Following the cyberattack: security analyses completed
Vaduz (ots)
The security architecture of the Register of Beneficial Owners (VwbP) has been comprehensively reviewed following the cyberattack at the end of July. The vulnerabilities traced to the registration area during the security analyses have been identified and documented. The requirements for verifying user accounts and checking identity will be strengthened by adding an upstream eID step. In addition, the monitoring and detection mechanisms are being expanded so that unauthorised access is detected at an earlier stage. Before the system is brought back into operation, the Office of Information Technology will carry out further comprehensive, multi-stage security checks in order to thoroughly test the protection mechanisms.
"The security analysis has shown that unauthorised access to the data was possible due to faulty authorisation-checking logic. This vulnerability made it possible to exploit the application programming interface (API) through repeated individual requests in a manner that was not intended. It was not a classic software vulnerability. For investigative reasons, we cannot provide any further information on the findings at this time," says Fabian Schmid, Head of the Office of Information Technology. "We are now doing everything we can to further strengthen the systems and to create the conditions for a secure return to operation of the systems that were taken offline as a precaution. The security tests still required for this purpose are very extensive and will accordingly take time," Schmid adds. According to the current plan, all checked systems will be brought back online step by step over the coming weeks.
The Government and the competent bodies are working with determination to further develop the systems and to protect them as effectively as possible against the constantly changing risks in cyberspace.
The preliminary inquiries at the Liechtenstein Court of Justice to identify the unknown perpetrators are ongoing. Requests for mutual legal assistance have been sent to various jurisdictions, but responses are still pending. Experience shows that this will still take some time. The Government will provide information on further developments in dealing with the cyberattack in close coordination with the investigating authorities.
Contact:
Information and Communications Unit of the Government
kommunikation@regierung.li