Vietnam's central bank requests thorough fixing of information system loopholes

The State Bank of Vietnam (SBV), the country's central bank, has required credit institutions and payment intermediaries to assess information security and promptly fix existing system loopholes.

The SBV delivered the request to credit institutions, payment intermediary service providers, credit information service providers, Deposit Insurance, National Payment Corporation of Vietnam (Napas), and National Credit Information Center of Vietnam (CIC) after an incident with "signs of personal data breach" occurred at CIC.

The SBV said it had received warnings from authorities and reports from members of the Banking Information Technology Security Incident Response Network about cybercrime increasing targeted attacks, exploiting vulnerabilities and weaknesses in applications and information technology infrastructure.

Therefore, the director of the Information Technology Department under the SBV requested the units to strengthen information system and data security.

Leaders of these banks and enterprises need to pay attention to information security in cyberspace, and be responsible before the law and the SBV Governor if there is a loss of network security and leakage of data or state secrets at the units under their management.

The units need to thoroughly and promptly fix the loopholes and weaknesses that still exist in their information systems. At the same time, they must upgrade and replace systems that are still using outdated operating systems and applications that are no longer supported by the manufacturer.

The central bank requires banks and payment intermediaries to promptly update security patches for all devices in the system, especially servers, applications, network devices, and network security. Service ports on the server must ensure that only necessary services are opened.

In addition, a series of other tasks to enhance system and data security were mentioned by the leader of the Information Technology Department, such as system administration access rights for officers; multi-factor authentication when accessing the administration of servers, applications, and important network devices and network security devices; data loss prevention, encrypted storage of information and data (not public information and data) etc.

The units are also required to assess information security with services provided by third parties, and prevent and stop hackers from exploiting third-party security vulnerabilities to penetrate the units' system (supply chain attacks).

In addition, units in the industry must regularly review threats on information systems, update intelligence information on ongoing and upcoming threats to proactively and effectively respond to cyber attacks, and have plans and scenarios for response.

Important data and applications need to be backed up according to the SBV's regulations and instructions, ensuring recovery when necessary.

The Vietnam Cyber Emergency Response Center (VNCERT) on Thursday announced that it has received a report of a cyber security incident occurring at the National Credit Information Center of Vietnam (CIC) and initial reports show "signs of personal data breach".

The CIC is under the State Bank of Vietnam, the country's central bank, while VNCERT is under the Department of Information Security of the Ministry of Science and Technology.

Immediately after receiving the information, the Department of Cyber Security and High-Tech Crime Prevention (A05) under the Ministry of Public Security, directed VNCERT to preside over and coordinate with leading enterprises providing network information security services including Viettel, VNPT, and NCS, along with CIC and functional units of the SBV.

"Initial verification results show signs of cybercrime attacks and intrusions with the aim of stealing personal data. The amount of illegally acquired data is still being counted and clarified," the government's news portal quoted VNCERT as saying.