SoylentNews is people
SoylentNews
from the if-you-are-allowed-in,-then-you-are-allowed-in dept.
Sean Gallagher reports at Ars Technica that Dr. Andy Ozment, Assistant Secretary for Cybersecurity in the Department of Homeland Security, told members of the House Oversight and Government Reform Committee that in the case of the recent discovery of an intrusion that gave attackers access to sensitive data on millions of government employees and government contractors, encryption would "not have helped" because the attackers had gained valid user credentials to the systems that they attacked—likely through social engineering.
Ozment added that because of the lack of multifactor authentication on these systems, the attackers would have been able to use those credentials at will to access systems from within and potentially even from outside the network. "If the adversary has the credentials of a user on the network, they can access data even if it's encrypted just as the users on the network have to access data," said Ozment. "That did occur in this case. Encryption in this instance would not have protected this data."
The fact that Social Security numbers of millions of current and former federal employees were not encrypted was one of few new details emerged about the data breach and House Oversight member Stephen Lynch (D-Mass.) was the one who pulled the SSN encryption answer from the teeth of the panel where others failed. "This is one of those hearings where I think that I will know less coming out of the hearing than I did when I walked in because of the obfuscation and the dancing around we are all doing here. As a matter of fact, I wish that you were as strenuous and hardworking at keeping information out of the hands of hackers as you are in keeping information out of the hands of Congress and federal employees. It's ironic. You are doing a great job stonewalling us, but hackers, not so much."
See our earlier stories: U.S. Government Employees Hit By Massive Data Breach and Hacking of Federal Security Forms Much Worse than Originally Thought
Original Submission
(Score: 2, Insightful) by darthservo on Thursday June 18 2015, @04:34PM
It needs to be baked in from the beginning, not tacked on after the fact.
That's one of the major underlying problems in this case. Unfortunately it's not unique - a system that was designed decades ago and built from the ground up in an era and especially in a culture where much or proper consideration to security wasn't addressed until after it was in production. So these kinds of things do need to be tacked on later.
The result is that the process of getting more secure is slowed down significantly by compatibility/usability issues and also, as you addressed, lack of adequate experience. Because (and this is another underlying problem) what looks better from the perspective of unfortunately many higher ups: 'Our systems are running and the agency can function efficiently'; or 'We [ran|are going to run] into major problems while upgrading which [caused|will cause] significant downtime' ? As is common in many other industries, the favor is quite typically given to short-term focus.
A comment from Ars [arstechnica.com] also appropriately addressed the problem:
Congress: "it's all your fault for not replacing those archaic and insecure computer systems with the funding we refuse to give you!"
"Good judgment seeks balance and progress. Lack of it eventually finds imbalance and frustration." - Dwight D Eisenhower
(Score: 1) by unzombied on Thursday June 18 2015, @08:53PM
Certainly, considering the overwhelming dollars given to DHS for secret and non-secret activities, a shortage of funds is not the problem. Rather, the billions spent on US "National Security" are not going to the nation's security.