Kathmandu. The National Cyber Security Center has issued a cyber security advisory. Noting that serious security flaws including Node to Cell have been identified in the Node.JS runtime recently, the Center has requested to check the version of the Node.JS runtime used in the systems and web applications of the relevant bodies and update the new version.
If the weakness is misused, there is a risk of unauthorized access to the related system, service interruption and unauthorized control over the operations running on the system. It is requested to take security measures to avoid this”, the center said.
The Center issued a circular today and also directed to mandatorily apply valid SSL/TLS certificates to secure websites. The Center, which is under the Office of Information Technology and Electronic Governance under the Office of the Prime Minister and the Council of Ministers, has written to the Federal Ministry, Commission, Secretariat, Provincial Ministry, Association of Nepal Municipalities and National Association of Rural Villages, requesting them to effectively implement the security standards of the website.
The Center has said that in recent days, in the context of increasing cyber security risks, encryption system should be made mandatory on the website to exchange user data safely. For that, it is mentioned in the instructions that a valid SSL and TLS certificate with TLS 1.2 or TLS 1.3 protocol should be used.
According to the directive, all government agencies should immediately check the validity of SSL and TLS certificates being used on their websites. Websites that do not have or have expired certificates should be connected and configured with a valid certificate issued by an official and trusted authority.
Similarly, the Center has also directed to make arrangements for the website to operate only through HTTPS and to completely stop old and insecure protocols like TLS 1.2 and TLS 1.3.
The center has requested to arrange for regular renewal of SSL and TLS certificates before their expiry and to implement other necessary security standards with high priority to reduce the risk of cyber attacks due to weaknesses in website security.
The center said that such a system is necessary to protect the personal details and other sensitive information of citizens while strengthening the security of the government website.