National Cyber Security Center issues advisory on government website security

The National Cyber Security Center has issued circulars and advisories to all government bodies on the security of government websites and systems.

The center operates under the Office of Information Technology and e-Governance, which falls under the Office of the Prime Minister and Council of Ministers. Circulars have been sent to federal and provincial ministries, commissions, secretariats and umbrella organizations of local levels.

Citing a growing risk of cyberattacks in recent times, the center has made valid SSL/TLS certificates mandatory for all government websites to encrypt the exchange of user data. The certificates must support the TLS 1.2 or 1.3 protocol, and agencies have been told to disable older protocols. Agencies under each body have also been directed to immediately check the validity of certificates currently in use on their websites.

In a separate advisory, the center said serious security vulnerabilities, including Node2Cell, have been found in the Node.js runtime. The center said exploitation of such vulnerabilities could allow unauthorized access to systems, disruption of services, and external control over ongoing operations. It has therefore urged agencies to check the version currently in use and update to the latest version.