SoylentNews is people
SoylentNews
from the if-you-are-allowed-in,-then-you-are-allowed-in dept.
Sean Gallagher reports at Ars Technica that Dr. Andy Ozment, Assistant Secretary for Cybersecurity in the Department of Homeland Security, told members of the House Oversight and Government Reform Committee that in the case of the recent discovery of an intrusion that gave attackers access to sensitive data on millions of government employees and government contractors, encryption would "not have helped" because the attackers had gained valid user credentials to the systems that they attacked—likely through social engineering.
Ozment added that because of the lack of multifactor authentication on these systems, the attackers would have been able to use those credentials at will to access systems from within and potentially even from outside the network. "If the adversary has the credentials of a user on the network, they can access data even if it's encrypted just as the users on the network have to access data," said Ozment. "That did occur in this case. Encryption in this instance would not have protected this data."
The fact that Social Security numbers of millions of current and former federal employees were not encrypted was one of few new details emerged about the data breach and House Oversight member Stephen Lynch (D-Mass.) was the one who pulled the SSN encryption answer from the teeth of the panel where others failed. "This is one of those hearings where I think that I will know less coming out of the hearing than I did when I walked in because of the obfuscation and the dancing around we are all doing here. As a matter of fact, I wish that you were as strenuous and hardworking at keeping information out of the hands of hackers as you are in keeping information out of the hands of Congress and federal employees. It's ironic. You are doing a great job stonewalling us, but hackers, not so much."
See our earlier stories: U.S. Government Employees Hit By Massive Data Breach and Hacking of Federal Security Forms Much Worse than Originally Thought
Original Submission
(Score: 3, Interesting) by iamjacksusername on Thursday June 18 2015, @03:55PM
You are right - security is hard. I think the problem is that we are getting the article filtered through the PR department. Unless we are looking at the audit report, it is impossible to say one way or the other. It could mean anything- maybe they compromised the admin's personal equipment so they could have retrieved the key anytime. Maybe they compromised the transit route before the data would have been encrypted. Who knows? We sure don't because we will never get to see the un-redacted report.
On a totally unrelated yet related note, I get a kick out of the fact that everybody is catching up to security practices that were baked into Novell Bindery Services by the late 80s. Seriously, the idea of audit accounts who can only monitor admin, admins who are super users but cannot monitor audit accounts, granular role controls. I remember taking my Netware 3.x classes and part of the story was that the audit role in the Bindery tree was added because of a CIA requirement that admins be monitored without being able to see what was being monitored or what accounts were monitoring them. I blame the move to AD for the complete breakdown in traditional security roles - AD had only a very limited understanding of inheritance and good luck trying to do anything with granular controls when MS was marketing it as manageable by any 2-bit reboot jockey.
Sigh. Someone is on my lawn and they should definitely get off of it.
(Score: 2) by c0lo on Thursday June 18 2015, @07:27PM
Sorry, can't do: those who are on your lawn have audit roles
https://www.youtube.com/watch?v=aoFiw2jMy-0