Before I weigh in with my two cents worth, I’d like to share a personal experience. Way back in spring 2006, I was awarded a contract to assist the Department of Transportation as they worked to submit the required systems Certification and Accreditation to OMB.
It was a tall order, but nonetheless I looked forward to the assignment; I assumed the only downside would be the pages of Government paperwork that I was required to submit before I could even step inside DoT headquarters. In order to obtain my ID badge, I had to provide personal details not just about myself, but my family and friends as well.
Fast forward to summer 2015, when OPM notified me that their database had been compromised; as many as 21.5 million individual records had been stolen and there was a “strong possibility” that the personal data included in my DoT paperwork was amongst them. Now it’s fair to say that this ‘strong possibility’ wasn’t an absolute certainty. But given that my family and close friends information was stolen as well as my own, let’s just say that I wasn’t very open to considering the ‘possibility’ that my data had been untouched. Would you have been?
Sure, I’ve since been offered a prepaid subscription to an identity theft monitoring program, but let’s be candid. That’s the virtual equivalent of deciding to install smoke detectors in your home, after it’s been burned to the ground. Taking steps to protect the people you’re responsible for, only after they’ve been compromised, means you’ve failed. It’s that simple.
I’ve since heard that OPM has introduced two-factor authentication as a common working practice since the incident. But given that’s a feature found on most iPhones, why did it take so long for a Government department to implement it as a basic security measure?
No matter where you stand politically, no one can deny that we share a mutual concern; virtual criminals are becoming increasingly sophisticated by the day, so a level paranoia comes with the territory in the Public Sector. What continues to alarm me is that we’re all seem to be victims waiting for the next headline to hit. We are so preoccupied with fixing the destruction caused by the last attack we didn’t see coming, that we don’t have time to be proactive about preventing the next one.
There tends to be a reliance on assumptions and ‘what we know’. But given the increasingly unpredictable and unparalleled nature of these attacks, is what we know good enough anymore?
With far more exciting targets such as the NSA and the Pentagon, I for one would’ve completely dismissed anyone who predicted the possibility that a Government agency such as the OPM would be targeted, and I’m willing to bet I’m not the only one.
Back in 2011, Iran admitted to overriding and taking control of a US drone and amazingly, the story once reported seems to have disappeared from our minds. Clearly, the political and military consequences were discussed but surely there should be more time committed to asking “if a drone can be hacked, what else can?”
We need to consider the far-fetched, worst-case scenario given our current climate. If a drone can be overridden, who can absolutely guarantee the same wouldn’t happen to a plane with a pilot onboard? Is a commercial air traffic control tower just as at risk of being compromised as the OPM? Are similar, low visibility departments at risk, like the Department of Veteran Affairs?
More recently the Chinese military unveiled their latest fighter aircraft the Chengdu-J20. The aircraft bears a striking resemblance to our F-22 advanced fighter. Anyone who has seen the J-20 can’t dismiss the fact that somehow the Chinese were able to hack into either a DoD or subcontractor network and steal proprietary specifications and designs for the F-22. Fortunately stealing the designs appears to be a simpler task than duplicating the sophisticated technology that provides the F-22 pilot the ability to see and fire upon enemy aircraft even if the enemy is behind them.
Fighting fires once the damage has been done is an all too common practice. But as for best practice? That comes with discussion, sharing our experiences and bouncing ideas off each other - and I’m not referring just to our world and industry leaders.
It’s time we took a more proactive role in actually preventing the constant threat of cyber criminals that we face daily, instead of simply waiting for the latest breach to make the news, and reacting to it.
For an industry that operates in the background to ensure our information is protected, we’re being caught in the headlines way too often, and for the wrong reasons.
Sometimes it’s on a global scale, sometimes it’s personal. But one things for certain, something needs to change.
Last week I created a LinkedIn closed group to bring together informed, like-minded people who want to take a different, more proactive approach to combatting cyber security.
The group isn’t designed to be a passive, voyeuristic forum. Its purpose is for those that want to come to the table with strong ideas, share best practice in a trusted environment and are ready to hit the issues head-on together.
That way, we have a fighting chance of preventing more disastrous headlines.
You can join ‘The Cyber Security Forum’ here.