DSTI: Legacy Systems Caused SA Lengau Supercomputer Breach

• South Africa's Lengau supercomputer experienced a cyber security incident in late May, involving unauthorised access and crypto-currency mining malware.
• The breach was attributed to vulnerabilities within the legacy high-performance computing system, including ageing components no longer fully supported by vendors.
• The DSTI Minister, Blade Nzimande, confirmed the incident in a Parliamentary reply, detailing that the compromise was confined to specific components and did not affect the entire national cyber infrastructure.
• Immediate containment measures were implemented, followed by a comprehensive remediation and resilience program by the National Integrated Cyber Infrastructure System (NICIS) at the CSIR.
• The incident highlights the critical need for robust cybersecurity frameworks and continuous vulnerability management for strategic national assets like the Lengau supercomputer.

This incident serves as a stark reminder of the ongoing risk posed by legacy system vulnerabilities and the need for continuous vigilance.

A significant cyber security incident impacted South Africa's Lengau supercomputer in late May, revealing vulnerabilities within the nation's critical research infrastructure. The breach, which involved unauthorised access and the deployment of crypto-currency mining malware, affected components of the high-performance computing environment managed by the Centre for High Performance Computing (CHPC). This facility is a vital national strategic research asset, integral to advancing high-performance computing capabilities across South Africa.

Details of the compromise came to light through a written Parliamentary reply from the Department of Science, Technology and Innovation (DSTI) minister, Professor Blade Nzimande. The minister confirmed that the Council for Scientific and Industrial Research (CSIR), specifically through its National Integrated Cyber Infrastructure System (NICIS), had identified the incident. The CHPC itself operates as a foundational pillar of the NICIS, underscoring the strategic importance of the affected system.

The primary cause of the SA Lengau supercomputer breach was attributed to “vulnerabilities associated with the legacy high-performance computing system,” as outlined in the DSTI Parliamentary reply concerning Lengau. Minister Nzimande elaborated that certain components within the system are ageing, technically constrained, and no longer receive full support from their original vendors. This situation highlights a common challenge for critical infrastructure, where the reliance on older, unsupported technology can create significant security gaps.

The minister's response came in reply to an inquiry by MK MP Thembinkosi Mjadu, who sought information on the technical and governance failures that facilitated the breach, accountability measures, and whether independent cybersecurity upgrades had been implemented. The inherent risks posed by such legacy environments contribute to broader South Africa critical infrastructure vulnerabilities, making systems susceptible to exploitation, as demonstrated by the crypto-currency mining malware Lengau incident.

Upon confirmation of the CSIR cyber security incident, immediate containment measures were enacted to limit the impact. Specialist technical support was engaged, and internal governance processes were initiated to thoroughly investigate the cause, extent, and impact of the breach, as well as to determine appropriate remedial actions. It was clarified that the incident did not compromise the entire national cyber infrastructure environment, but was confined to specific affected components within the high-performance computing system.

The NICIS has since implemented a comprehensive cyber security remediation and resilience programme for the CHPC environment. This programme encompasses both immediate containment actions and longer-term improvements to the system's security architecture, monitoring capabilities, governance frameworks, and assurance processes. Specific remedial measures include strengthened access controls, enhanced privileged-access management, account reviews, improved network segmentation, hardening of affected systems, and better vulnerability and patch-management processes. Furthermore, enhanced monitoring has been put in place to detect abnormal compute workloads, suspicious authentication activity, and other indicators of compromise. An independent team of cybersecurity specialists from the CSIR defence and security cluster was also brought in to support forensic analysis and technical remediation, with the NICIS subjecting all implemented measures to independent cyber security assurance.

The Lengau supercomputer, unveiled in 2016, is a petascale cluster featuring over 32,000 central processing unit cores. It delivers peak performance crucial for local scientific and industrial research, supporting advanced workloads such as bioinformatics. The breach underscores the critical importance of robust cybersecurity for such strategic national assets, particularly given the persistent threat of crypto-currency mining malware and other sophisticated attacks.

Minister Blade Nzimande affirmed that existing escalation, reporting, and cyber risk oversight arrangements will be strengthened to ensure faster response times and greater executive visibility of cyber security incidents affecting strategic research infrastructure. This incident serves as a stark reminder of the ongoing risk posed by legacy system vulnerabilities and the need for continuous vigilance. It urges compliance officers and legal counsel to review their clients' cybersecurity frameworks, incident response plans, and vulnerability management processes, especially for entities managing critical infrastructure or sensitive data holdings, to mitigate future risks and ensure national security.

This incident highlights the ongoing risk posed by legacy system vulnerabilities and crypto-mining malware, urging compliance officers and legal counsel to review their clients' cybersecurity frameworks, incident response plans, and vulnerability management processes, especially for critical infrastructure or sensitive data holdings.

Source: Insights derived from a DSTI Parliamentary reply.