Slashdot Mirror
Report: Federal Workers, Contractors Behind Half of Government Cyber Breaches
schwit1 writes Federal employees and contractors are unwittingly undermining a $10 billion-per-year effort to protect sensitive government data from cyberattacks, according to a published report. The AP says that workers in more than a dozen agencies, from the Defense and Education departments to the National Weather Service, are responsible for at least half of the federal cyberincidents reported each year since 2010, according to an analysis of records.
If you don't want to watch 4 unrelated videos at once, turn off autoplay before visiting the sites in the summary.
The statistic I have always heard is that 60% of intrusions are internal. So 50% of breaches coming from employees sounds about right. It's a lot easier to steal stuff if you have a key. And as we have learned again over the past 6 years or so, the best way to rob a bank is to own one.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
From TFA: "Since 2006, there have been more than 87 million sensitive or private records exposed by breaches of federal networks, .....
By comparison, retail businesses lost 255 million records during that time, financial and insurance services lost 212 million and educational institutions lost 13 million."
My bank is constantly sending out new credit cards because businesses (hey there Home Depot!) won't implement basic security measures to prevent data theft. Data security is a serious issue that needs to be addressed, but "Blame the incompetent gubmint!!!" isn't where we should start.
Never let a lack of data get in the way of a good rant.
... instead of fixing the goddam problem.
FTFA:
"No matter what we do with the technology ... we'll always be vulnerable to the phishing attack and ... human-factor attacks unless we educate the overall workforce," said Eric Rosenbach, Assistant Secretary of Defense for Homeland Defense and Global Security.
Bold is mine.
So much for AI in doing anything useful in protecting systems, and it's not the overall workforce that needs educating ... it's the fucking gate keepers -- IT and software/hardware manufacturers.
It's a bitch that we send people to schools to be experts in their craft and then we have to educate the consumers of our craft because we are so fucking incompetent.
It little behooves the best of us to comment on the rest of us.
If education could have worked, it would have worked by now.
The problem is that even if the IT people are competent they have to be MORE competent than everyone who can attack them. Why does everything have to be connected to the Internet?
And they have to that competent with the software/hardware that they're using. How many times has the purchasing decision been made before you've even been aware of the issue?
Which leads to the issues that the software/hardware vendors have within their own companies. Ship today and we'll patch tomorrow. Got to get to market before the competition.
And that isn't considering the problems that "management" at the company you work for keeps introducing. I cannot tell you how many times some executive simply had to have admin access on his laptop which resulted in massive infections being brought onto the network.
Security is easy --- in theory.
But it depends upon hundreds or thousands of decisions being made correctly. By people who have no incentive to protect the security of the systems you support.
Dear US military and federal contracting wanker-sphere,
I know you were 30 years late discovering this whole internet thing, so imagery and phrases from 1980s cyberpunk still sound super-duper-cutting-edge to you, but can you please stop using "cyber" as a catch-all for everything connected to computers? Thanks.
PS: When you leave a laptop full of citizen's private information on the bus, and a million people's social security numbers turn up on pastebin the next day, that's called "negligence" not "a cyberattack".
0 1 - just my two bits
All of it can be overcome by a janitor with a USB drive with penetration software.
Security culture is worse. Elaborate passwords. Two or three factor identification. Putting the security burden on the user in general. All you do is:
1) Inconvenience users and make productivity next to impossible.
2) Create an entire culture of employees who must, in order to get any work done, know how to hack their way into corporate systems from outside (I know of two ways. My IT guy knows about 6 entirely different ways), and frequently, inside.
The problem is that security guys get bonuses for reducing intrusions (as they count them). Everyone else gets bonuses for getting their work done and being productive, which frequently isn't something that ever gets on a spreadsheet.
And upper management, as usual, is too stupid, distracted with power politics and just plain pig-ignorant to understand this.
Please do not read this sig. Thank you.