[BreachExchange] Thwarting the threat actors: What government can do

[Audrey McNeil]

https://gcn.com/articles/2016/03/08/thwarting-threat-actors.aspx?admgarea=TC_SecCybersSec

Few things have become as stealthy, pervasive and damaging in our society
as cyberattacks. The effects can be devastating as criminals go undetected
for months or years while they pilfer an organization’s data.

We may look back on 2015 as the year of government attacks. An intrusion on
the IRS, exposed the tax returns of more than 300,000 people; hackers
nabbed thousands of federal employees’ personal data from the U.S. Census
Bureau -- and then made the information freely available on the web. Most
damaging of all, 22.5 million government employees and their families had
information stolen from the Office of Personnel Management and the
Department of Defense.

The Government Accountability Office reported that federal agencies
experienced 67,168 cybersecurity attacks involving personally identifiable
information in fiscal year 2014, an increase of 1,121 percent since 2006.
Add to this the fact that every state government experienced attempted or
successful cyber invasions last year, and it’s clear that hackers have
government agencies in their sights. It’s no wonder National Intelligence
Director James Clapper said cyberattacks are the greatest threat to
government.

Who’s behind the ambushes on government?

Attacks on government come in a variety of forms, including spamming
emails, viruses, external probes to a network and distributed
denial-of-service attacks designed to take the targeted website offline.
They originate from a variety of threat actors, the people or organizations
responsible for launching cyberattacks. The three most common threat actors
are:

Commodity, or sport, threat actors, who typically operate alone, launching
broad-based attacks in an attempt to hit as many targets as possible. They
may initiate attacks to check their personal hacking skills, sometimes as a
way to impress other hackers or prepare for a more complex onslaught
against a designated target. While commodity threat actors should be taken
seriously, the more sophisticated attacks on government tend to be carried
out by the next two categories of threat actors.

Hacktivists, who use attacks to advance political or social agendas or to
express displeasure with government policies. One of the better-known
hacktivist groups, Anonymous, has launched repeated assaults on federal and
state government agencies over the years. For example, Anonymous claimed
responsibility for the Census Bureau breach mentioned above and said it
struck because of its opposition to the Transatlantic Trade and Investment
Partnership and Trans-Pacific Partnership trade negotiations. Many other
hacktivist collectives, while not as well known as Anonymous, also
regularly focus their efforts on government agencies.

Nation-state threat actors, who are typically sponsored by hostile foreign
governments and unleash highly targeted attacks as a means of espionage to
steal intellectual property, military intelligence or gain tactical
advantage. For example, last year’s enormous Office of Public Management
breach is widely thought to have been perpetrated by the Chinese
government. Late last year, Richard Ledgett, deputy director of the
National Security Agency, warned that the danger of nation-state attacks is
growing and that the attacks are becoming increasingly destructive.

How should government respond to increasing threats?

It is almost impossible to quantify the risk of a breach to government
agencies. Besides the threat of losing data and public trust and exposing
private citizen information or intelligence secrets, costs can mount
quickly if an agency is forced to redirect IT staff from other projects to
deal with a breach, hire a third-party forensic company to investigate how
a breach occurred and pay to have the mess cleaned up.

While there are no steps that can be taken to guarantee data will be 100
percent secure, agencies can take steps to make it as difficult as possible
for hackers to gain access to services and systems. No single security
technology or set of policies will protect against every threat, but the
five strategies below will help strengthen a government agency’s
cybersecurity posture.

1. Store data in multiple data centers to limit the information a threat
actor would be able to access in any single successful attack.

2. Maintain always-on system monitoring to increase the chance of quickly
detecting an attempted attack.

3. Protect the “gold mine.” Ultimately, hackers are after data, which
should be stored in an encrypted format so attackers can’t use the data
even if they get it.

4. Have both internal and externals team at the ready. Third-party
providers -- perhaps the same ones already charged with monitoring the
network -- can work with an agency’s IT staff to respond immediately to a
cyber invasion.

5. Learn from an attack. After an incursion is contained and mitigated,
investigate where the agency’s weaknesses were and implement technologies
and processes that will prevent those vulnerabilities from being exploited
in the future.

The number of attempted and successful cyber strikes on government agencies
has risen every year, and the trend will continue in 2016. While it is
virtually impossible to know when cybercriminals will attack, taking
certain preventative actions before an attack can certainly reduce the risk
of damage.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20160308/0bfd3365/attachment.html>