Potential Attacks towards Malaysian Organisations’ Websites

For technical teams

1. Organisations and Security Operation Centres are advised to take the following actions: Official source
2. Update your critical assets with the latest security patches and updates; Do not open or click on unsolicited mails and links with/without attachments; Ensure that anti-virus/anti-malware signatures are up to date and functioning; Never follow links from untrusted sources, which could possibly lead to security attacks, computer virus infection or even identity or account information theft; Disconnect your computer from the Internet when it is not in use; Review your firewall logs and other security devices for anomalies from time to time; Review your firewall and other security devices configurations from time to time; Block or restrict access to every port such as port 3389 (RDP), port 5900 (VNC) and port 22 (SSH) and services except for those that should be publicly available; Make sure loggings of systems and servers are always enabled; Make sure your website administrator’s password is strong and secured. Change the password if needed; Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site; Shut down all workstations before leaving your office; If you suspected that your servers have been compromised, isolate your server, reset all usernames and passwords and initiate incident handling; Perform hardening on all your Internet facing applications; Monitor your environment closely for any anomalies; and Report any anomalies happening within your network and enterprise environment immediately to NC4. Official source