Posted on Jun 25, 2015
U.S. data hack may be 4 times larger than the government originally said
3.9K
17
12
5
5
0
Stand by to stand by. The OPM data hack may be much larger than originally thought. I'm personally still waiting to hear if my information got compromised (I do have an active TS/SCI security clearance) and this may be why.
Washington (CNN)The personal data of an estimated 18 million current, former and prospective federal employees were affected by a cyber breach at the Office of Personnel Management - more than four times the 4.2 million the agency has publicly acknowledged. The number is expected to grow, according to U.S. officials briefed on the investigation.
FBI Director James Comey gave the 18 million estimate in a closed-door briefing to Senators in recent weeks, using the OPM's own internal data, according to U.S. officials briefed on the matter. Those affected could include people who applied for government jobs, but never actually ended up working for the government.
Can Washington keep your data secure?
The same hackers who accessed OPM's data are believed to have last year breached an OPM contractor, KeyPoint Government Solutions, U.S. officials said. When the OPM breach was discovered in April, investigators found that KeyPoint security credentials were used to breach the OPM system.
Some investigators believe that after that intrusion last year, OPM officials should have blocked all access from KeyPoint, and that doing so could have prevented more serious damage. But a person briefed on the investigation says OPM officials don't believe such a move would have made a difference. That's because the OPM breach is believed to have pre-dated the KeyPoint breach. Hackers are also believed to have built their own backdoor access to the OPM system, armed with high-level system administrator access to the system. One official called it the "keys to the kingdom." KeyPoint did not respond to CNN's request for comment.
U.S. investigators believe the Chinese government is behind the cyber intrusion, which are considered the worst ever against the U.S. government.
Why would China hack the U.S. government?
OPM has so far stuck by the 4.2 million estimate, which is the number of people so far notified that their information was compromised. An agency spokesman said the investigation is ongoing and that it hasn't verified the larger number.
The actual number of people affected is expected to grow, in part because hackers accessed a database storing government forms used for security clearances, known as SF86 questionnaires, which contain the private information of multiple family members and associates for each government official affected, these officials said.
OPM officials are facing multiple congressional hearings this week on the hack and their response to it. There's growing frustration among lawmakers and government employees that the Obama administration's response has minimized the severity of breach.
OPM's internal auditors told a House Oversight and Government Affairs Committee last week that key databases housing sensitive national security data, including applications for background checks, had not met federal security standards.
"Not only was a large volume (11 out of 47 systems) of OPM's IT systems operating without a valid Authorization, but several of these systems are among the most critical and sensitive applications owned by the agency," Michael Esser, OPM's assistant inspector general for audits, wrote in testimony prepared for committee.
Katherine Archuleta, who leads OPM, is beginning to face heat for her agency's failure to protect key national security data -- highly prized by foreign intelligence agencies -- as well as for how slowly the agency has provided information.
Rep. Stephen Lynch, D-Mass., at a hearing last week told Archuleta: "I wish that you were as strenuous and hardworking at keeping information out of the hands of hacker as are at keeping information out of the hands of Congress."
http://www.cnn.com/2015/06/22/politics/opm-hack-18-milliion/index.html
Washington (CNN)The personal data of an estimated 18 million current, former and prospective federal employees were affected by a cyber breach at the Office of Personnel Management - more than four times the 4.2 million the agency has publicly acknowledged. The number is expected to grow, according to U.S. officials briefed on the investigation.
FBI Director James Comey gave the 18 million estimate in a closed-door briefing to Senators in recent weeks, using the OPM's own internal data, according to U.S. officials briefed on the matter. Those affected could include people who applied for government jobs, but never actually ended up working for the government.
Can Washington keep your data secure?
The same hackers who accessed OPM's data are believed to have last year breached an OPM contractor, KeyPoint Government Solutions, U.S. officials said. When the OPM breach was discovered in April, investigators found that KeyPoint security credentials were used to breach the OPM system.
Some investigators believe that after that intrusion last year, OPM officials should have blocked all access from KeyPoint, and that doing so could have prevented more serious damage. But a person briefed on the investigation says OPM officials don't believe such a move would have made a difference. That's because the OPM breach is believed to have pre-dated the KeyPoint breach. Hackers are also believed to have built their own backdoor access to the OPM system, armed with high-level system administrator access to the system. One official called it the "keys to the kingdom." KeyPoint did not respond to CNN's request for comment.
U.S. investigators believe the Chinese government is behind the cyber intrusion, which are considered the worst ever against the U.S. government.
Why would China hack the U.S. government?
OPM has so far stuck by the 4.2 million estimate, which is the number of people so far notified that their information was compromised. An agency spokesman said the investigation is ongoing and that it hasn't verified the larger number.
The actual number of people affected is expected to grow, in part because hackers accessed a database storing government forms used for security clearances, known as SF86 questionnaires, which contain the private information of multiple family members and associates for each government official affected, these officials said.
OPM officials are facing multiple congressional hearings this week on the hack and their response to it. There's growing frustration among lawmakers and government employees that the Obama administration's response has minimized the severity of breach.
OPM's internal auditors told a House Oversight and Government Affairs Committee last week that key databases housing sensitive national security data, including applications for background checks, had not met federal security standards.
"Not only was a large volume (11 out of 47 systems) of OPM's IT systems operating without a valid Authorization, but several of these systems are among the most critical and sensitive applications owned by the agency," Michael Esser, OPM's assistant inspector general for audits, wrote in testimony prepared for committee.
Katherine Archuleta, who leads OPM, is beginning to face heat for her agency's failure to protect key national security data -- highly prized by foreign intelligence agencies -- as well as for how slowly the agency has provided information.
Rep. Stephen Lynch, D-Mass., at a hearing last week told Archuleta: "I wish that you were as strenuous and hardworking at keeping information out of the hands of hacker as are at keeping information out of the hands of Congress."
http://www.cnn.com/2015/06/22/politics/opm-hack-18-milliion/index.html
Hacking
Security Clearance
DoD
Posted >1 y ago
Responses: 5
1
1
0
I did the OPM identity theft thing that they will pay for 18 months. It should be paid for much longer. I haven't seen discussions of severing internet access to countries that sponsor hacking and spying. I guess that would mean killing it most everywhere including here. Implementation of CACs with random PIN number chips for all sensitive systems in all Agencies is long overdue. We'll have some spillage still, but not the wholesale open door policy we have now.
(1)
(0)
1
1
0
Disorganized feds struggle with database security:
The government's failure to centralize database security was a key factor in the massive government hack now roiling the Obama administration.
Even after the damaging intrusion, believed to be from China and possibly affecting well over 18 million people, officials say the government is still struggling to fix the problem.
http://www.msn.com/en-us/news/politics/disorganized-feds-struggle-with-database-security/ar-AAcfjcn
The government's failure to centralize database security was a key factor in the massive government hack now roiling the Obama administration.
Even after the damaging intrusion, believed to be from China and possibly affecting well over 18 million people, officials say the government is still struggling to fix the problem.
http://www.msn.com/en-us/news/politics/disorganized-feds-struggle-with-database-security/ar-AAcfjcn
Disorganized feds struggle with database security
The government's inability to centralize database security helped hackers get into the OPM network.
(1)
(0)
PO1 John Miller
It would be so much simpler/more secure if the federal government just put the military in charge of cyber security!
(0)
(0)
1
1
0
Government logins widely available online ... maybe this is part of the problem?
http://www.federaltimes.com/story/government/cybersecurity/2015/06/25/fed-logins-online/29267693/
http://www.federaltimes.com/story/government/cybersecurity/2015/06/25/fed-logins-online/29267693/
Government logins widely available online
Login information for 47 federal agencies can be found online with a simple search.
(1)
(0)
CW2 Ernest Krutzsch
It wasn't a hack, some Genius in OMB decided it was a good idea to outsource the database administration to a Chinese national and Venezuelan, it appears that OMB gave the info away!
(1)
(0)
PO1 John Miller
It would be so much simpler/more secure if the federal government just put the military in charge of cyber security!
(0)
(0)
1
1
0
As Capt Seid Waddell said this should have been caught sooner however, the issue is not where many people are trying to point. it has been my experience working in this field that the issue with security is often from decisions at the top level.
let's start with training, few people are aware enough of how do to proper risk assessments on the systems and data they have. You have to be aware of who targets your systems and what they may want.
This feeds into the budget, a risk assessment places a value (not always money) on the data and systems (CIA). This is how you know what to protect, the protect everything equally model is not practical, do you protect everything at your house equally? my guess is no, you have some things in your front yard out in the open, some items protected by a fence in your back yard while others are in the home, in a safe, or locked in a safety deposit box.
After everything is assessed management can separate IT and IT Security budgets allowing the better decisions on securing and manning security teams for the digital information systems.
Activity duty is leading the way on this while the rest of the federal government is dead last! I am currently in an Army Cyber Defense course and have discussed this at length with my classmates. there are several great ideas floating around about how to utilize the military cyber teams to defend the rest of the government however, we are not structured to do so currently nor do we have legal authority.
In short, the skills are likely there to secure the systems, the system failed to allow it to be secured by not assessing the threat correctly therefore not staffing and funding the defense of the systems.
let's start with training, few people are aware enough of how do to proper risk assessments on the systems and data they have. You have to be aware of who targets your systems and what they may want.
This feeds into the budget, a risk assessment places a value (not always money) on the data and systems (CIA). This is how you know what to protect, the protect everything equally model is not practical, do you protect everything at your house equally? my guess is no, you have some things in your front yard out in the open, some items protected by a fence in your back yard while others are in the home, in a safe, or locked in a safety deposit box.
After everything is assessed management can separate IT and IT Security budgets allowing the better decisions on securing and manning security teams for the digital information systems.
Activity duty is leading the way on this while the rest of the federal government is dead last! I am currently in an Army Cyber Defense course and have discussed this at length with my classmates. there are several great ideas floating around about how to utilize the military cyber teams to defend the rest of the government however, we are not structured to do so currently nor do we have legal authority.
In short, the skills are likely there to secure the systems, the system failed to allow it to be secured by not assessing the threat correctly therefore not staffing and funding the defense of the systems.
(1)
(0)
Capt Seid Waddell
SSG Ed Mikus, I have been contacted by IT in companies where I worked asking me about the volume of requests for certain data, to ensure that the requests were legitimate. With the volume of personal data downloads the Chinese made one would think that this would have set off alarm bells somewhere.
(2)
(0)
SSG Ed Mikus
If that was even being monitored, I have seen logging systems turned off or down just because they did not want to justify not reviewing them. Too many people believe security is magic. I wish our government culture was such that people looked into or cared to monitor such in great numbers.
(2)
(0)
1
1
0
Surely this should have been caught sooner. A number of people had to have been asleep at the switch.
(1)
(0)
Read This Next
Continue with Facebook 
Continue with Google