Risk

3/21/2011
01:17 PM
50%
50%

Government Eyeing Security Technology To Prevent Another Wikileaks

The Intelligence Community is trying to find a "sweet spot" between sharing intelligence information while preventing unauthorized access to that data by people who might misuse it, an official told Congress.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
U.S. intelligence agencies are eyeing the use of new security technology to help prevent another insider data breach like the one that caused the Wikileaks international scandal last year.

Testifying before the Senate Homeland Security and Governmental Affairs Committee earlier this month, Corin Stone, the Intelligence Community's (IC) information sharing executive, said that striking a balance between sharing intelligence information while still protecting data against insider threats is a persistent problem within the community, and one that it will use technology to solve.

The Intelligence Community is a coalition of 17 U.S. intelligence agencies and departments -- including the Central Intelligence Agency, the Federal Bureau of Investigations, the Office of National Intelligence, and the Defense Intelligence Agency -- that perform intelligence operations.

As information sharing executive, Stone is responsible for disseminating intelligence information within the community, a result of a reassigning of duties by the Office of the Director of National Intelligence last October. Previously, the IC CIO was responsible for that activity.

Stone said the community is trying to find a "sweet spot" between allowing its members to share intelligence information while preventing unauthorized access to that data by people who might misuse it.

She described the process of doing so as one in which both factors must be considered equally. "In other words, as we increase information sharing, we must also increase the protections afforded to that information," Stone said.

To do this, the community is in the process of implementing insider threat detection capability designed for it by the National Counterintelligence Executive, of which "technology refresh is a vital part," she said.

Stone outlined a two-pronged technology approach that will be implemented over the course of the 2011 and 2012 fiscal years that includes enhancements to logical and physical security controls and information-sharing capability that prioritizes mission needs of various organizations in the community.

Technologies the community plans to deploy include identity and access management; data protection and discoverability; and a reliable audit process, she said. The IC also is working on end-to-end data management technology to ensure that intelligence is appropriately secured throughout its entire lifecycle, she said.

New network authentication technologies also will be deployed to "authoritatively identify who is accessing classified information," Stone said.

The IC CIO is working on this task and aims to assign security certificates to eligible IC personnel in the first quarter of the 2012 fiscal year, she said. The community also is working on better user authentication at the application level, she added.

Stone's concerns are part of a broader move by federal agencies handling intelligence and other classified information to prevent unauthorized access or misuse of it. Last year was a tipping point in the government's thorny relationship with the whistle-blowing Web site Wikileaks, and the feds want to prevent future breaches from occurring.

Last July, Wikileaks published thousands of classified Department of Defense (DoD) documents related to the war in Afghanistan, then followed that up by releasing online 400,000 classified Iraq logs in October.

Then the release of thousands of classified U.S. embassy cables in late November spurred an incident that became known as Cablegate, which caused many to seriously question security at the DoD. Army Private First Class Bradley Manning was arrested last June and is suspected of leaking the information after removing it from the DoD's classified SIPRNet network.

Other top federal officials also have expressed the same concern about avoiding another major scandal. Testifying at the same hearing, new DoD CIO Teri Takai said the agency also is currently deploying new security technology to SIPRNet, to prevent future insider breaches.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8142
PUBLISHED: 2018-05-21
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.
CVE-2018-11311
PUBLISHED: 2018-05-20
A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials.
CVE-2018-11319
PUBLISHED: 2018-05-20
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to ...
CVE-2018-11242
PUBLISHED: 2018-05-20
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
CVE-2018-11315
PUBLISHED: 2018-05-20
The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a ho...