Slashdot Mirror
Report: Federal Workers, Contractors Behind Half of Government Cyber Breaches
schwit1 writes Federal employees and contractors are unwittingly undermining a $10 billion-per-year effort to protect sensitive government data from cyberattacks, according to a published report. The AP says that workers in more than a dozen agencies, from the Defense and Education departments to the National Weather Service, are responsible for at least half of the federal cyberincidents reported each year since 2010, according to an analysis of records.
If you don't want to watch 4 unrelated videos at once, turn off autoplay before visiting the sites in the summary.
The statistic I have always heard is that 60% of intrusions are internal. So 50% of breaches coming from employees sounds about right. It's a lot easier to steal stuff if you have a key. And as we have learned again over the past 6 years or so, the best way to rob a bank is to own one.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
From TFA: "Since 2006, there have been more than 87 million sensitive or private records exposed by breaches of federal networks, .....
By comparison, retail businesses lost 255 million records during that time, financial and insurance services lost 212 million and educational institutions lost 13 million."
My bank is constantly sending out new credit cards because businesses (hey there Home Depot!) won't implement basic security measures to prevent data theft. Data security is a serious issue that needs to be addressed, but "Blame the incompetent gubmint!!!" isn't where we should start.
Never let a lack of data get in the way of a good rant.
Always one, isn't there.
Never underestimate the power of stupid people in large groups.
... instead of fixing the goddam problem.
FTFA:
"No matter what we do with the technology ... we'll always be vulnerable to the phishing attack and ... human-factor attacks unless we educate the overall workforce," said Eric Rosenbach, Assistant Secretary of Defense for Homeland Defense and Global Security.
Bold is mine.
So much for AI in doing anything useful in protecting systems, and it's not the overall workforce that needs educating ... it's the fucking gate keepers -- IT and software/hardware manufacturers.
It's a bitch that we send people to schools to be experts in their craft and then we have to educate the consumers of our craft because we are so fucking incompetent.
It little behooves the best of us to comment on the rest of us.
And here I thought those guys didn't do anything all day...
If education could have worked, it would have worked by now.
The problem is that even if the IT people are competent they have to be MORE competent than everyone who can attack them. Why does everything have to be connected to the Internet?
And they have to that competent with the software/hardware that they're using. How many times has the purchasing decision been made before you've even been aware of the issue?
Which leads to the issues that the software/hardware vendors have within their own companies. Ship today and we'll patch tomorrow. Got to get to market before the competition.
And that isn't considering the problems that "management" at the company you work for keeps introducing. I cannot tell you how many times some executive simply had to have admin access on his laptop which resulted in massive infections being brought onto the network.
Security is easy --- in theory.
But it depends upon hundreds or thousands of decisions being made correctly. By people who have no incentive to protect the security of the systems you support.
Dear US military and federal contracting wanker-sphere,
I know you were 30 years late discovering this whole internet thing, so imagery and phrases from 1980s cyberpunk still sound super-duper-cutting-edge to you, but can you please stop using "cyber" as a catch-all for everything connected to computers? Thanks.
PS: When you leave a laptop full of citizen's private information on the bus, and a million people's social security numbers turn up on pastebin the next day, that's called "negligence" not "a cyberattack".
0 1 - just my two bits
I believe that in almost all sectors, users are the primary entree into the protected network, either via phishing or other social engineering. You could probably replace the word Government in the phrase "government cyber breeches" with healthcare, financial services, social networking, retail, non-profit, etc.
Social engineering will always work as long as humans have access to the data and systems. There are steps sys admins can take that can limit or mitigate the damage, but the bottom line is that if people need to access the data, then other people will be able to exploit them.
Heavy handed security often isn't the panacea it's advertised as, because ordinary users will find ways to deal with it. Do you make them change passwords daily? They'll resort to keeping a file of daily passwords. Do you make them fill out a big form to request access to a system? They'll request access to a dozen, in hopes that they will stumble across the correct one, and so won't have to repeat the ordeal; out of the dozen departments they request access from, some may approve the inappropriate request. Or some department head will proclaim "grant everything to my department, because I don't want to waste our time with all these expensive little requests." All of these can be exploited even in the best of situations.
John
And the Russians! Aren't they the chief troublemakers? How can we push our pre-emptive cyberwarfare withouth a boogeyman foreigner?
Nah; today the term is "terrist". ;-) And them terrists can live nearly anywhere. There are lots of them in China, India, Malaysia, Nigeria, Brazil, and all those Muslim countries that are our current Enemies of Choice. And you can even find them in Canada.
In Russia, "cyberwarfare" (aka "hacking" to the MSM) is becoming a public, respectable industry. They're into it as a way to systematically make a lot of money, putting them in essentially the same class as most of management in the corporate world. But in other parts of the world, it's more often a case of causing trouble for your victim, rather than just making money off them.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
They need to be taking proactive steps to securing their systems not only against outside threats, but from the idiots using their systems/networks. Isn't this like common knowledge, your users are your worst enemy?
Oh wait, its the guberment. All bets are all, I guess. Common sense need not apply.
at every opportunity, often to shine light away from the NSA's own global malfeasance.
All of it can be overcome by a janitor with a USB drive with penetration software.
Security culture is worse. Elaborate passwords. Two or three factor identification. Putting the security burden on the user in general. All you do is:
1) Inconvenience users and make productivity next to impossible.
2) Create an entire culture of employees who must, in order to get any work done, know how to hack their way into corporate systems from outside (I know of two ways. My IT guy knows about 6 entirely different ways), and frequently, inside.
The problem is that security guys get bonuses for reducing intrusions (as they count them). Everyone else gets bonuses for getting their work done and being productive, which frequently isn't something that ever gets on a spreadsheet.
And upper management, as usual, is too stupid, distracted with power politics and just plain pig-ignorant to understand this.
Please do not read this sig. Thank you.
Why are government employees web surfing. Don't the have anything better to do?
He quit before the end of the day.
XDInd
If you IA types understood how a network actually maybe we could talk but get your CISSP and make big bucks saying NO.
Example:
Backup program needs Port X open to initiate backups on remote servers (remember we are an Enterprise, Remote Management and all). Vendor did not adequately document port but our firewall logs and sniffer clearly indicate this message originates from the control server and goes to the Media server to initiate the backup.
What does IA do? Stops all backups until paperwork is finished, six months without backups and guess what once the vendor documents turn it back on. No thought about the data risk just turn it off.
Further details if you want but why not allow us a firewall rule from control server to destination server locked to IP addresses and maybe only during a defined time window to allow the backups.
But IA has the hammer and enjoys using it.
Workers are responsible for half of cyber incidents? Well, if opening an email or clicking a link as described in the article makes the worker responsible, then so be it. But, in the days before the internet, when corporate (or government) espionage was the issue, it wasn't the worker who created the report that was responsible for it being stolen, but the actual thief. So, other than another attempt to denigrate government workers, why if somebody sends a malicious link is it not the person who sent the link responsible versus the unknowing end user?
Saying the government workers are the cause of the problem is like saying the woman wearing a short skirt was the cause of the rape. Blaming the victim just diverts attention from the real problem.
... a person in the workforce asks me if an email is safe.
I grab their email.
The sender is apparently UPS, and the package ain't going nowhere until I click on the attached invoice and correct the ship-to address and stuff.
NOW PAY ATTENTION:
I look at the attachment and it's a .zip file. I double-click the .zip and, inside, there's a goddam .exe.
UPS isn't going to send an attachment in the first place, and it damn sure isn't going to be an .exe, right?
Why in Sam Hill can't a small, fast AI scrubber do this simple task?
Why can't AI follow a link, intercept a download (either with or without the operator's permission), let the code execute in a sandbox to see what it WOULD do and say, "I don't think so?"
We don't need to educate the workforce.
We just need to do our jobs.
It little behooves the best of us to comment on the rest of us.
Lol.. what is flamebait about that. Everyone knows public employees are in the union and you cannot fire them for reasons not outlined in the conteact.
Sound off!
"Report: Federal Workers, Contractors Behind Half of Government Cyber Breaches"
Since the government employs about half of the people in the US this is probably statistically correct for anything :)