Name: Analysis | The Cybersecurity 202: Russian hack reveals weaknesses in government cybersecurity protections
Brand: washingtonpost.com
SKU: washingtonpost-com-1022
Availability: OnlineOnly

critic

Analysis | The Cybersecurity 202: Russian hack reveals weaknesses in government cybersecurity protections

preview

This article was published more than&nbsp;2 years agoCommentGift Sharewith Tonya RileyA major Russian breach is prompting fears the government's cybersecurity protections have fallen dangerously behind.&nbsp;Lawmakers and experts are&nbsp;sounding alarms that billions of dollars' worth of custom-made government cybersecurity systems aren’t equipped to spot the most nefarious Russian hacker activity.&nbsp;And they’re warning the government is poorly organized to respond to such breaches once they come to light.&nbsp;“This really reinforced the need to double down on our cyber defensive strategy,” Rep. Jim Langevin (D-R.I.), co-founder of the Congressional Cybersecurity Caucus, told me.&nbsp;The breach is highlighting how years of efforts to create state-of-the-art cybersecurity protections within government have nevertheless failed to keep out sophisticated Russian hackers who’ve also been improving their game.&nbsp;AdvertisementNotably, the government has fallen behind at keeping tabs on the vast supply chain of technology that runs its computer systems, making it more vulnerable to attacks such as the recent one, which began with Russian hackers breaking into the Texas software company SolarWinds. The hackers then sent corrupted updates to customers including the State, Treasury, Commerce and Homeland Security departments, and probably to many other government agencies and companies as well.&nbsp;“It’s going to take far too long for the executive branch to inventory precisely where Orion [the SolarWinds system] is deployed and utilized and that demonstrates the critical importance of supply chain security,” Langevin said.&nbsp;The hack also shows how the private sector’s cybersecurity savvy has arguably improved faster than the government's.It was the cybersecurity company FireEye, after all, that spotted the Russian campaign, not the National Security Agency or another government agency.&nbsp;Advertisement“For people in Washington who believed that Fort Meade is the center of everything cyber in the U.S., this is going to be a shock,” Jason Healey, a former White House cybersecurity official who’s now a&nbsp;senior research scholar at Columbia University’s School for International and Public Affairs, told me. “It was the private sector that caught this and it’s primarily the private sector that has the capability here.”Some of the earliest concern has focused on a $6 billion cybersecurity detection system known as Einstein.&nbsp;That system is run by DHS and was designed to alert the agency when hackers were trying to infiltrate government systems. But it was designed only to find malicious software the government already knows about, . That allowed the Russian malware, which DHS was unaware of, to sneak in.&nbsp;AdvertisementAs of 2018, the government was planning an Einstein update that might have caught the hack — a system designed to spot when computers aren’t infected with known malware but are acting in a way that suggest they might be compromised, such as connecting to new and unknown IP addresses that might be controlled by hackers. That update was slated for 2022, according to a .&nbsp;“It’s fair to say that Einstein wasn’t designed properly,” Thomas Bossert, a top cybersecurity official in the George W. Bush and Trump administrations, told my colleagues. He called it a “management failure.”Sen. Ron Wyden (D-Ore.), was more critical. “DHS spent billions of taxpayer dollars on cyber defenses and all it got in return as a lemon with a catchy name,” said Wyden, a member of the Senate Intelligence Committee. “Despite warnings by government watchdogs, this administration failed to promptly deploy technology necessary to identify suspicious traffic and catch hackers using new tools and new servers.”AdvertisementOnce DHS learned of the hacking campaign, it loaded indicators of the activity into Einstein to help identify breaches on agency networks, Sara Sendek, a spokeswoman for the DHS’s Cybersecurity and Infrastructure Security Agency (CISA), told my colleagues.&nbsp;Some lawmakers are also expressing concern about another DHS program called Continuous Diagnostics and Mitigation. That’s essentially a suite of preapproved cybersecurity tools DHS okays for use by federal agencies. Here’s more from Politico’s Eric Geller:CDM point is worth considering. What IS the value of such an expensive program if it can't catch the attacks that represent the biggest threat?Then again, is it fair to judge CDM by its failure to catch what everyone agrees is an outlier attack, a super-sophisticated scheme?— Eric Geller (@ericgeller)Langevin, however, defended both programs, saying they'd successfully kept out a range of digital threats and were only outsmarted by a highly sophisticated and elaborate Russian campaign that likely took years of effort.&nbsp;“I wouldn’t say this was a failure of government programs,” he said. “They pulled off something no one else has been able to pull off…It took a determined, sophisticated adversary, which clearly is what we have in Russia.”AdvertisementYet, the breach also comes after four years during which the Trump White House focused far more on punching back against hackers from Russia and elsewhere than on improving cyber defenses.“Trump went far in the direction of … the best defense is a good offense,” Healey said. “Hopefully we can get back to where a good defense is a good defense and focusing on improving cybersecurity as a whole so attacks become harder.”Lawmakers are also pushing changes that would improve the government’s response to such breaches.&nbsp;A major defense bill that’s sitting on President Trump’s desk would create the role of a national cyber director who would lead such efforts. Trump, who has threatened to veto the defense bill, eliminated a similar but less powerful position in 2018.&nbsp;“There’s no doubt that it would be helpful if we had a quarterback in the White House now,” Langevin said.&nbsp;Alex Stamos, a former chief cybersecurity official at Facebook and Yahoo, argued in a for going a step further and creating a government group similar to the National Transportation Safety Board to review major breaches and recommend changes so they don’t happen again. Stamos is now director of the Stanford Internet Observatory.&nbsp;The government response so far has been somewhat scattershot.&nbsp;CISA issued an emergency directive ordering agencies to find instances of the targeted software on their networks. But some agencies missed a Monday deadline to report back and it’s still not clear how many government agencies were compromised.&nbsp;AdvertisementCISA also is working without most of its top leadership after Trump fired director Christopher Krebs for defending the integrity of the election and several other top leaders resigned under pressure or by choice. That has left acting director Brandon Wales to shoulder a large part of the operation.&nbsp;National security adviser Robert O’Brien announced late yesterday he is to come back and coordinate the response. That came several hours after the National Security Council announced it was Cyber Unified Coordination Group to manage the response.Finally, the breach is raising questions about whether the government is making the right calls on broader cybersecurity policies.&nbsp;The Justice Department, for example, has been pushing for years for special access to encrypted communications with a warrant so it can better track criminals communicating online.&nbsp;AdvertisementBut the government’s failures to protect its own networks raise serious questions about whether it could ensure such special access didn’t also give criminals or foreign spy agencies broad access to people’s private communications.Here’s more from Eva Galperin, cybersecurity director at the Electronic Frontier Foundation:I'm saving my "What about SolarWinds?" for the next time the FBI tries to tell me that backdooring end-to-end encryption will be fine because the US government will protect the keys.— Eva (@evacide)Ousted CISA leader Krebs will testify before a Senate committee about the security of the 2020 election.&nbsp;Advertisement“”“”R-Wis.“Here's more on what to watch for at the hearing from election security expert David Levine:1/ While the witness list includes and , both of whom played important roles in helping secure , it includes no others who serve on the front lines of elections, such as state and local election officials, vendors, and other federal partners.— David Levine (@davidalanlevine)3/As the Senators, witnesses and others prepare for tomorrow's hearing, they should be mindful of the fact that any false claims of election irregularities could cast further doubt on the legitimacy of .— David Levine (@davidalanlevine)Top investors in SolarWinds sold millions in stock days before the company announced hackers breached its software.The timing raises questions about when investors received information about the hack and whether they used that information to avoid major losses, . &nbsp;The company's stock has plunged about 22 percent since the Texas-based company disclosed that its software created a backdoor for Russian hackers.&nbsp;The concerns could spark an investigation by financial regulators.“Of course the SEC is going to look at that,” said Jacob S. Frenkel, a former senior counsel in the SEC’s Division of Enforcement. “Large trades in advance of a major announcement, then an announcement: That is a formula for an insider trading investigation.”&nbsp;Two of the firms that traded stock owned 70 percent of SolarWinds and had control of six board seats, giving them key access. Trades also occurred just before the company announced its chief executive was resigning, which could flag further concerns.&nbsp;A SolarWinds spokesman declined to discuss timing or answer further questions about the trades. A spokeswoman for the SEC, also declined to comment.Individuals affiliated with the French military ran Facebook influence operations that scuffled with Russian trolls.“”Stanford and UC-Berkeley cyber programs and 20 other institutions signed a pledge to end all- White male&nbsp;cybersecurity panel discussions.&nbsp;adviser”More cybersecurity news:&nbsp;Help1. What are computer 2. How online3. Who do computer bad 4. Computer??? How???5. Computer — Ed Zitron (@edzitron)Congrats to our friend at Politico Eric Geller on his attention-grabbing doors.&nbsp;Leslie, welcome to cyber twitter, where we all mildly drag Eric from time to time— Greg Otto (@gregotto)CommentsGift ArticleTOP STORIESThe BriefingDon’t miss reporting and analysis from the Hill and the White House.Try a different topic or to save your preferences

This article was published more than&nbsp;2 years agoCommentGift Sharewith Tonya RileyA major Russian breach is prompting fears the government's cybersecurity protections have fallen dangerously behind.&nbsp;Lawmakers and experts are&nbsp;sounding alarms that billions of dollars' worth of custom-made government cybersecurity systems aren’t equipped to spot the most nefarious Russian hacker activity.&nbsp;And they’re warning the government is poorly organized to respond to such breaches once they come to light.&nbsp;“This really reinforced the need to double down on our cyber defensive...

Analysis | The Cybersecurity 202: Russian hack reveals weaknesses in government cybersecurity protections

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS