Alan Kelly (Tipperary, Labour)
Link to this: Individually | In context | Oireachtas source

179. To ask the Minister for Public Expenditure and Reform if Departments or public service computers, devices or network systems were compromised due to a computer system vulnerability (details supplied); if online or other services stopped working due to same; if so, the details of such incidents; and if he will make a statement on the matter. [2738/22]

Alan Kelly (Tipperary, Labour)
Link to this: Individually | In context | Oireachtas source

180. To ask the Minister for Public Expenditure and Reform the costs to date of addressing a computer systems vulnerability (details supplied); if this issue has been resolved; if specialist teams were established, recruited or contracted to address the issue; if additional resources were procured; if so, the details and costs of same; and if he will make a statement on the matter. [2739/22]

Alan Kelly (Tipperary, Labour)
Link to this: Individually | In context | Oireachtas source

181. To ask the Minister for Public Expenditure and Reform the number of computers and devices impacted in Departments and the public service by a computer system vulnerability (details supplied); if data was compromised; the number of servers that were impacted; if the issues have been resolved; and if he will make a statement on the matter. [2740/22]

Michael McGrath (Cork South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I propose to take Questions Nos. 179, 180 and 181 together.

My Department implements a multi-layered approach to cyber security and to protecting ICT systems, infrastructures, and services. Information relating to services provided and or responses initiated to events in other Departments should be directed to these Departments.

The threat landscape is constantly evolving and significant effort is expended to continually enhance and strengthen ICT security to mitigate against emerging threats, risks, vulnerabilities and cyber security issues. In addition to deploying intrusion protection systems, software vulnerabilities are managed by maintaining up-to-date versions. 

The vulnerability referenced in the question was identified by my Department on Friday 10th December. In accordance with current standard operational procedures my staff immediately began to examine the Department’s internal and external facing systems in a coordinated fashion to identify potential vulnerabilities.  Vendors of key software applications, equipment, and services were consulted to identify any potential issues with their applications, equipment or services. The recommendations that were detailed in advisory alerts issued by the National Cyber Security Centre on the vulnerability were followed which included checking through system logs for exploits and ensuring that mitigation measures such as applying security patches were put in place.

There were no unplanned stoppages of my Department’s online or other services and there is no evidence to indicate that any computers, devices or services were compromised by the vulnerability.

No additional costs have arisen to date to address the vulnerability. As the vulnerability was investigated and addressed where necessary by existing Department resources and under existing support arrangements, there was no need for additional dedicated specialist teams to be established, recruited or contracted.