MAS Technology Risk Management Guidelines (2021)

To have an accurate and complete view of its IT operating environment, the FI should establish information asset management practices covering the identification of the information assets that support its business and the delivery of financial services, the classification of an asset by its security classification or criticality, the ownership of assets and the roles and responsibilities of the staff managing them, and policies, standards and procedures to manage assets according to that classification.

The FI should maintain an inventory of all its information assets, review the inventory periodically, and update it whenever there are changes.

To facilitate the remediation of vulnerabilities in a timely manner, the FI should keep track of updates and reported vulnerabilities for the third party and open-source software codes incorporated in its software.

All issues and software defects discovered from source code review and application security testing should be tracked, and major issues and software defects should be remediated before production deployment.

The FI should implement a configuration management process to maintain accurate information about the configuration of the hardware and software that makes up each IT system — model, version, specifications and the like — so as to have visibility and effective control of its IT systems.

The FI should review and verify the configuration information of its hardware and software on a regular basis to ensure it is accurate and up-to-date.

The FI should avoid using outdated and unsupported hardware or software, which could increase its exposure to security and stability risks, and should closely monitor end-of-support dates, as service providers typically cease providing patches — including for security vulnerabilities found after that date.

A patch management process should be established to ensure applicable functional and non-functional patches, such as fixes for security vulnerabilities and software bugs, are implemented within a timeframe commensurate with the criticality of the patches and of the FI's IT systems.

The FI should establish a change management process to ensure changes to information assets are assessed, tested, reviewed and approved before implementation.

As logs contain information that facilitates investigation and troubleshooting, the FI should ensure the logging facility is enabled to record the activities performed during the change process.

Controls should be implemented to maintain traceability and integrity for all software codes moved between IT environments.

The security standards for the FI's hardware and software, such as operating systems, databases, network devices and endpoint devices, should outline the configurations that will minimise their exposure to cyber threats, and should be reviewed periodically for relevance and effectiveness.

The FI should establish a process to verify that the standards are applied uniformly on systems and to identify deviations from them, and risks arising from deviations should be addressed in a timely manner.

Security measures, such as application white-listing, should be implemented to ensure only authorised software is allowed to be installed on the FI's systems.

To maintain good cyber situational awareness, the FI should establish a process to collect, process and analyse cyber-related information — cyber events, cyber threat intelligence and information on system vulnerabilities — for its relevance and potential impact to the FI's business and IT environment.

A process to collect, process, review and retain system logs should be established to facilitate the FI's security monitoring operations, and these logs should be protected against unauthorised access.

The FI should establish a process to conduct regular vulnerability assessment on its IT systems to identify security vulnerabilities and ensure the risks arising from these gaps are addressed in a timely manner, at a frequency commensurate with the criticality of the IT system and the security risk to which it is exposed.

When performing a vulnerability assessment, the scope should minimally include vulnerability discovery, identification of weak security configurations and open network ports, and application vulnerabilities, and for web-based systems it should include checks on common web-based vulnerabilities.

A comprehensive remediation process should be established to track and resolve the issues identified from cyber security assessments or exercises, minimally including severity assessment and classification of an issue, a timeframe to remediate issues of different severity, and risk assessment and mitigation strategies to manage deviations from the framework.