Slashdot Mirror
US Office of Personnel Management Hacked Again
tranquilidad writes: According to a story in the Washington Post, China hacked into the computer system of the United States' Office of Personnel Management last December. This was the second major intrusion in less than a year. Personally identifiable information of approximately 4 million individuals may have been compromised. The compromised information was related to security clearances and employee records. "The FBI is working with our interagency partners to investigate this matter. We take all potential threats to public and private sector systems seriously, and will continue to investigate and hold accountable those who pose a threat in cyberspace," an FBI spokesman said.
Government: Crap, we got hacked again. How are we supposed to protect our lists of security clearances and employee records? Its so confusing.
IT people of the wold collectively reply: ID10T Errors, you have to solve them first! Then you can protect your data.
HELP HELP WHO CAN I TRUST...
We're from the government and we're here to help you...
'The most terrifying words you can hear' Ronald Reagan
"...and will continue to investigate and hold accountable those who pose a threat in cyberspace,"
I am sure they will investigate. What I am not sure about is whether, "hold accountable those who pose a threat in cyberspace" means anything if history is to be believed.
I beg to be enlightened: What has my the [mighty] USA done in the past, that should make me think holding accountable in the case of China means anything really?
Now, remember we as a country, do the same stuff to other countries regularly.
So, I think that the word we need to get out to the uninformed public is that hackers do not have magic powers that are impossible to defend against. Governments and Corporations responsible for these breaches keep trying to portray the hackers as if they were mad-men flying planes into buildings. How can you stop a fully loaded 747 flying at 800mph right?!?!
But that's not the case. Every single one of these breaches has been the result of mistakes made my the organization that was attacked as trivial as leaving keys in the lock of your safe with a big sign that says "Money inside!" These agencies and companies could easily, and with little monetary investment, make breaches like this nearly impossible.
In most cases the mistakes aren't even technological, they're institutional. Usually those attacked had well qualified security folks on staff who were doing their best to prevent the attack. But when the "VP of operations" (or whatever) comes in and says "The project is late, everyone's telling me it's because you're department is insisting on two factor authentication. I'm going to sign off on that and we're going to move forward" there's not much they can do.
Look at the Sony attack. You had executives of the company sitting there with the entire companies financial records down to the penny sitting on their windows desktop... WHILE their security department was telling them the entire network had an active virus infection running rampant. Basically nothing happened to any of the people responsible.
Trying to think, what the guys like Benjamin Franklin or Thomas Jefferson would've said, had anybody told them, that mere 200 years later the Republic they founded will have millions of Federal-government employees and that the collective spending of governments will dance around 50% of the nation's GDP...
Oh, some of those aren't employees, but are contractors. Sure, that changes everything...
In Soviet Washington the swamp drains you.
Should we be so concerned with what they took?
How about we be a little more concerned with what they inserted?
I wonder how many Ministry of State Security agents are now vetted for U.S. high security clearances?