Breach Of Homeland Security Background Checks Raises Red Flags; State-Sponsored Attack May Be Targeting Those Getting Security Clearances

August 26, 2014 · by Fortuna's Corner · in Asia/Pacific Pivot, China, CIA, Critical Infrastructure Protection, Cyber War, Cybersecurity, Defense Industrial Base, DIA, espionage, spying, Intelligence Community, Internet, national security, NSA, U.S. Cyber Command, US Military · 1 Comment
Breach Of Homeland Security Background Checks Raises Red Flags; State-Sponsored Attack May Be Targeting Those Getting Security Clearances
http://www.fortunascorner.wordpress.com
Sara Peters, writing on the August 25, 2014 website Dark Reading notes that “background check records of 25,000 undercover investigators and other Department Of Homeland Security (DHS) staff, were exposed in the breach at US Investigations Services (USIS) [earlier] this month,” unnamed officials told the Reuters News Service last Friday. USIS released a statement saying the incident “had all the markings of a state-sponsored attack.” Ms. Peters writes that “What agency officials have said about the incident — and, what they haven’t said about it — are raising questions about the breach’s ultimate impact; and, about inadequate measures for ensuring that third-party government contractors properly secure classified information.”
“If [leaking] credit-card data to [attackers] is like giving your kids a spoonful of sugar, compromising background checks is like handing them cocaine,” said Rich Dakin, CEO of Coalfire, the nation’s largest independent IT governance, risk, and compliance firm. “This is not lightweight data. These are very rich databases on how to compromise national security.”
Ms. Peters writes that “USIS is the third-party commercial firm that performs background checks for DHS, including the U.S. Immigration and Customs Enforcement, and U.S. Customs and Border Protection units. These background checks are not like the ones you request about your new babysitter. They cover criminal history, drug use, and other indiscretions going back many years.” As Dakin puts it, “they want to know when you stopped kicking dogs.” “The data also includes information about spouses, relatives, and friends — all things that could be used to threaten and pressure agents to identify those who are undercover.”
“We should be burning down the house over this breach,” Dakin said. “People’s lives are at risk.”
“Some things about this incident have the entire Coalfire teams Spidey-sense tingling. Having conducted hundreds of assessments and forensic investigations, they would expect officials to reveal certain kinds of information if they had it — upbeat things like the data was encrypted — and, this information has been conspicuously absent from officials’ statements. For example,’ Ms. Peters writes, “in a notification letter obtained by Reuters, USIS stated, “Records, including this data were exposed to unauthorized users during the cyber security intrusion. We do not know yet whether the data was actually taken.”
Mr. Dakin added that [USIS] “officials haven’t mentioned anything about network segmentation. Yet, he says that, even if USIS did segment its networks, there’s “not a chance in the world, no way they had only 25,000 [background checks] in one segment.” “So,” writes Ms. Peters, “Dakin suspects this number will go up. (He compares it to the 2005 Choicepoint breach. At first, Choicepoint revealed only the number of customer records it was required to report under state laws, subtracting records for customers who lived in states that did not have such laws).
“This “underreporting” raises a red flag in Dakin’s mind,” Ms. Peters writes. “USIS owes us a full disclosure,” Dakin said.
Mr. Dakin also said that “USIS did not undergo a rigorous process to assess its security posture; and, ensure that certain policies are upheld. He notes that USIS is not on the short list of providers that have been approved under FedRAMP, a government program that was created to help government agencies choose cloud service providers that upheld certain security standards.”
“USIS may not consider themselves a cloud service provider,” Dakin said, “but, they should be,” says Dakin. “If a service provider collects data online, processes data online, delivers data online, and delivers data to its clients online….it’s a cloud service provider. Intelligence agencies know this stuff is happening,” he says. ‘They could have warned USIS,” and organizations can help themselves — by helping their service providers.”
Ms. Peters ends by noting that “DHS has suspended business with USIS; it has not announced what service it will employ to perform background checks in USIS’s stead.”
It is well known that China, among others, have hacked into U.S. government IT systems in the hopes of collecting personal data on U.S. government employees who either already have a security clearance; or, are under consideration for one. V/R, RCP