Risk
10/7/2011
03:44 PM
50%
50%

Feds Tighten Cybersecurity Policies To Stop Insider Threats

White House order aims to avoid another Cablegate by creating more agency oversight and security for data stored on classified networks.

The White House has issued sweeping new cybersecurity policies to protect classified information on federal networks and to prevent data leaks like the one that caused the Wikileaks Cablegate scandal last year.

The executive order by President Obama creates a number of new interagency governing bodies that will work together to oversee the protection of classified information across federal agencies and departments while balancing the needs of federal users that have permission to access it.

"Our nation's security requires classified information to be shared immediately with authorized users around the world but also requires sophisticated and vigilant means to ensure it is shared securely," according to Obama's order. "Computer networks have individual and common vulnerabilities that require coordinated decisions on risk management."

[The feds are revamping their approach to fighting national security threats. Learn more: Homeland Security Revamps Cyber Arm.]

The order also makes federal organizations primarily responsible for the sharing and protection of their classified information, and mandates they designate a senior official to oversee these tasks.

Additionally, agencies and departments must willingly provide information for independent assessments of their compliance with security policy and standards, as well as implement an insider threat detection and prevention program.

To help them with the latter, the order creates an Insider Threat Task Force that will create a federal program to identify insider threats and prevent classified info from being exploited or compromised. The task force will work with agencies to develop standards for compliance with the program.

The new policies stem from the work of an interagency committee formed by national security staff after the website Wikileaks posted thousands of classified U.S. embassy cables in November. The cables were allegedly removed via a detachable storage device by a military analyst named Bradley Manning, who was arrested earlier that year on suspicion he was leaking classified information.

The incident was an embarrassment to the federal government as it drew attention around the world to the insecurity of its networks, and officials have been working since then to lock down classified info to prevent a similar breach.

In addition to the new policies, the order also sets up a series of committees to ensure agency compliance with the security measures and to facilitate interagency coordination. Specifically, a Senior Information Sharing and Safeguarding Steering Committee will have overall responsibility for the new policies and be held accountable for department and agency compliance.

The White House also will create a Classified Information Sharing and Safeguarding Office to work fulltime to share and safeguard classified national security information. It also will work with partners to make sure policies and standards are consistent as officials aim to identify potential security problems, according to the order.

Senior officials from the Department of Defense (DOD) and the National Security Agency (NSA) will jointly act as a new Executive Agent for Safeguarding Classified Information on Computer Networks to develop technical policies and standards to protect classified information. This agent also will be responsible for third-party assessments of agency compliance.

As officials were laying the groundwork for the new policies, the newly established Insider Threat Task Force has been working informally since June to clarify policies in several priority security areas, according to the Office of Management and Budget (OMB).

For example, departments and agencies already have standardized policies for removable media, limiting the number of users who are permitted to use such devices.

To shore up online identity management, administrators of classified systems also have enacted measures to strengthen online identity management policies and their ability to track information being accessed by these users.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.