Deathmage wrote: » what's the point of next-generation firewalls then....or where these records stolen from unsecured networks?
jvrlopez wrote: » At least I've never (to my knowledge) given any of my financial information to OPM...
tpatt100 wrote: » Just got done uploading all of my photos to Google last night, come get me!
kiki162 wrote: » Most people would be surprised at the lack of security and change control in place within gov't institutions outside of DoD.
beads wrote: » And the Russians appear to have broken into the German Government, shutting down many parts of that system. So? This is the espionage. You folks have to stop once in awhile and ask why are these institutions targets in the first place? What is the reward these people are seeking? Unless your working off some bizarre model unavailable to me you come to work, where ever that may be, for a reason - like money/salary. You don't show up because you have nothing better to do, right? So ask yourself what's in it for the hackers in this case? Is it money? Fraud? To embarrass the US Government? Or perhaps they were drag netting for personal information to possibly compromise US Government employees? Well, that last one is a pretty exhaustive list of potential candidates to mess with. Also happens to be very old school espionage at the beginning of a compromise of an individual. We need to start thinking a bit more as intelligence analysts at times and less about the individual data points. - b/eads
LeBroke wrote: » Next generation firewalls are especially amazing when you have barely-secured terminal servers, and a completely unsecured file share holding all kinds of documents only marginally less important than SIN numbers and credit card data. This is a multinational firm of 10,000 employees my friend recently started to work at. ...Any attempts to remediate it have been met with "but we have important data on there that we can't move," and "I don't have the time to set up NFS permissions, submit a change request to risk management, have them approve it, then create requests with Systems. Oh yeah, we will also need permission from any department such as Finance and Marketing, since they have data on there."
kiki162 wrote: » Most people would be surprised at the lack of security and change control in place within gov't institutions outside of DoD. Would love to see OPM in general change their hiring practices within the Federal Government so they can attract and retain some of the top IT Security Pros out there, and for gov't agencies to TRAIN their people properly, instead of slapping 8570 on them every 3 years. Send them to some of the SANS or other security conferences out there. Train these ppl like other countries are training theirs. How much you want a bet that there are a ton of federal employees working in infosec that would love to get their hands dirty. Yet the gov't only requires IAT II or III for most positions, and there are no funds to send them to training. Same thing with the contractors out there. I've talked to so many gov't employees over the years, and pretty much all of them have said there's no motivation unless the job requires it.
bermovick wrote: » This isn't just outside DoD. Our NIPR network here is woefully unsecure. Access ports that aren't shutdown or in a parking vlan, R/W snmpv2 communities, you name it.
renacido wrote: » Even better are the "we can't apply security controls to protect our biggest targets because they're too sensitive." - "We're exempting our C-level executives because they don't want to be hassled by security." Right, they're only the biggest targets for phishing or data theft. - "We're not obligated by our regulators to do that." Right, because as long as you're compliant with the law, hackers can't attack you. - "We CAN'T run those scans on our database servers, that's where we keep our crown jewels and the execs don't want to risk a service interruption from a scan in progress." Yeah, because the miniscule risk of a minor degredation of performance caused by our carefully planned and tested scanning policy far outweighs the risk of the catastrophic, financially ruinous, headline-producing breach due to servers left unpatched and vulnerable to known exploits. Welcome to infosec.
LeBroke wrote: » Nah, once in a while you've got some good ones. I'm a Linux server admin, though I've done infosec on the side for a few years. IT manager: "Oh, you have a hacking background? Great, if you can break into our (old, shitty, hard to support) webapp that two customers insist on using, that'll finally give us a good reason to deprecate it." Meanwhile, senior admin: "yeah, I love security too. We really need to find holes in our systems so we can patch them out. Just don't run any scans on any production systems so performance doesn't suffer."
Cyberscum wrote: » ^^^^ I hear ya, but patching/firewalls/defense in depth etc... is not going to fix the problem. The problem is undereducated "cyber security" experts working for the gov that ONLY use software/hardware to defend their networks. Using a GUI to "eliminate" hackers like its a video game or something. Its too late in the game to train these employees to the amount of expertise needed to defend us. Were better off outsourcing security at this point
renacido wrote: » According to forensic reports and trend analysis from Mandiant (FireEye) and Verizon, the most common attack vector used in 2014 and so far in 2015 was spear phishing. Of all recipients of a phish, 23% opened the email and 11% opened an attached file. If you're not rocking a security awareness program for your users, your stats are probably even higher. For 99.9% of all exploited vulnerabilities, the associated CVE was published over a year prior and the patch to remediate the vulnerability was available for several months (71% had patches released >1 year prior to exploit). The most reliable indicator that a vulnerability would be successfully exploited in 2014 was that the CVE was added to Metasploit. So this shows that vulnerability scans and patching are still absolutely critical, and contrary to what some here believe, 99.9% of all exploits are not done by some genius in a loft somewhere in Russia finding deftly evading and exploiting zero-days with Python and Bash scripts he bangs out on the fly like some James Bond villian, to the contrary the exploit tool of choice among blackhats is the very same that they teach in that "out-dated" "script kiddie" C|EH curriculum. 2015 Data Breach Investigations Report (DBIR) | Verizon Enterprise Solutionshttps://www.mandiant.com/resources/mandiant-reports/
