ISLAMABAD: National Assembly was informed that an average of 71,000 cyber-attacks were being made on Federal Board of Revenue (FBR) portals every month.
This information was given to the lowe house of the Parliament by Finance Minister Shaukat Tarin, in a written reply to a question from PPP MNA Hina Rabani Khar placed before the House, about the cyber-attacks being made on FBR web-portals.
Tarin also infirmed the house that the volume has, over a couple of years, increased sharply as tools and methods available with the hackers are more powerful and sophisticated.
This was the first detailed reply from the finance minister regarding protecting the data of taxpayers.
The minister said FBR had been authorized to procure cyber and information security-related hardware, software and services to protect the organization from future attacks.
In the written reply, he said during the last three years (Feb 18, 2019 to Feb 22, 2020; March 23, 2021; April 13, 2021 to August 19, 2021), FBR’s systems were breached three times (around 0.001pc success rate).
“The breach in 2019 was not detected till the investigation into the latest breach in August 2021. The breach was minor in nature and the infrastructure hosting the FBR website was hardened. Therefore, a cyber-breach-related audit was not carried out to date”, the minister informed the house.
Shaukat Tarin said there was an ongoing investigation into the current breach with the help of a third party. This third party is helping scan the entire FBR network, including all machines located in the field formations, in order to determine the possible point of the initial breach.
He said once this has been determined and remedial actions have been taken, a full third-party security audit will be carried out to determine any remaining vulnerabilities.
A full action plan to counter the vulnerabilities will be put together and its execution monitored, he said, adding, “Therefore, a cyber-breach-related audit was not carried out to date. Technology continues to evolve at breakneck speed and requires constant reinvestment.”
The minister said it was highly recommended that an annual budget for technology refresh be allocated to FBR, which would allow the organization to keep its technology up to date and take full advantage of advancements taking place in that space. This should be equivalent to 0.05pc of the revenue collected which would have amounted to Rs2.4bn last year.
This amount would have been sufficient for the FBR to have upgraded much of its information security infrastructure which may have prevented the recent incident.
The threat landscape is always evolving at a faster pace as compared to organizations trying to protect themselves. Therefore, this initial procurement may protect the FBR for the immediate and medium future. However, a continued investment must be put in place to protect and allow the FBR to evolve into a data-driven digital organization, he added.
Read more: Pakistan not given blanket GSP Plus extension; asked to submit fresh application
