Posted on 06/24/2015 6:35:16 PM PDT by markomalley
Representatives on Wednesday pointedly asked a Department of Homeland Security official why the department's multibillion-dollar cyber traffic-monitoring system known as EINSTEIN failed to prevent intruders from breaching the Office of Personnel Management and extracting sensitive files on millions of federal employees.
"There's been a lot of criticism...that EINSTEIN didn't work," said Rep. Dan Donovan, R-N.Y. referring to the DHS cyber program that monitors government network traffic. In the case of the OPM breach, he asked witnesses at a House Homeland Security subcommittee hearing, "did Einstein actually do what it was created to do?"
It depends on what version of EINSTEIN you're talking about, DHS officials say. OPM and the Interior Department both deployed an earlier version of the tool, which is capable of identifying abnormal network traffic and detecting known malicious traffic.
Assistant Secretary for DHS' Office of Cybersecurity and Communications Andy Ozment told members of the committee that EINSTEIN did just that.
But “OPM and the Department of the Interior are not covered by EINSTEIN 3 yet, the system that blocks intrusions," Ozment said.
DHS is working with Interior to roll it out there soon, but it's not yet available to OPM "because we have not yet completed [work] with the Internet Service Provider who services OPM," he added.
Ozment described EINSTEIN as DHS' “first line of defense, which protects agencies at their perimeters”, recording all traffic and identifying anomalies. A second version of the tool sends alerts if it detects suspicious intruders. EINSTEIN 3A -- a newer system -- is "like a guard post," Ozment said -- capable of blocking prohibited users from accessing a network.
The use of EINSTEIN 1 helped DHS pinpoint what data was exfiltrated, Ozment said, but added, "the trick with EINSTEIN is, as it currently is built, it has to know about a threat before it can detect or block it...One layer of depth we need to provide is a layer that will help us detect and block intrusions we have not previously seen."
Private sector researchers agree the tool isn't a panacea. During the same hearing, RAND Corporation staff member Daniel Gerstein testified that EINSTEIN "still requires additional development and coordination, which will be contracted to implement the program...more will be needed to defend government networks in cyberspace.”
During a question-and-answer session, members of the committee suggested a range of potential fixes for shoring up agencies' cybersecurity shortcomings.
Rep. John Ratcliffe, R-Tex., asked Ozment why OPM was storing information in unencrypted systems.
CIOs are often faced with budget restrictions, and managing risk can be challenging in that environment, Ozment replied. He noted that in the case of the OPM intrusion, the adversary compromised an administrative credential -- almost like copying a superintendent's key to gain access to an apartment building, he said -- and "therefore had legitimate access to the information on the network." As a result, encryption may not have made a difference.
When Ratcliffe later asked if multifactor authentication might have prevented some damage, Ozment answered that though it wouldn't have prevented an attack, some of the damage could have been mitigated."
What about beefing up DHS' role in enforcing cyber protocol across agencies, Rep. Scott Perry, R-Pa., wondered.
DHS doesn't “have a stick to enforce that compulsory order,” Ozment said, adding, “I don’t know that it’s possible for one department to be given that sort of compulsory ability with some sort of budgetary authority over another department.”
Rep. Cedric Richmond, D-La., proposed that DHS take an offensive approach to cybersecurity, perhaps agencies could “embed something in our information” that could wipe an extractor’s system clean, he proffered. “I would think that we should...be in a position that we can put landmines in all of our data that we can activate whenever we need to activate,” he said.
Such technology would likely need more development.
“We need a robust research and development program that looks at all alternatives,” Gerstein, the RAND researcher, responded, pointing to commercially available technology that lets users activate a kill-switch, wiping devices clean of sensitive information if they’re stolen.
The DHS are clearly not exactly Einsteins.
I’m glad all the federal parasites were hacked. I want all their dirt to come out so the taxpayers can sue them into oblivion.
The use of EINSTEIN 1 helped DHS pinpoint what data was exfiltrated, Ozment said, but added, “the trick with EINSTEIN is, as it currently is built, it has to know about a threat before it can detect or block it.
Great intrusion detection system. Works perfectly if only the bad guys would be so kind to notify them in advance of a break in attempt.
I'm in that database (I've held a security clearance for the last 35 years...the security clearance database was one of the ones compromised)
My wife is in that database (her information is provided as a consequence of one or more DD 398's/SF-86's I've had to fill out over the years).
My daughter is in that database, for the same reason.
My parents and my in-laws are in that database, for the same reason.
Many of my friends are in that database, for the same reason.
My neighbors are in that database, for the same reason.
BTW, the vast majority of the people I listed above are not, nor ever have been, federal employees. I am not a federal employee and haven't been since I retired from the military.
Oh, and by the way, I am not a parasite. Neither is my wife. Neither is my daughter. Neither are my friends. Neither are my neighbors.
Just sayin'
They are too busy spying on U.S. citizens in the TEA party
A rational nation would be hanging people by now.
L
DUmbstein
Then I wasn't talking about you.
But I was talking about the porn-watching bureaucRATs of the IRS, NSA and the party boys of the Secret Service etc etc etc.
When the ragheads nuke an American city Washington DC has nothing to worry about.
Apology accepted.
But I was talking about the porn-watching bureaucRATs of the IRS, NSA and the party boys of the Secret Service etc etc etc.
So far they've owned up to over 19 million people who are directly impacted (and that doesn't include family members, neighbors, references, and other people who are identified on clearance forms). Many of those are military (current, former, retired) and non-employees who have security clearances.
And it also includes not a few FReepers.
Just sayin...
My ex sister in law was compromised. She received a letter offering 2 years of fraud protection, 1 million dollar policy. In order to get the fraud protection they have to go to a website and enter lots of personal identifying information. The government gave the fraud contract to some company in Detroit. Yeah, Detroit business.
I told her just to get Life Lock. She and others in military are doing just that. She was a teacher for children of military overseas. She is retired now.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.