# MA-1015.012024: MyCERT Advisory - Cyber Security Best Practices for System Administrators and Internet Users

**Date:** 29 Jan 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1015.012024  
**Advisory ID:** MA-1015.012024

---

**1.0 Introduction**
The Cyber999 Cyber Incident Response Team has recently observed cyber threat activities online. These activities include online fraud, intrusion, malicious code, and data breaches. Sensitive and private personal information, such as names, phone numbers, emails, and home addresses, are exposed and might be traded on the dark web by cyber criminals.
Hence, organisations and citizens are advised to be constantly vigilant and cautious of potential cyber-attacks and always be prepared with necessary mitigation and prevention measures.
Notably, we have also constantly produced security advisories on software vulnerabilities as well as product updates such as Microsoft, Cisco, Adobe, and Apple, as well as other cyber threats, which can be found in the following URL:
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5>
System Administrators and Internet users are highly advised to refer to our Security Alerts and Advisories and follow our cyber security best practices. System Administrators and Internet users must be aware of system and software vulnerabilities and associated threats by applying necessary patches and updates. This is crucial to help prevent cyber-attacks as much as possible and minimise the impacts or risks associated with the incidents. Our experiences dealing with cyber-attacks show many attacks are due to vulnerable systems and software without the latest updates.
**2.0 Impact**
The impact of data breaches, intrusions, and malware infections depends on the nature. A data breach may lead to the unauthorised access and exfiltration of sensitive information, impacting the confidentiality and integrity of data. Intrusions involve unauthorised access to network or system resources, potentially leading to data compromise, disruption of services, and the exfiltration of critical intellectual property. Malware infections introduce malicious software that can compromise systems and data availability, integrity, and confidentiality. The financial impact includes costs associated with incident response, forensics, and regulatory fines for non-compliance. Reputation damage refers to the loss of trust from stakeholders and customers. Legal consequences involve potential regulatory actions and lawsuits. Operational disruptions encompass downtime and loss of productivity.
**3.0 Recommendations**
3.1 The following are best practices and recommendations for System Administrators:
- Ensure systems, applications and third-party add-ons are updated with the latest upgrades and security patches. If you are running older versions of operating systems or software, upgrade it to the newest version, as older versions are vulnerable and easily manipulated by intruders. Also, patch your web-based applications and network-based appliances accordingly.
- Refer to your respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, you may also refer to MyCERT’s website for the latest advisories on patches, service packs and upgrades as below:
- <https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5>
- Update the Anti-virus software running on hosts and email gateways with the latest signature files and ensure the settings to scan all files are enabled.
- Configure systems properly to avoid incidents such as information disclosure and directory listing due to system misconfiguration.
- Always enable logging systems and server activities and keep them in a sufficient period.
- Backup critical information regularly to limit the impact of data or system loss and to help expedite the recovery process. Ideally, backup daily on a separate media and store offline at an alternate site.
- Organisations are recommended to apply an defence in-depth strategy in protecting their networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent and log most generic attacks.
- Data Centres and Web Hosting Companies should beware of any software or third-party add-ons they are running by applying the latest patches or upgrades to prevent intrusions that may exploit unpatched applications.
- Organisations must ensure the contact information of System Administrators is made available in the event of a security incident at or originating from your site.
- Financial Institutions must be vigilant against any possibilities of phishing and fraudulent activities that target Internet banking. Customers must be advised adequately to avoid becoming victims of these scams by applying safe browsing, email, and Internet banking practices.
- System Administrators must immediately report any suspicious activities they observe in systems and networks under their administrations to relevant authorities and seek assistance. Incidents can be reported to the Cyber999 Incident Response Centre through our reporting channels, as listed at the end of the page, and we will respond accordingly. To report any critical incident, call Cyber999 via the 24x7 On Call Incident Reporting channel.
3.2 The following are best practices and recommendations for home users:
- Update your computer and browsers with the latest upgrades and security patches.
- Install Anti-Virus software on your PC to scan and block any malware. Update Anti-virus regularly with the latest signature files to detect new worms/viruses.
- Take extra precautions when clicking links and downloading attachments from social networking sites or emails.
- Do not fall victim to online scams. Take precautions against online scams that target Internet users.
- Do not simply share your personal identifier information on the internet.
- Users are recommended to practice the following tips and guidelines to browse the Internet safely:
- [http://www.cybersafe.my](http://www.cybersafe.my/)
- Backup critical information regularly to limit the impact of data or system loss and to help expedite the recovery process. Ideally, backup daily and keep data on a separate device, offline at an alternate site.
- Incidents can be reported to Cyber999 through our reporting channels, as listed at the end of the page, and we will respond accordingly. To report any critical incident, please call Cyber999 via the 24/7 On Call Incident Reporting channel.
- Users who have become victims are advised to call the National Scam Response Centre (NSRC) at 997 immediately for NSRC's quick action.
Generally, we advise System Administrators and Internet users to be updated with the latest security announcements by the vendor and follow best practices and security policies to determine which updates should be applied.
This Security Alert is released by CyberSecurity Malaysia. For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>