The OPM Breach: What Went Right
Security | Jun 4, 2015
What the OPM is Doing Right
While this state-sponsored attack on federal employees and their agencies is an act of espionage and therefore of grave concern to the nation, I see signs in the news coverage that the OPM is taking action that is deserving of praise. As noted in the recent Washington Post coverage, “After the earlier breach discovered in March 2014, the OPM undertook ‘an aggressive effort to update our cybersecurity posture, adding numerous tools and capabilities to our networks,’ Seymour said. ‘As a result of adding these tools, we were able to detect this intrusion into our networks.’”
This type of response to an initial breach is not only appropriate, but exemplary. Government agencies need to be proactive, because many realize that breaches like the recent Sony attack prove that the enemy may already be within their gates—and sometimes cruising the network for months before they’re detected.
Key Takeaway: Be Proactive
Many organizations—in both private and public sectors-- house extremely sensitive data. High-value data is ideally confined to properly fortified servers, and tightly sealed off with aggressive whitelisting and rigorous audits. Multi-factor authentication and strong passwords are critical, and there’s a new tactic that becomes more crucial with every hack we learn about: active, ongoing anomaly hunting.
Sensitive data tends to congregate on network endpoints such as laptops and servers, and it has a habit of multiplying into errant, unauthorized copies in unauthorized storage locations. For that reason, it’s essential for today’s security teams to create and regularly update baselines of normal activity for each endpoint that houses sensitive data, and to then actively watch for signs of anomalous behavior against those baselines.
Today’s threat actors are deploying malware in unusual places--such as the UDP channel--that are not visible with most security tools. With its exclusive ability to gain visibility of the endpoint even below the operating system, EnCase® Endpoint Security was designed to see the unseen by helping you baseline normal behavior across all your organizational endpoints, then watch for signs that something unusual is happening. After all, anomalies are the hallmark of infiltration.
Comments? Are you proactively hunting threats in your systems? We welcome discussion in the section below, whether on this topic or on one you would like to see us write about here in the blog.
Michael Harris is the Chief Marketing Officer at Guidance Software.