Application Security // Database Security
8/25/2014
05:48 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Breach of Homeland Security Background Checks Raises Red Flags

"We should be burning down the house over this," says a GRC expert.

Background check records of 25,000 undercover investigators and other homeland security staff were exposed in the breach at US Investigations Services (USIS) this month, unnamed officials told Reuters Friday. USIS has said the incident had "all the markings of a state-sponsored attack." What agency officials have said about the incident--and what they haven't said about it--are raising questions about the breach's ultimate impact and about inadequate measures for ensuring that third-party government contractors properly secure classified data.

"If [leaking] credit card data [to attackers] is like giving your kids a spoonful of sugar, compromising background checks is like handing them cocaine," says Rick Dakin, CEO of Coalfire, the nation's largest independent IT governance, risk, and compliance firm. "This is not lightweight data. These are very rich databases on how to compromise national security."

USIS is the third-party commercial firm that performs employee background checks for the Department of Homeland Security, including the US Immigration and Customs Enforcement and US Customs and Border Protection units.

These background checks are not like the ones you request about your new babysitter. They cover criminal history, drug use, and other indiscretions going back many years. As Dakin puts it, "they want to know when you stopped kicking dogs." The data also includes information about spouses, relatives, and friends -- all things that could be used to threaten and pressure agents and identify those who are undercover.

"We should be burning down the house over this" breach, says Dakin. "People's lives are at risk."

Some things about this incident have the entire Coalfire team's Spidey-sense tingling. Having conducted hundreds of assessments and forensic investigations, they would expect officials to reveal certain kinds of information if they had it -- upbeat things like that the data was encrypted -- and this information has been conspicuously absent from officials' statements. For example, in a notification letter obtained by Reuters, USIS stated, "Records including this data were exposed to unauthorized users during the cybersecurity intrusion. We do not yet know whether the data was actually taken."

As Dakin sees it, the fact that the agency doesn't know that could be an indication that its networking monitoring -- especially as it relates to data exfiltration -- is lacking.

Officials also have not mentioned anything about network segmentation. Yet he says that, even if USIS did segment its networks, there's "not a chance in the world, no way they had only 25,000 [background checks] in one segment." So he suspects that this number will go up. (He compares it to the 2005 Choicepoint breach. At first, Choicepoint revealed only the number of customer records it was required to report under state laws, subtracting records for customers who lived in states that did not have such laws.)

This "underreporting" raises a red flag in Dakin's mind. "USIS owes us a full disclosure."

He also says that USIS did not undergo any rigorous process to assess its security posture and ensure that certain security policies are upheld. He notes that USIS is not on the short list of service providers that have been approved under FedRAMP, a government program that was created to help government agencies choose cloud service providers that upheld certain security standards.

"USIS may not consider themselves a cloud service provider, but they should be," says Dakin. "If a service provider collects data online, processes data online, and delivers reports to clients online… it is a cloud service provider."

Though many in both the government and the security industry have been banging the information-sharing drum a lot over the past few years, Dakin says the Department of Homeland Security was likely not sharing adequate threat data with USIS.

"Intelligence agencies know this stuff is happening," he says. "They could have warned USIS," and organizations can help themselves by helping their service providers.

DHS has suspended business with USIS; it has not announced what service it will employ to perform background checks in USIS's stead.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
8/29/2014 | 9:36:37 AM
Re: Unacceptable
I'm a little unclear as to how a GRC program might have prevented this. I wonder if the folks who commented on this in the article could provide a bit more detail.
aws0513
50%
50%
aws0513,
User Rank: Ninja
8/27/2014 | 3:16:55 PM
Re: this is going to sound silly
Data retention is a touchy subject more and more.

In some countries, the "right to be forgotten" is becoming law.

The regulatory requirements for records retention are now bumping into risk management frameworks.

The rules for management of HR relevant records, including background checks, are quite clear on how long such records are to be maintained.  The risk begins to show when the data that is in storage is not properly protected.

What is really frustrating me is that with each breach I see in the news releases, the explicit details on how the breach occured are not being fully disclosed NOR are they releasing details on how the breach was discovered.
I understand that investigations take time, but even an early "this is what we know" report regarding the vector and the discovery details can be very helpful to those in the same trenches.  This information is crucial to all of us out here who are trying to improve our security practices.  Yet all we see is the headlines of the damage.  I appreciate the damage information gives weight to the issue, but the truly valuable information is what can be learned from the event.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
8/26/2014 | 4:04:17 PM
this is going to sound silly
Okay, this is going to sound silly, but I'm serious. Remember all those spy movies when the phrase "This message will self-destruct in X seconds"? Do we need better ways to more quickly destroy data? I see how it could work with data in transit -- or rather, data soon after it's reached its receiver. I'm not quite sure how this could work on data in storage, though...

Well, for starters, I suppose that you could use something like that to prevent data sprawl. Like, if data would be automatically deleted moments after it was stored on an unauthorized storage device/instance? Am I just blue-skying? Or does something like this exist and I just forgot?
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
8/26/2014 | 3:59:18 PM
Re: Unacceptable
@SomeGuy  Agreed. Deal with the problem now. Assess blame later. The fact is, EVERYONE needs to think about security, and need to share the job with their contractors, service providers, and even their customers.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
8/26/2014 | 3:55:57 PM
Re: Unacceptable
@AlisonDiana  I com pletely agree Alison. These days there are SO MANY breaches, and people are getting desensitized. When your hospitals, your food stores, your clothing stores, your DMV, and your local florist are all getting breached, what can you really do? You only have so many options... if you try to avoid every one that has a breach, eventually you'll run out of options.

And that's just one reason why market pressures will never really result in good security.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/26/2014 | 12:10:36 PM
Re: Unacceptable
The is probably one of most worrying data breaches due to the nature of information compromised... every Government Database is a potential target, its accesses from third parties must be carefully regulated.

I'm very worried by this last attack

 
Some Guy
50%
50%
Some Guy,
User Rank: Strategist
8/26/2014 | 11:10:13 AM
Re: Unacceptable
I'd say that no longer doing business with USIS is the corporate death sentence. Anyone feel better now? Didn't think so. We need to quit the witch-hunt, and apply lessons learned from this across the board.

Don't fix the blame, fix the problem.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/26/2014 | 9:20:38 AM
Re: Unacceptable
In my opinion, this should lead to criminal charges.  As a result of this negligence the families and friends of undercover operatives are at risk.  This is utterly unforgivable.
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
8/26/2014 | 9:19:25 AM
Re: Unacceptable
There is almost a blase attitude to breaches these days. It's absolutely infuriating to continually hear that breach after breach includes lack of encryption, lack of patches, or other basic security steps that go ignored. Someone -- government, consumers, or a combination of both -- has to begin holding organizations' feet to the fire. We saw it somewhat with Target; people left the store and shopped elsewhere. But in CHS' case, the stock rose! The government MUST act strongly in this instance to send a strong, strong message that this lack of adequate security measures won't be tolerated.
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
8/26/2014 | 9:17:06 AM
Re: Unacceptable
I had the same reaction, Robert. This is the type of information America's enemies will pay good money for -- and then use to do harm to those working to protect this country. There is absolutely no excuse for this failure.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.