After the OPM breach: ripple effects and lingering questions
Connecting state and local government leaders
A panel of cybersecurity experts explore the lessons learned from the breach and how Defense agencies can best defend their networks.
This security breach of Office of Personnel Management systems that compromised the personal information of more than 22 million people continues reverberate throughout government. Yet while a cyber sprint has been run and some details of the attack revealed, the incident has prompted far more questions than answers -- not just at OPM, but across other agencies and military branches.
On Sept. 16, the American Security Project held a panel in Washington, D.C., on what lessons the government -- and the military in particular -- have taken from the OPM breach.
Aamir Lakhani, who works for the private cybersecurity company Fortinet, commented on one of the few details about the breach that has been made public -- that the source of the breach was the stolen credentials of a vendor. Lakhani believes that even today, companies are not adequately securing their networks.
“One of the things that we’ve seen is that once you have credentials to one system, it's really easy to get credentials to other systems and just move laterally,” Lakhani said. “People are just not taking internal security seriously because it’s a very difficult task to handle these days.”
Logan Brown, the president of Exodus Intelligence, agreed, although he held out hope that gaining access wasn't quite that easy.
“I would really hope in this situation -- and we don’t know the details of how it happened -- but I really hope it wasn’t just, 'OK, we have the password, now we have access to all the databases we want,'” Brown said. “Hopefully there was segmentation and they compartmentalize the actual critical data. And if they did do that at OPM, hopefully the hacker that had the credentials [had to survey the] network landscape to determine what software is on the network, and had access to zero-day to move into those databases.”
Lt. Col. Scott Applegate, chief of defensive cyberspace operations at Army Cyber Command, said he doubted it was a zero-day hack that affected OPM, but that the hackers more likely used OPM’s network to their advantage.
“It’s important to point out that in terms of how the adversary moves through our network, it’s generally not zero-day,” Applegate said. “The stealthiest way to move through a network is to use the tools that are already there, because for the most part your network sensors and security systems aren’t looking for legitimate tools -- they’re looking for malware and things like that.”
“Basic network hygiene can prevent a lot of these breaches that we’re seeing,” Applegate added. "Standard patching, and not allowing system to system communication, things like that."
Applegate also stressed the need for security inside a network as well as outside, in order to minimize threats. "Perimeter security is a good thing, but it's only the first line of defense," he said. "You’ve got to have internal security mechanisms as well. ... If you don't have sensors inside telling you that at 3 a.m. someone is uploading or downloading gigabytes of data, you probably missed the boat."
Later, Applegate spoke briefly about the Defense Department’s Joint Information Environment, the secure and interoperable cloud computing environment that is being developed to accommodate all military services and DOD components as well as allied forces.
"With some of the oncoming technologies we're trying to implement like the JIE, it will allow us to have a better overall network" and improve DOD's ability to do that sort of internal and external monitoring, he said. "And that's going to help a great deal."
Brown, however, voiced his concerns that the JIE is the equivalent of storing all the money in one centralized bank.
“It does scare me that the government is making one large network," he said. "That to me is putting all the money in the U.S. in one building. And we’ve learned from a government standpoint many times over, don’t challenge the attacker because the attacker is more agile -- moving everything into a flat network is easier to monitor, but it’s also easier to attack.”
Applegate responded that the network will have increased security measures to address that risk. “In this case the benefits outweigh the drawbacks,” he said. “Even though we’re flattening the network... it doesn’t mean it won’t have increased security.”