Can feds give cybersecurity the attention it deserves?

Can feds give cybersecurity the attention it deserves?

The insider threat to agency data, whether from people actively trying to steal it or from those who witlessly allow others to access it, is hardly a new issue. But it seems to be one that still causes more headaches than perhaps it should.

A Symantec-sponsored report found that just under half of the federal IT managers surveyed said their agency had been the target of an insider incident over a 12-month period. One in three said they had lost data to such an incident.

Sound familiar? The potential damage caused by malicious threats from insiders was certainly noted after the Wikileaks incident and hammered home by the Snowden affair. More recent breaches at the Office of Personnel Management and at the Pentagon were blamed, at least in part, on “bad cyber hygiene” by agency insiders.

Yet the report found that most agencies still don’t employ basic security measures. Well under half of them offer annual in-person security training to their employees or  employ obvious technologies such as two-factor authentication or agencywide endpoint encryption. Plus, they can’t tell when documents have been shared or how.

According to Symantec Public Sector Unified Security Practice Manager Ken Durbin, that’s largely because of the many competing issues agency IT managers must juggle.

“They’re under a lot of pressure on a lot of different fronts and have a lot of mandates and guidance they have to balance,” he said. “It’s a constant struggle for them to figure out where to put their resources, and what [security] area they need to tackle first.”

The good news is that the survey found over 75 percent of agencies seem be more focused on the insider threat now than a year ago. Despite that, however, two-thirds also said it is common for employees and contractors to email documents to personal accounts, and over half said appropriate security protocols simply are not followed. Some 40 percent say unauthorized employees access government information they shouldn’t on at least a weekly basis.

It’s these kinds of behaviors that have caused agency executives increasingly violent conniptions, and some have started to threaten fairly draconian action if their workers don’t start getting their security act together. Defense Department CIO Terry Halvorsen, for example, has said he could throw people who don’t practice good cyber hygiene off DOD networks. More recently, the Department of Homeland Security’s chief information security officer has talked about revoking repeat offenders’ security clearances.

It’s not clear how far that approach would go with all agencies. Some would no doubt want to wield that kind of big stick, but others will prefer to dangle carrots in front of people. It’s unlikely there will be anything like consensus.

Meanwhile, agencies must do what they can. Down the road, effective help is heading their way in the form of the DHS Continuous Diagnostics and Mitigation program, which will seed all agencies with a capability to know in real time if there are any problems on their networks and what they can do about them. That has the added attraction of something that DHS will pay for but, as Durbin also pointed out, it’s being rolled out much more slowly than many would like.

So, what to do in the meantime?

“Access control makes a lot of sense, limiting the kind of access that could otherwise be taken advantage of,” Durbin said. “Two-factor authentication gives a higher confidence that someone is who they say they are, and limiting escalated privileges means that, if someone is comprised, attackers can’t get access to (vital) network privileges.”

Even with all of that, he admits, it’s still a porous border. A better balanced scenario would be for agencies to put at least some of this in place, but also focus on their most sensitive data and put the strongest protections around that.

However, that requires agencies in the first place knowing what data they have and where it is. Which is the subject for a whole other story.

Mission: Impossible, the DARPA way

The problem with putting data on a chip for security sensitive organizations like the DOD is that the data is persistent, and if equipment containing the chips is captured, so is the information they contain. So the Defense Advanced Research Projects Agency, perhaps having watched old TV shows or recent Tom Cruise movies, is trying the destructive approach.

Following a contract with IBM to create self-destructing chips that use strained glass substrates, it recently demoed a working version of such a chip. It uses a circuit that, when triggered, causes a resistor to heat the chip and shatter.

At least in battlefield situations, spinning disk drives will soon be a thing of the past, with more robust solid state drives — chip-based memory — taking their place. That’s their advantage, but also their problem, one the DARPA program aims to solve.

It may take a few seconds longer for these chips to self-destruct than the MI devices required, however. And DARPA’s not saying if said destruction will be accompanied by those cool clouds of smoke that Jim Phelps had to endure.

Posted by Brian Robinson on Sep 25, 2015 at 10:32 AM1 comments

spear phishing

Phish me once, shame on you. Phish me twice…

What should we make of the most recent announcements of government “awareness campaigns” about phishing? The National Counterintelligence and Security Center (NCSC) is the latest to say it will launch such a program, following damaging breaches this year the Office of Personnel Management and other agencies.

NCSC director Bill Evanina told the audience at a recent conference that the vast majority of significant breaches in both the public and private sector have started with spear phishing, where malware-laden emails are sent to specific people in organizations. Even keeping  just a few people from clicking the links in those emails, Evanina said, may prevent a massive breach in the future. The NCSC, he said, has begun a four-part campaign to make people more aware of cyber threats, including spear phishing.

Earlier this year, the Defense Department’s CIO Office said it was “drawing a line in the sand” about users with poor cyber hygiene, meaning those who didn’t follow basic security practices would be thrown off DOD networks. That follows a March memo from CIO Terry Halvorsen specifically warning DOD personnel and their families about phishing dangers.

However, it seems we’ve been here before. Phishing threats have been known for some time. The National Institute of Standards and Technology has published cybersecurity guidelines highlighting the dangers and, broadly, what agencies can do about them. Federal Information Security Management Act policies also mandate that agencies provide comprehensive awareness and training programs for their workers.

Getting from there to an actual increased defense against phishing is a another matter, however. Telecom provider Verizon, in its 2015 Data Breach Report, found overall that some 23 percent of recipients of phishing emails open them, and nearly half of those actually click on the attachments that contain the malware. A campaign of just 10 phishing emails has a greater than 90 percent chance that at least one user will become a victim.

And training may not be the answer. Security company KnowBe4 made its own study and found that educational and awareness campaigns deliver significantly less than they promise. Too many organizations “still rely on a once-a-year breakroom ‘death by PowerPoint’ training approach or just rely on their filters, do no training and see no change in behavior,” the firm said.

Anecdotal evidence from both current and recently retired government employees seems to confirm that. Agencies provide those training sessions, for sure, but there’s little or no follow-up in the time between them. In too many cases, awareness and educational training seems to be just one more box to tick on agencies’ compliance list.

It’s not that government employees willfully disregard the dangers, but when they have so much to do during the day just to get their jobs done, and when the awareness isn’t reinforced, those dangers tend to recede in the face of more immediate needs. Clicking on an email that has been artfully designed to look like it’s from an official source is then an easy mistake to make.

The proof of the NSCS’s campaign and Halvorsen’s tough talk will be in the eventual application of consequences. For example, despite the March CIO memo and later crack-down comments, the Pentagon found itself in July investigating an attack on its senior officers’ unclassified email network, prompting a temporary shutdown of the Joint Chiefs of Staff’s 4,200 email accounts.

The hack was believed to have come through a phishing attack. The usual suspects –in this case Russia – were thrown out as possible sources of the attack, but it was surely also a case of “bad cyber hygiene” on the part of the Pentagon brass. So, when can we expect the Joint Chiefs to be thrown off that particular part of the DOD network?

Posted by Brian Robinson on Sep 11, 2015 at 10:47 AM2 comments

Shadow BYOD

Dumb and dumber: Shadow BYOD in government agencies

A rising concern for government organizations is the so-called shadow IT ecosystem --the unauthorized applications that employees download and use at work without formal agency permission.

That poses serious security headaches for network administrators, who don’t know which applications are out there and who has them, and therefore find it impossible to write effective security policies. It's similarly difficult to optimize  network parameters when traffic is produced by unknown sources.

The bring-your-own-device movement has generated its own security headaches over the past few years, and agencies have struggled to come up with ways to let employees use their own mobile devices for government work. A few have done that, but most have simply barred employees from using their personal phones and tablets to handle government data.

Case closed? If only.

Were there really that many IT executives who thought that, simply by saying so, people used to peering at their screens every few minutes outside work would meekly give that up at the office and switch to agency-sanctioned devices? Hillary Clinton is not the only one who doesn’t want to swap phones to get emails or other communications.

Mobile security company Lookout wanted to see what the reality of this “shadow BYOD” is, and it’s not pretty. An analysis of records for Lookout-enabled devices found 14,622 associated with government networks. More than one in 10 of those devices registered a "serious mobile threat encounter" over the course of a year.

In a survey of over 1,000 government employees at 20 agencies in June, Lookout discovered that fully half of them have used their personal devices to get email, and nearly as many have used them to download work documents.

And the threat from mobile devices not only is real -- it seems to be higher than that found outside government. Some 18 percent of federal employees claim to have encountered malware on their mobile devices, the Lookout survey found, including both their personal and government-issued devices. That’s more than double the average percentage reported overall for iPhone and Android devices.

This all comes on the heels of a number of recent announcements of dangerous bugs found in the Android operating system. One was the so-called Stagefright vulnerability, which could affect up to 95 percent of all Android devices and has been likened by some to the OpenSSL Heartbleed bug of 2014.

Now another bug has been found in an Android system-level app. Called Google Admin, it allows Android to accept URLs from other apps, which could be manipulated to give malware access to private data on the device.

This bad news for Android continues to pile on, with vulnerabilities also found in various browsers used with Android. But don’t make the mistake in thinking Apple’s iOS is immune to cyber threats.

The trick, of course, is in making sure users install all the patches that come out for Android and iOS to fix these vulnerabilities, and do so in a timely manner. Perfect patching doesn’t happen, so at any one time there will be vulnerable devices accessing government systems and data.

Then there’s just the dumb stuff that no one can govern. The Lookout survey found that some 58 percent of respondents were aware of the potential consequences of using their personal devices at work, but 85 percent admitted to using them for risky activities anyway.

It’s back to school time for most of America. Maybe it’s also time for the federal government to get back to basics with cybersecurity and put together formal policies to handle BYOD. The practice is only going to get more prevalent over time – and so will the potential risks.

Posted by Brian Robinson on Aug 28, 2015 at 10:04 AM0 comments

Windows 10 touts enterprise- and mobile-friendly security

Windows 10 touts enterprise- and mobile-friendly security

Microsoft has provided its latest Windows 10 operating system as a free upgrade for current Windows users, and as with most new offerings it comes standard with several security features, including ones that are aimed specifically at government and enterprise customers.

It’s not likely to mean much to agencies immediately, however, as most seem unlikely to upgrade anytime soon.  If history is any guide, given the headaches past updates have posed (think Vista, Microsoft 7 and – gasp! – Windows 8), it could be much longer than the 12 months or more that some surveys have suggested.

Also bear in mind that government agencies are notoriously slow in moving to new systems, given money and mission concerns. The fact that there’s still a large number of users on the now-officially defunct Microsoft XP is testimony to that.

Microsoft itself is touting Windows 10’s “encryption containers” and two-factor authentication (using fingerprint and facial recognition biometrics) as ways to toughen access requirements and help prevent data loss even when systems are breached.

These and other security features are becoming common in new operating systems –-  and are even seen as competitive necessities. For Microsoft, they should help the venerable desktop OS stay relevant. More important, given the company’s belated recognition of the mobile universe, it could buttress Microsoft’s attempt to make Windows 10 a viable, if minor, competitor to Apple’s iOS and the multiple varieties of Android.

In fact, some observers think Microsoft is deliberately trying to make Windows 10 much more like a smartphone environment from the get-go, combining the various security features with a new Windows Store for authorized and vetted applications, a la the Apple Store and Android app markets.

Microsoft’s Device Guard, for example, requires a three-way sign-off by app vendors, the Windows Store and the enterprise for any application to work -- an attempt to block zero-day attacks. And Windows Hello (how do they come up with these names?) is the biometric security feature that works with Windows 10’s new Passport to verify you actually have the device on which you are trying to access services within your possession.

Not everything appears hunky dory with Windows 10 security, however. The “next generation” OS apparently requires an opt-out statement by a user to decline a default feature that allows Windows 10 to share access to any network the user logs onto with contacts listed in both Outlook and Skype, the VoIP provider Microsoft bought several years ago.

Some people are poo-pooing the concern over this feature, saying users still must affirmatively allow this sharing. All well and good, but how many users will take the steps to actively opt out, safeguarding themselves from possibly leaking access credentials or unintentionally giving someone access to a network?

To be continued, no doubt.

Stage fright: Android’s Heartbleed moment?

On the Android front, there is apparently a bundle of vulnerabilities that some experts are saying could leave most Android phones open to attack with just a single multimedia text. It could, they warn, turn out to be the worst Android flaw ever, along the lines of the OpenSSL Heartbleed bug that caused such panic last year.

Apparently, the fault lies with remote execution bugs in Android's Stagefright media playback tool. Joshua Drake, a researcher at Zimperium zLabs who first reported the bugs in April, said the vulnerability could affect 95 percent of all Android devices -- and the exploits don’t even require the user to interact with the text.

The U.S. Computer Emergency Response Team has published a formal alert on Stagefright, with pointers to various patches and other ways to guard against possible exploits.

Posted by Brian Robinson on Jul 31, 2015 at 9:01 AM0 comments