Breach of Homeland Security Background Checks Raises Red Flags

We should be burning down the house over this, says GRC expert.

Background check records of 25,000 undercover investigators and other homeland security staff were exposed in the breach at US Investigations Services (USIS) this month, unnamed
officials told Reuters
Friday. USIS has said the incident had all the markings of a state-sponsored attack. What agency officials have said about the incident--and what they
havent
said about it--are raising questions about the breachs ultimate impact and about inadequate measures for ensuring that third-party government contractors properly secure classified data.
If [leaking] credit card data [to attackers] is like giving your kids a spoonful of sugar, compromising background checks is like handing them cocaine, says Rick Dakin, CEO of
Coalfire
, the nations largest independent IT governance, risk, and compliance firm. This is not lightweight data. These are very rich databases on how to compromise national security.
USIS is the third-party commercial firm that performs employee background checks for the Department of Homeland Security, including the US Immigration and Customs Enforcement and US Customs and Border Protection units.
These background checks are not like the ones you request about your new babysitter. They cover criminal history, drug use, and other indiscretions going back many years. As Dakin puts it, they want to know when you stopped kicking dogs. The data also includes information about spouses, relatives, and friends -- all things that could be used to threaten and pressure agents and identify those who are undercover.
We should be burning down the house over this breach, says Dakin. Peoples lives are at risk.
Some things about this incident have the entire Coalfire teams Spidey-sense tingling. Having conducted hundreds of assessments and forensic investigations, they would expect officials to reveal certain kinds of information if they had it -- upbeat things like that the data was encrypted -- and this information has been conspicuously absent from officials statements. For example, in a notification letter obtained by Reuters, USIS stated, Records including this data were exposed to unauthorized users during the cybersecurity intrusion. We do not yet know whether the data was actually taken.
As Dakin sees it, the fact that the agency doesnt know that could be an indication that its networking monitoring -- especially as it relates to data exfiltration -- is lacking.
Officials also have not mentioned anything about network segmentation. Yet he says that, even if USIS did segment its networks, theres not a chance in the world, no way they had only 25,000 [background checks] in one segment. So he suspects that this number will go up. (He compares it to the 2005 Choicepoint breach. At first, Choicepoint revealed only the number of customer records it was required to report under state laws, subtracting records for customers who lived in states that did not have such laws.)
This underreporting raises a red flag in Dakins mind. USIS owes us a full disclosure.
He also says that USIS did not undergo any rigorous process to assess its security posture and ensure that certain security policies are upheld. He notes that USIS is not on the
short list of service providers
that have been approved under FedRAMP, a government program that was created to help government agencies choose cloud service providers that upheld certain security standards.
USIS may not consider themselves a cloud service provider, but they should be, says Dakin. If a service provider collects data online, processes data online, and delivers reports to clients online… it is a cloud service provider.
Though many in both the government and the security industry have been banging the information-sharing drum a lot over the past few years, Dakin says the Department of Homeland Security was likely not sharing adequate threat data with USIS.
Intelligence agencies know this stuff is happening, he says. They could have warned USIS, and organizations can help themselves by helping their service providers.
DHS has suspended business with USIS; it has not announced what service it will employ to perform background checks in USISs stead.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Breach of Homeland Security Background Checks Raises Red Flags