The Institute for Critical Infrastructure Technology has published its official analysis of the Office of Personnel Management breach, Handing Over the Keys to the Castle: OPM Demonstrates that Antiquated Security Practices Harm National Security. This research brief provides insights on several of the most important aspects of the breach, some of which are not being discussed in detail by mainstream media including:
– The connection between the VAE, Anthem and OPM breaches
– The legitimacy and confidence we can put in claims attributing the breach to Dark Panda or another Chinese state sponsored group
– Detailed cybersecurity recommendations which would have prevented the outcomes of the attack including analysis around User Behavior Analytics, Governance, Centralized IT Models, Standardization of IT Best Practices, and Continuous Monitoring and Risk Assessment
– The impact of the breach of victims, actions they should be taking, and how their risk level changes based on who is ultimately determined to be the perpetrator of the attack (nation state vs. organized crime syndicate)
ICIT will distribute and present the brief to select members of the House and Senate, Federal Agency CIOs and IT leaders, and select Sector Coordinating Councils and ISACs.
“The OPM breach was a wake-up call for the federal community that they can no longer selectively comply with the findings of security audits which show security flaws in their network. If Congress, the Executive Branch and Agencies can come together to fund and execute a new security paradigm within the government, we are capable today of preventing these incidents and protecting our nation from falling victim to these attacks.” said ICIT Sr. Fellow Parham Eftekhari.
ICIT would like to thank the following Fellows who contributed to this brief:
- James Scott (ICIT Senior Fellow – Institute for Critical Infrastructure Technology)
- Drew Spaniel (ICIT Visiting Scholar, Carnegie Mellon University)
- Dan Waddell (ICIT Fellow – Director, Government Affairs, (ISC)2)
- Ralph Pisani, (ICIT Fellow – EVP of Field Operations, Exabeam)
- Rob Roy (ICIT Fellow – Federal Chief Technology Officer, U.S. Public Sector, HP Enterprise Security)
- Cynthia Cullen (ICIT Fellow – Security Strategist, Northeast, HP Enterprise Security)
- Stan Wisseman (ICIT Fellow – Security Strategist, Southeast, HP Enterprise Security)
- Igor Baikalov (ICIT Fellow – Chief Scientist, Securonix)
Legislative Branch, Executive Branch, Federal Agency and Fellow Program contact information can be found on the last page of the brief.