Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
GAO Finds Deficiencies in Systems for Handling National Debt
Oldest First  |  Newest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/28/2019 | 9:14:43 AM
End Game
What is the actual risk if these systems were to be compromised? Do they only touch data around National Debt?

I would posit that debt isn't an asset so is it something worth targeting. Is it IP in those systems that is the main worry?
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/30/2019 | 1:51:51 PM
least privilege access
the audit mentions the lack of least privilege access as a security concern for systems. This may be important, they may need to address this first I would say.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/30/2019 | 1:52:54 PM
Breaches
Though the deficiencies have not resulted in breaches, the response has not come through improvements to the technology and its use. I wonder how they wiiid know that. Most breaches go unheard.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/30/2019 | 1:54:14 PM
Re: End Game
What is the actual risk if these systems were to be compromised? Good question. Level of risk getting bigger in each step they do not have any mitigation.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/30/2019 | 1:55:45 PM
Re: End Game
I would posit that debt isn't an asset so is it something worth targeting. Interesting to point out. Anything that can be hacked my be considered target.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/30/2019 | 1:57:30 PM
deficiencies
"These new and continuing control deficiencies increase the risk of unauthorized access to, modification of, or disclosure of sensitive data and programs," Obviously there is good amount of work to be done. Unauthorized access can easily be mitigated.
ThomasMaloney
50%
50%
ThomasMaloney,
User Rank: Apprentice
4/16/2019 | 3:00:36 AM
Need intervention
It is really not surprising at all that there are actually deficiencies in the systems regardless of whether or not they belong to the state. Vulnerabilities are bound to be present anywhere at all as long as there are security lapses that are still pending intervention.


AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.