internal network's servers and databases," said the Controller General of Defence Accounts in an official circular issued on 6 December.

"Also attackers exfiltrate data and then deploy ransomware to encrypt the data they have stolen and release stolen data in public domain," the circular said.

This comes just a few weeks after the All India Institute of Medical Sciences (AIIMS) was hit by a massive ransomware attack that rendered its digital systems inoperable, making operations such as the generation of unique health identification numbers, new registrations, laboratory reports, billing, and patient discharge inaccessible.

This advisory is significant because the DAD is responsible for payment, financial advice, internal audits, and accounting of the expenditures and receipts of the Armed Forces, including the Coast Guard, Defense Research and Development Organization laboratories, and defence ordnance factories.

Moneycontrol has sent additional questions to the CGDA, and the post will be updated once a response is received.

CERT's advisory regarding data breaches

The CGDA said that CERT-In has issued a set of guidelines on how to avoid data breaches, which it urged employees to follow.

One of these guidelines from CERT-In, which appeared in the CGDA's circular, stated: "Employees must be advised to avoid mixing personal with work email and/or work documents, or allowing someone they shouldn't to use their official device or sharing official information with them."

The CERT-In advisory also urged employees to identify and classify sensitive/personal data, as well as to take measures to encrypt such data.

Here are some additional directives from CERT-In that were mentioned in the CGDA circular:

• CERT-In advised users to check their systems for keyloggers. A keylogger monitors and records each keystroke or single key depression on a keyboard.
• It advised against enabling the "remember password" option in email.
• Use strong and unique passwords, and keep all computer software up to date.
• It also warned against clicking links in "unsolicited" SMS messages or emails.
• CERT-In advised that when making online payments, the website should utilise HTTPS and have valid certificates.
• It also advised not to share personal information over phone calls and to use Linux on internet-connected PCs.

The defence body warned its employees in August about a cyber security threat in which users were being targeted by a fake WhatsApp-like app in order to trick them into providing their login information.

According to the CGDA's August 24 circular, malicious content was embedded in a fake messaging app called WHSAPP.APK that mimicked WhatsApp.

“This HQrs (headquarters) have been received inputs (sic) from MoD and credible Govt Agency that a new squatting campaign is being used by threat actors to target users and convince them to hand over their login credentials,” the circular read.

Squatting, also known as cybersquatting, is the fraudulent act of registering domain names that appear to be related to already-existing domains or brands with the intention of making money off of user errors, according to Palo Alto Networks, a US-based cybersecurity firm.