Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Breach of Homeland Security Background Checks Raises Red Flags
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Robert McDougal
Robert McDougal,
User Rank: Ninja
8/25/2014 | 11:18:25 PM
Unacceptable
I don't know if I can express how upset I am over this breach.  This could literally lead to the deaths of many people.

Of all the data in the world, this is the kind that needs to be paper only or at the very least on a non internet connected network.
zaious
zaious,
User Rank: Apprentice
8/26/2014 | 1:07:22 AM
Re: Unacceptable
It is disappointing. It means that all databases are being targated. Attackers are not shifting their target from hard objectives (highly secured databases). Every enterprise with a database should stay alert -all the time.
Stratustician
Stratustician,
User Rank: Moderator
8/26/2014 | 9:08:09 AM
Re: Unacceptable
I agree, Government agencies should have more accountability when it comes to protecting personal data, especially data that directly affects the safety of citizens, and to find it was not encrypted?  This is outrageous. 
Alison_Diana
Alison_Diana,
User Rank: Moderator
8/26/2014 | 9:17:06 AM
Re: Unacceptable
I had the same reaction, Robert. This is the type of information America's enemies will pay good money for -- and then use to do harm to those working to protect this country. There is absolutely no excuse for this failure.
Alison_Diana
Alison_Diana,
User Rank: Moderator
8/26/2014 | 9:19:25 AM
Re: Unacceptable
There is almost a blase attitude to breaches these days. It's absolutely infuriating to continually hear that breach after breach includes lack of encryption, lack of patches, or other basic security steps that go ignored. Someone -- government, consumers, or a combination of both -- has to begin holding organizations' feet to the fire. We saw it somewhat with Target; people left the store and shopped elsewhere. But in CHS' case, the stock rose! The government MUST act strongly in this instance to send a strong, strong message that this lack of adequate security measures won't be tolerated.
Robert McDougal
Robert McDougal,
User Rank: Ninja
8/26/2014 | 9:20:38 AM
Re: Unacceptable
In my opinion, this should lead to criminal charges.  As a result of this negligence the families and friends of undercover operatives are at risk.  This is utterly unforgivable.
Some Guy
Some Guy,
User Rank: Moderator
8/26/2014 | 11:10:13 AM
Re: Unacceptable
I'd say that no longer doing business with USIS is the corporate death sentence. Anyone feel better now? Didn't think so. We need to quit the witch-hunt, and apply lessons learned from this across the board.

Don't fix the blame, fix the problem.
securityaffairs
securityaffairs,
User Rank: Ninja
8/26/2014 | 12:10:36 PM
Re: Unacceptable
The is probably one of most worrying data breaches due to the nature of information compromised... every Government Database is a potential target, its accesses from third parties must be carefully regulated.

I'm very worried by this last attack

 
Sara Peters
Sara Peters,
User Rank: Author
8/26/2014 | 3:55:57 PM
Re: Unacceptable
@AlisonDiana  I com pletely agree Alison. These days there are SO MANY breaches, and people are getting desensitized. When your hospitals, your food stores, your clothing stores, your DMV, and your local florist are all getting breached, what can you really do? You only have so many options... if you try to avoid every one that has a breach, eventually you'll run out of options.

And that's just one reason why market pressures will never really result in good security.
Sara Peters
Sara Peters,
User Rank: Author
8/26/2014 | 3:59:18 PM
Re: Unacceptable
@SomeGuy  Agreed. Deal with the problem now. Assess blame later. The fact is, EVERYONE needs to think about security, and need to share the job with their contractors, service providers, and even their customers.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9754
PUBLISHED: 2022-06-27
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
CVE-2022-33146
PUBLISHED: 2022-06-27
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
CVE-2022-33202
PUBLISHED: 2022-06-27
Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative pat...
CVE-2022-2206
PUBLISHED: 2022-06-26
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-30932
PUBLISHED: 2022-06-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.