Even as Singapore takes steps to prevent another cyber attack like the one which compromised the data of around 1.5 million SingHealth patients, the incident should not be allowed to derail the country's push towards becoming a Smart Nation.

Deputy Prime Minister Teo Chee Hean made this clear while speaking at the Public Service Engineering Conference 2018 at Resorts World Sentosa yesterday.

"We should not allow this incident to hold us back in building a Smart Nation and a digital government. We need to persist with our efforts to harness the potential of the digital age while building deeper expertise in our cyber security... to do so confidently," said Mr Teo, who is also Coordinating Minister for National Security.

Commenting on the lessons learnt so far, he added that the incident had exposed weaknesses in the end-user workstations of the public health sector.

Internet surfing separation could and should have been implemented for computers in the public healthcare sector, just as it had been done for the public sector. This would have gone some way in preventing the massive data breach revealed last week, he added.

Mr Teo disclosed that the attackers had gained entry into the SingHealth system through one of the front-end computers connected to the Internet used by "thousands of users in the medical and academic community".

The hackers eventually made off with the personal information of around 1.5 million patients in the worst cyber attack here.

Of these, 160,000 people, including Prime Minister Lee Hsien Loong and a few ministers, had their outpatient prescription information stolen as well.

The computers in the public healthcare clusters have since been delinked from the Internet, a move which Mr Teo said would have disrupted the cyber attack.

The Health Ministry, announcing the temporary delinking on Monday, did not say when it would end. Such a move has been in place for public servants since last year, when all official computers used by government agencies, ministries and statutory boards were delinked from the Internet for security reasons.

Besides front-end computers, the sophisticated and persistent intruder had also circumvented security barriers at the intermediate layer that manages and screens requests to SingHealth's database, said Mr Teo.

He added that solutions are being implemented to address these issues.

The case has cast a spotlight on the prompt reporting of such incidents to the cyber security authorities so that investigations can be carried out, said Mr Teo.

He noted that SingHealth's IT operators were able to discover the intrusion attempt and report it.

In other jurisdictions, he pointed out, there had been instances in which systems intrusions and the loss of large amounts of data were discovered only after the data was published online or offered for sale on the Dark Web.

But Mr Teo said: "Of course, we are studying to see how this could have been detected and reported more quickly, preventing such a large data loss."

A Committee of Inquiry has been appointed to look thoroughly into all aspects of the cyber attack.

Pointing to this, Mr Teo said that addressing the issue of the cyber attack goes beyond implementing technical solutions, and also involves "addressing public concerns and confidence, communicating and explaining to the public and our own users as transparently as possible".