Breach of Homeland Security Background Checks Raises Red Flags

[Jeffrey Walton <noloader () gmail com>]

http://www.darkreading.com/breach-of-homeland-security-background-checks-raises-red-flags/d/d-id/1306624

Background check records of 25,000 undercover investigators and other
homeland security staff were exposed in the breach at US
Investigations Services (USIS) this month, unnamed officials told
Reuters Friday. USIS has said the incident had "all the markings of a
state-sponsored attack." What agency officials have said about the
incident--and what they haven't said about it--are raising questions
about the breach's ultimate impact and about inadequate measures for
ensuring that third-party government contractors properly secure
classified data.

"If [leaking] credit card data [to attackers] is like giving your kids
a spoonful of sugar, compromising background checks is like handing
them cocaine," says Rick Dakin, CEO of Coalfire, the nation's largest
independent IT governance, risk, and compliance firm. "This is not
lightweight data. These are very rich databases on how to compromise
national security."

USIS is the third-party commercial firm that performs employee
background checks for the Department of Homeland Security, including
the US Immigration and Customs Enforcement and US Customs and Border
Protection units.

These background checks are not like the ones you request about your
new babysitter. They cover criminal history, drug use, and other
indiscretions going back many years. As Dakin puts it, "they want to
know when you stopped kicking dogs." The data also includes
information about spouses, relatives, and friends -- all things that
could be used to threaten and pressure agents and identify those who
are undercover.

"We should be burning down the house over this" breach, says Dakin.
"People's lives are at risk."

Some things about this incident have the entire Coalfire team's
Spidey-sense tingling. Having conducted hundreds of assessments and
forensic investigations, they would expect officials to reveal certain
kinds of information if they had it -- upbeat things like that the
data was encrypted -- and this information has been conspicuously
absent from officials' statements. For example, in a notification
letter obtained by Reuters, USIS stated, "Records including this data
were exposed to unauthorized users during the cybersecurity intrusion.
We do not yet know whether the data was actually taken."

As Dakin sees it, the fact that the agency doesn't know that could be
an indication that its networking monitoring -- especially as it
relates to data exfiltration -- is lacking.

Officials also have not mentioned anything about network segmentation.
Yet he says that, even if USIS did segment its networks, there's "not
a chance in the world, no way they had only 25,000 [background checks]
in one segment." So he suspects that this number will go up. (He
compares it to the 2005 Choicepoint breach. At first, Choicepoint
revealed only the number of customer records it was required to report
under state laws, subtracting records for customers who lived in
states that did not have such laws.)

This "underreporting" raises a red flag in Dakin's mind. "USIS owes us
a full disclosure."

He also says that USIS did not undergo any rigorous process to assess
its security posture and ensure that certain security policies are
upheld. He notes that USIS is not on the short list of service
providers that have been approved under FedRAMP, a government program
that was created to help government agencies choose cloud service
providers that upheld certain security standards.

"USIS may not consider themselves a cloud service provider, but they
should be," says Dakin. "If a service provider collects data online,
processes data online, and delivers reports to clients online… it is a
cloud service provider."

Though many in both the government and the security industry have been
banging the information-sharing drum a lot over the past few years,
Dakin says the Department of Homeland Security was likely not sharing
adequate threat data with USIS.

"Intelligence agencies know this stuff is happening," he says. "They
could have warned USIS," and organizations can help themselves by
helping their service providers.

DHS has suspended business with USIS; it has not announced what
service it will employ to perform background checks in USIS's stead.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.