US Lawmakers Demand Federal Encryption Requirements After OPM Hack

Patrick O'Neill writes: After suffering one of the biggest hacks in federal history at the Office of Personnel Management, the U.S. government is sprinting to require a wide range of cybersecurity improvements across agencies in order to better secure troves of sensitive government data against constant cyberattacks. The top priorities are basic but key: Encryption of sensitive data and two-factor authentication required for privileged users. Despite eight years of internal warnings, these measures were not implemented at OPM when hackers breached their systems beginning last year.

The calls for added security measures comes as high-level government officials, particularly FBI director James Comey and NSA director Adm. Mike Rogers, are pushing to require backdoors on encryption software that many experts, like UPenn professor Matt Blaze, say would fundamentally "weaken our infrastructure" because the backdoors would be open to hackers as well.

Comments

Re:Oh please, not another law for them to ignore

[Anonymous Coward]

The problem with security is that under normal circumstances it delivers zero value to an organization and basically just shores up against bad publicity. The best security in the world isn't enough and you can spend $ridiculous on it and still only be 99% secure. You're basically trying to outspend your competition in the hopes that they won't hire the guy that knows where the bad sprintf() is.

To any corporation, or any department, this is just a pure money-sink with no returns on investment. It's cheaper to cover up the breaches.

Re:Back Doors Are Like Anal Sex

[Kozar_The_Malignant]

I'm not really clear on how you ban encryption. Do you lock up all the mathematicians?

Ask Phil Zimmerman about that. The US didn't lock him up, but it wasn't for lack of trying.