Report: Federal Workers, Contractors Behind Half of Government Cyber Breaches 61
schwit1 writes Federal employees and contractors are unwittingly undermining a $10 billion-per-year effort to protect sensitive government data from cyberattacks, according to a published report. The AP says that workers in more than a dozen agencies, from the Defense and Education departments to the National Weather Service, are responsible for at least half of the federal cyberincidents reported each year since 2010, according to an analysis of records.
turn off autoplay (Score:3, Informative)
If you don't want to watch 4 unrelated videos at once, turn off autoplay before visiting the sites in the summary.
Re:turn off autoplay (Score:5, Informative)
If you don't want to watch 4 unrelated videos at once, turn off autoplay before visiting the sites in the summary.
Also, you don't need to click both links, since they are the exact same story, word for word. One is the AP report, the other is the Fox News verbatim repost of the AP report.
About right (Score:5, Interesting)
Re:About right (Score:4, Interesting)
It doesn't even have to be that intentional. From TFA:
People are usually the weakest link in a security system.
And it does not sound like that security system is very well designed in the first place.
Re: (Score:3)
Re: (Score:2)
I believe that in almost all sectors, users are the primary entree into the protected network, either via phishing or other social engineering. You could probably replace the word Government in the phrase "government cyber breeches" with healthcare, financial services, social networking, retail, non-profit, etc.
Social engineering will always work as long as humans have access to the data and systems. There are steps sys admins can take that can limit or mitigate the damage, but the bottom line is that if people need to access the data, then other people will be able to exploit them.
Heavy handed security often isn't the panacea it's advertised as, because ordinary users will find ways to deal with it. Do you make them change passwords daily? They'll resort to keeping a file of daily passwords. Do you make them
Re: (Score:2)
Always one, isn't there.
It's a problem, but not just the feds: (Score:4, Insightful)
My bank is constantly sending out new credit cards because businesses (hey there Home Depot!) won't implement basic security measures to prevent data theft. Data security is a serious issue that needs to be addressed, but "Blame the incompetent gubmint!!!" isn't where we should start.
Re:It's a problem, but not just the feds: (Score:4, Interesting)
Businesses (hey there Home Depot!) won't implement basic security measures to prevent data theft. Data security is a serious issue that needs to be addressed
Yes... PCI was a start, but we need new regulations; first of all, Businesses should be liable for costs to consumers resulting from breaches. There should also be a statutory liability for not being able to prove to within certain standards to consumers and independent auditors that their information is secure and has not been leaked.
In the event a customer's information gets leaked; the burden of proof should rest on the business.
And companies that collect SSNs or other PII that can be used to conduct ID theft should be required to take out an insurance policy to cover at least a portion of their potential liability.
They should be required to have 3rd party independent oversight, and there should be a fine for failures to comply, money which should be distributed to the affected customers, AND there should be a bounty for the company overseeing them spotting an error.
Re: (Score:2)
And companies that collect SSNs or other PII that can be used to conduct ID theft should be required to take out an insurance policy to cover at least a portion of their potential liability.
That's probably not going to solve the problem. There's already a land-rush business in such policies for "covered entities" and "business associates" encumbered by HIPAA, and the general consensus is that they are not worth the paper they're written on. All include (not surprisingly) clauses that require the insured to have "implemented all required safeguards..." (or words to that effect). The problem is that there is no "standard requirement". The clause is just weasel-wording to ensure that no matter wh
Re: (Score:2)
All include (not surprisingly) clauses that require the insured to have "implemented all required safeguards..."
If such a clause exists, then the feds' view should be that the insurance policy is not compliant with the requirement, because the purpose of the insurance requirement is to help protect consumers against insolvency of the business, as such, the insurance policy should be required to payout to a trust sufficient amounts which can only be redeemed by those whose information was leaked or who s
Re: It's a problem, but not just the feds: (Score:2)
What is really the cause is running windows combined with outsourcing to locations that have NO vested interest in the company and are paid very low relative to other nations.
For example, nearly all of the companies that have been cracked of late (target, neiman Marcus, home depot, etc) had ( and most still do) outsourced production admin to India. In India, they pay these ppl less than $10,000 due to exchange rate manipulation. Others in China and Russia simply offer a p
Blame the victim ... (Score:3)
... instead of fixing the goddam problem.
FTFA:
"No matter what we do with the technology ... we'll always be vulnerable to the phishing attack and ... human-factor attacks unless we educate the overall workforce," said Eric Rosenbach, Assistant Secretary of Defense for Homeland Defense and Global Security.
Bold is mine.
So much for AI in doing anything useful in protecting systems, and it's not the overall workforce that needs educating ... it's the fucking gate keepers -- IT and software/hardware manufacturers.
It's a bitch that we send people to schools to be experts in their craft and then we have to educate the consumers of our craft because we are so fucking incompetent.
Re: (Score:2)
Which means that the obvious answer is to have IT working directly with each user. When a user needs to log in, they call IT, IT checks their credentials to ensure they have the right person sitting at the computer, then logs them in. You'll need another couple IT people to make sure that workstsations are locked with people get up, and of course, you'll need someone available to log the users back in when they get back from
If education could have worked ... (Score:4, Insightful)
If education could have worked, it would have worked by now.
The problem is that even if the IT people are competent they have to be MORE competent than everyone who can attack them. Why does everything have to be connected to the Internet?
And they have to that competent with the software/hardware that they're using. How many times has the purchasing decision been made before you've even been aware of the issue?
Which leads to the issues that the software/hardware vendors have within their own companies. Ship today and we'll patch tomorrow. Got to get to market before the competition.
And that isn't considering the problems that "management" at the company you work for keeps introducing. I cannot tell you how many times some executive simply had to have admin access on his laptop which resulted in massive infections being brought onto the network.
Security is easy --- in theory.
But it depends upon hundreds or thousands of decisions being made correctly. By people who have no incentive to protect the security of the systems you support.
Re: (Score:3)
I do federal government InfoSec. When there is a conflict between the mission and security the manager will overrule the system administrator every time. Even in the military where lives are potentially at risk.
Sure, there is a lot of less-than-competent admins out there, but a lot more of the problem is political rather than technical than most people realize.
Re: (Score:2)
Yes. I think it is because the political issues stem from status battles. If you can overrule IT then you have more status.
If you cannot overrule IT then you have less status than the nerds.
And YOUR status, today, is worth more than the risk of someone else's life, possibly, sometime in the nebulous future.
Particularly because you can still blame IT for not
Re: (Score:1)
I do federal government InfoSec. When there is a conflict between the mission and security the manager will overrule the system administrator every time. Even in the military where lives are potentially at risk.
Sure, there is a lot of less-than-competent admins out there, but a lot more of the problem is political rather than technical than most people realize.
Definitely not true in the agency I'm in: Security rules, to the detriment of the mission. We're grinding to a halt under new security rules that have been implemented without accompanying processes in place. "We used to do X, but we can't any more for security reasons." "Okay, what's the new way?" "Y, and it'll be in place next year." "But, uh...we need to get work done NOW." "Well, you can't do X or Y." I want to keep our data safe, too, but we also need to get our projects done...it'd be nice if
Yep, Gov InfoSec (Score:2)
If you IA types understood how a network actually maybe we could talk but get your CISSP and make big bucks saying NO.
Example:
Backup program needs Port X open to initiate backups on remote servers (remember we are an Enterprise, Remote Management and all). Vendor did not adequately document port but our firewall logs and sniffer clearly indicate this message originates from the control server and goes to the Media server to initiate the backup.
What does IA do? Stops all backups until paperwork is finished,
Re: (Score:2)
The problem is that even if the IT people are competent they have to be MORE competent than everyone who can attack them. Why does everything have to be connected to the Internet?
Because there is always someone who thinks they need to be able to access the system from wherever they are in the world. Either a big-wig who wants access to data, or an IT person who wants to be able to work on system issues from his home when things happen in the middle of the night.
Security suffers at the hands of the human penchant for laziness.
Re: (Score:2)
You can't fix stupid.
You can fire them though.
Not if they're a GS employee.
The media and govermment blame russia (Score:1)
Re: (Score:2)
And the Russians! Aren't they the chief troublemakers? How can we push our pre-emptive cyberwarfare withouth a boogeyman foreigner?
Nah; today the term is "terrist". ;-) And them terrists can live nearly anywhere. There are lots of them in China, India, Malaysia, Nigeria, Brazil, and all those Muslim countries that are our current Enemies of Choice. And you can even find them in Canada [google.com].
In Russia, "cyberwarfare" (aka "hacking" to the MSM) is becoming a public, respectable industry. They're into it as a way to systematically make a lot of money, putting them in essentially the same class as most of management in the corporate world
Re: (Score:1)
Welcome to the world of unions.
To finish your one sided connversation a month later, it would be-
"What? He filed a grievance with the union"
"What do you mean he gets his job back with back pay?"
"So hard hard will it be to get that into the next contract?"
"So it won't happen. Expect more of the same- we cannot do anything unless we get competent users who follow rules unless we lock everything down, but then they cannot get any work done"
Re: (Score:2)
Lol.. what is flamebait about that. Everyone knows public employees are in the union and you cannot fire them for reasons not outlined in the conteact.
Re: (Score:2)
Wow (Score:1)
And here I thought those guys didn't do anything all day...
CyberThis, CyberThat, CyberCommand (Score:5, Insightful)
Dear US military and federal contracting wanker-sphere,
I know you were 30 years late discovering this whole internet thing, so imagery and phrases from 1980s cyberpunk still sound super-duper-cutting-edge to you, but can you please stop using "cyber" as a catch-all for everything connected to computers? Thanks.
PS: When you leave a laptop full of citizen's private information on the bus, and a million people's social security numbers turn up on pastebin the next day, that's called "negligence" not "a cyberattack".
Re: (Score:1)
Actually, the "US military and federal contracting wanker-sphere" were among the few organizations that spent big bucks on the foundational concepts of networking that eventually led to the Internet. Look up the history of DARPA sometimes. The first letter in the acronym, D, stands for Defense.
Their reasons for using "Cyber" in front of everything are for completely different reasons. Beancounters in the massive federal bureaucracy system need distinctive search keywords for disparate efforts. If they just
Re: (Score:1)
Sound off!
Re: (Score:1)
I blame the sysadmins/IT staff (Score:2)
They need to be taking proactive steps to securing their systems not only against outside threats, but from the idiots using their systems/networks. Isn't this like common knowledge, your users are your worst enemy?
Oh wait, its the guberment. All bets are all, I guess. Common sense need not apply.
Re: (Score:2)
correction: all bets are off
Which is why corporate security is a joke. (Score:5, Insightful)
All of it can be overcome by a janitor with a USB drive with penetration software.
Security culture is worse. Elaborate passwords. Two or three factor identification. Putting the security burden on the user in general. All you do is:
1) Inconvenience users and make productivity next to impossible.
2) Create an entire culture of employees who must, in order to get any work done, know how to hack their way into corporate systems from outside (I know of two ways. My IT guy knows about 6 entirely different ways), and frequently, inside.
The problem is that security guys get bonuses for reducing intrusions (as they count them). Everyone else gets bonuses for getting their work done and being productive, which frequently isn't something that ever gets on a spreadsheet.
And upper management, as usual, is too stupid, distracted with power politics and just plain pig-ignorant to understand this.
Web Surfing (Score:2)
Re: (Score:2)
Why are government employees web surfing. Don't the have anything better to do?
Don't you love it when people complain about government workers/contractors doing non-work related activities, but then they turn around and complain about their own boss treating them like a machine and expecting them to be productive every minute they're on the clock?
Remember when the perpetrator was responsible? (Score:2)
Workers are responsible for half of cyber incidents? Well, if opening an email or clicking a link as described in the article makes the worker responsible, then so be it. But, in the days before the internet, when corporate (or government) espionage was the issue, it wasn't the worker who created the report that was responsible for it being stolen, but the actual thief. So, other than another attempt to denigrate government workers, why if somebody sends a malicious link is it not the person who sent the li
I'll make this easy on all of us ... (Score:2)
... a person in the workforce asks me if an email is safe.
I grab their email.
The sender is apparently UPS, and the package ain't going nowhere until I click on the attached invoice and correct the ship-to address and stuff.
NOW PAY ATTENTION:
I look at the attachment and it's a .zip file. I double-click the .zip and, inside, there's a goddam .exe.
UPS isn't going to send an attachment in the first place, and it damn sure isn't going to be an .exe, right?
Why in Sam Hill can't a small, fast AI scrubber do this
seems about right (Score:1)
"Report: Federal Workers, Contractors Behind Half of Government Cyber Breaches"
Since the government employs about half of the people in the US this is probably statistically correct for anything :)