# MA-505.082015: MyCERT Alert - Best Practices to Secure Systems Against Security Incidents and Threats

**Date:** 11 Aug 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-505.082015  
**Advisory ID:** MA-505.082015

---

#### **1.0 Introduction**
MyCERT had been receiving several incidents that involve compromise of systems that belong to various sectors within our constituency. As a preventive measure, MyCERT release this Alert to advise System Administrators to constantly take necessary steps to secure their systems against unwanted incidents as well from other security threats.
System Administrators should take extra precautions against any possibilities of intrusions, phishing attacks, and malware activities by implementing proper preventive measures against the threats. Data Centres and Web Hosting Companies should also take extra precautions against any software or third party add-ons they're running by applying the latest patches/upgrades to prevent intrusions that may exploit unpatched applications.
**2.0 Recommendation**
Attached below are some recommendations for System Administrators:
1. Organizations are recommended to apply defense in depth strategy in protecting their networks. Firewalls, intrusion prevention systems (IPS), network and host based intrusion detection systems (IDS) can prevent and log most of the generic attacks.
2. Make sure systems, applications and third party add-ons are updated with latest upgrades and security patches.
If you're running older versions of operating systems or software, make sure they are upgraded to the latest versions as older versions may have some vulnerability that can be manipulated by intruders. Aside from that, please make sure that your web based applications and network based appliances are patched accordingly.
You may refer to your respective vendors' websites for the latest patches, service packs and upgrades. You may also refer to MyCERT's website for information on the latest patches, service packs and upgrades by referring to our latest advisories at:
•    https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2015&ctype=&keyword=
3. Make sure Anti-virus software that are running on hosts and email gateways are updated with the latest signature files and are enabled to scan all files. You may refer to the AV sites at:
•    [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
4. Make sure that your systems are configured properly in order to avoid incidents such as information disclosure, directory listing that are caused by system misconfiguration.
5. Make sure loggings of systems and servers are always enabled. System Administrators are advised to read and monitor the logs on daily basis.
6. Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site.
7. Organizations are recommended to regularly conduct vulnerability assessment and penetration testing on their systems.
8. Report security incidents to relevant authorities or to CERTs/CSIRTs in your constituency for immediate remediation and mitigations.
9. In addition, home users are advised to:
• Make sure your PCs and browsers are up-to-date with the latest upgrades and security patches
• Install Anti-Virus software on your PCs to scans and blocks any malware to the PC. The Anti-virus should be regularly updated with the latest signature files in order to detect new worms/viruses
• Do not simply click on links and attachments that they receive via Social Networking Sites or Emails on their computers and smartphones. Extra precautions must be taken when opening the links and attachments.
• Users are recommended the following tips and guidelines on safe Internet at:
<http://www.cybersafe.my>
• Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done on daily basis and this data should be kept on a separate device, stored offline at an alternate site.
• Report security incidents to relevant authorities or to CERTs/CSIRTs in your constituency for immediate remediation and mitigations.
In this year, MyCERT had released several Alerts and Advisories on current threats and vulnerabilities. System Administrators and Internet users must be aware of these threats and vulnerabilities by applying necessary patches and updates.
The Alerts and Advisories are available at:
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2015&ctype=&keyword=>
For incident reporting and other enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my]( https://www.mycert.org.my)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)