Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
NASA Investigating Breach That Exposed PII on Employees, Ex-Workers
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
jfw3rd
50%
50%
jfw3rd,
User Rank: Apprentice
12/20/2018 | 9:28:58 AM
Reasons why these things continue to happen at Federal Agencies
Unfortunately, these types of breaches and security issues plague many Federal Agencies, and will continue to do so in the foreseeable future.  The reasons for this are quite simple.  Federal Agencies are loathe to spend money on IT security because it is not central to their mission. Also, the pay structures of the federal government do not generally allow the agencies to pay what they need to pay for qualified IT security personnel.  That is not to say that there are not qualified IT security professionals in federal agencies.  There are quite a few.  But this is not the norm.  Even when there are qualified IT security professionals, they are often overruled in their attempts to increase security, either because of funding issues, or because their superiors do not care about security unless a breach is publicized and they become embarrassed.  In short, security is unimportant to most Directors of Federal Agencies.  They only care about fulfilling their core mission.
lakers85
50%
50%
lakers85,
User Rank: Strategist
12/20/2018 | 10:08:31 AM
Re: Reasons why these things continue to happen at Federal Agencies
And this is not just an issue with Federal agencies either. Many organizations view IT as non revenue generating and thus treat them in that manner. Meaning, cut, cut, cut even though IT is vital to the day to day operations & success of the organization.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/21/2018 | 1:54:54 PM
inb4
Has anyone else made a "cybersecurity isn't rocket science" joke yet?

If not, consider this my "cybersecurity isn't rocket science" joke.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:43:21 PM
PII
PII can be anything, other than nans and SSN, anything else such as DOB and home address? Those would be sensitive information too.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:45:26 PM
Re: Reasons why these things continue to happen at Federal Agencies
Reasons why these things continue to happen at Federal Agencies Because they want their contractors go through regulations and implement them hot egenit comes to their own infrastructure they don not do the same things.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:46:28 PM
Re: Reasons why these things continue to happen at Federal Agencies
Federal Agencies are loathe to spend money on IT security because it is not central to their mission. That is true too. It should be part of their mission definition in my view.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:47:59 PM
Re: Reasons why these things continue to happen at Federal Agencies
Also, the pay structures of the federal government do not generally allow the agencies to pay what they need to pay for qualified IT security personnel. If I guess I would guess that is is less about money/personel than the culture of the agencies.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:49:23 PM
Re: Reasons why these things continue to happen at Federal Agencies
Even when there are qualified IT security professionals, they are often overruled in their attempts to increase security, I would guess this might be the norm. They do not want to spend money on security most likely as it gests expensive in most cases.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:50:31 PM
Re: Reasons why these things continue to happen at Federal Agencies
because their superiors do not care about security unless a breach is publicized and they become embarrassed Yes, this represents a cultural issue in the agencies.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/26/2018 | 12:51:49 PM
Re: Reasons why these things continue to happen at Federal Agencies
They only care about fulfilling their core mission. I assume they are blinded by the regulations bit they do not have to obey obviously.
Page 1 / 2   >   >>


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-20466
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.
CVE-2020-20467
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.
CVE-2020-20468
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
CVE-2021-24368
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.