Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

8/25/2014
05:48 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Breach of Homeland Security Background Checks Raises Red Flags

"We should be burning down the house over this," says a GRC expert.

Background check records of 25,000 undercover investigators and other homeland security staff were exposed in the breach at US Investigations Services (USIS) this month, unnamed officials told Reuters Friday. USIS has said the incident had "all the markings of a state-sponsored attack." What agency officials have said about the incident--and what they haven't said about it--are raising questions about the breach's ultimate impact and about inadequate measures for ensuring that third-party government contractors properly secure classified data.

"If [leaking] credit card data [to attackers] is like giving your kids a spoonful of sugar, compromising background checks is like handing them cocaine," says Rick Dakin, CEO of Coalfire, the nation's largest independent IT governance, risk, and compliance firm. "This is not lightweight data. These are very rich databases on how to compromise national security."

USIS is the third-party commercial firm that performs employee background checks for the Department of Homeland Security, including the US Immigration and Customs Enforcement and US Customs and Border Protection units.

These background checks are not like the ones you request about your new babysitter. They cover criminal history, drug use, and other indiscretions going back many years. As Dakin puts it, "they want to know when you stopped kicking dogs." The data also includes information about spouses, relatives, and friends -- all things that could be used to threaten and pressure agents and identify those who are undercover.

"We should be burning down the house over this" breach, says Dakin. "People's lives are at risk."

Some things about this incident have the entire Coalfire team's Spidey-sense tingling. Having conducted hundreds of assessments and forensic investigations, they would expect officials to reveal certain kinds of information if they had it -- upbeat things like that the data was encrypted -- and this information has been conspicuously absent from officials' statements. For example, in a notification letter obtained by Reuters, USIS stated, "Records including this data were exposed to unauthorized users during the cybersecurity intrusion. We do not yet know whether the data was actually taken."

As Dakin sees it, the fact that the agency doesn't know that could be an indication that its networking monitoring -- especially as it relates to data exfiltration -- is lacking.

Officials also have not mentioned anything about network segmentation. Yet he says that, even if USIS did segment its networks, there's "not a chance in the world, no way they had only 25,000 [background checks] in one segment." So he suspects that this number will go up. (He compares it to the 2005 Choicepoint breach. At first, Choicepoint revealed only the number of customer records it was required to report under state laws, subtracting records for customers who lived in states that did not have such laws.)

This "underreporting" raises a red flag in Dakin's mind. "USIS owes us a full disclosure."

He also says that USIS did not undergo any rigorous process to assess its security posture and ensure that certain security policies are upheld. He notes that USIS is not on the short list of service providers that have been approved under FedRAMP, a government program that was created to help government agencies choose cloud service providers that upheld certain security standards.

"USIS may not consider themselves a cloud service provider, but they should be," says Dakin. "If a service provider collects data online, processes data online, and delivers reports to clients online… it is a cloud service provider."

Though many in both the government and the security industry have been banging the information-sharing drum a lot over the past few years, Dakin says the Department of Homeland Security was likely not sharing adequate threat data with USIS.

"Intelligence agencies know this stuff is happening," he says. "They could have warned USIS," and organizations can help themselves by helping their service providers.

DHS has suspended business with USIS; it has not announced what service it will employ to perform background checks in USIS's stead.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
8/26/2014 | 9:17:06 AM
Re: Unacceptable
I had the same reaction, Robert. This is the type of information America's enemies will pay good money for -- and then use to do harm to those working to protect this country. There is absolutely no excuse for this failure.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
8/26/2014 | 9:08:09 AM
Re: Unacceptable
I agree, Government agencies should have more accountability when it comes to protecting personal data, especially data that directly affects the safety of citizens, and to find it was not encrypted?  This is outrageous. 
zaious
50%
50%
zaious,
User Rank: Apprentice
8/26/2014 | 1:07:22 AM
Re: Unacceptable
It is disappointing. It means that all databases are being targated. Attackers are not shifting their target from hard objectives (highly secured databases). Every enterprise with a database should stay alert -all the time.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/25/2014 | 11:18:25 PM
Unacceptable
I don't know if I can express how upset I am over this breach.  This could literally lead to the deaths of many people.

Of all the data in the world, this is the kind that needs to be paper only or at the very least on a non internet connected network.
<<   <   Page 2 / 2
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25137
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise &amp; Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /a...
CVE-2020-25138
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise &amp; Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test...
CVE-2020-25139
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise &amp; Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for delete_syslog_ru...
CVE-2020-25140
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise &amp; Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php.
CVE-2020-4531
PUBLISHED: 2020-09-25
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the sy...