Cyberattack threats on Independence Day loom to destroy Pakistan’s image

The National Telecommunication and Information Security Board (NTISB) has raised an alarm regarding a possible cyberattack aimed at disrupting services and tarnishing Pakistan’s global image on Independence Day, August 14, 2023. The Board’s advisory, titled “Prevention against Website Compromise on the Eve of National Days,” underscores that hostile elements, often state-sponsored malicious actors, historically target government departments, ministries, and defense sector websites to unleash attacks on such significant national occasions.

Highlighting this imminent threat, the NTISB is taking proactive measures to sensitize website administrators and service providers. The advisory recommends adopting additional security precautions, including web server hardening and traffic/integrity monitoring. These steps are crucial to thwart potential website defacement and hacking attempts that might be orchestrated by these hostile entities.

NTISB’s efforts to counter cyber threats are evident through its issuance of 47 advisories in 2023. These advisories cover a range of cybersecurity concerns, including cyberattacks, hacking, fraudulent/fake emails, and protection guidelines for individuals, government employees, and websites.

To fortify digital defenses, NTISB advocates adhering to a series of cybersecurity best practices:

1. Keep operating systems and web servers updated to the latest versions.
2. Restrict access to the website admin panel to white-listed IP addresses only.
3. Shield websites from SQL injection attacks by employing input validation techniques.
4. Conduct thorough analysis and penetration testing to identify potential vulnerabilities.
5. Deploy the complete website infrastructure on local servers, including databases.
6. Use the HTTPS protocol for secure client-web server communication.
7. Separate application and database installations on different machines with robust security measures.
8. Store sensitive data in encrypted form, limiting public access.
9. Minimize database user privileges and grant access within programming code.
10. Implement stringent security measures on endpoints and servers, avoiding unnecessary ports and applications.
11. Employ updated antivirus tools and firewalls on endpoints and servers.
12. Enforce strong password usage policies.
13. Disable remote management services like RDP and SSH in production environments.
14. Utilize web application firewalls (WAF) for safeguarding against web attacks.
15. Adhere to secure coding practices, including parameterized queries and input validation.
16. Maintain up-to-date systems and network devices.
17. Establish a log retention policy for at least three months on separate devices to identify attackers’ reconnaissance activities.