2015 White House OPM Hack is Still Largely Unfixed

AlphaAtlas

AlphaAtlas

[H]ard|Gawd
Staff member
Joined
Mar 3, 2018
Messages
1,713
Back in 2015, the White House Office of Personnel Management was hit by a big hack, and the government response was pretty slow. The Government Accountability Office, which recently released a scathing report on the security of U.S. weapon systems, issued several recommendations after the hack, and just recently went back to check on the office's progress, and the results of the report aren't good. According to the GAO, the OPM followed up on some of the requests, but failed to "demonstrated that it had fully implemented" others. The accusations including failing to "reset all passwords subsequent to the breach," failing to install critical security updates in a timely manner, and failing to stop the use of shared administrator accounts. Public scrutiny may be accelerating the agency's security efforts, as many of the recommendations were implemented this quarter. Thanks to pek for the tip.

However, the agency had not provided sufficient evidence that it had implemented the other 16 recommendations. These recommendations included avoiding the use of the same administrator accounts by multiple persons, implementing procedures governing the use of special privileges on a key computer, encrypting passwords while stored or in-transit across the network, and installing the latest versions of operating system software on network devices supporting a high-impact system
 
If anybody reading this isnt familiar with the contents of an SF86 form, you should be. The OPM hack wasnt just the info of the military and contractors, but our entire damn family, where we've lived, who've known, where we've worked. It's not just enough for stealing identity, its enough to create a basic psych profile of the individual.

...and they've had years to do what a civilian company would have days to do, or risk public crucification, and they've still failed to do it. OPM is literally using paper systems now, as they were told not to trust certain components of networks.
 
When people bitch about other breaches and want the government to fix it, this is what I point at.

I was exposed in this hack so I do have a dog in the fight.
 
For every guy you've got fixing a hole there are ten thousand trying to find new ones.
 
But they gave us free credit report monitoring!

#metoo
 
I didn't realize that OPM was a part of the white house. It's supposed to cover all of the federal government.
 
Hey, not my fault, I just passed the report link to him.
 
pek said:
But they gave us free credit report monitoring!

#metoo
Click to expand...
A decade's worth, even. And I'm guessing 50/50 odds that it gets extended indefinitely.


Upside: Don't have to worry about all your shit getting compromised when it already is. Eh? Eh?
 
XenIneX said:
A decade's worth, even. And I'm guessing 50/50 odds that it gets extended indefinitely.


Upside: Don't have to worry about all your shit getting compromised when it already is. Eh? Eh?
Click to expand...

Yeah,

I'm pretty upset at having been caught up in the OPM hack, but I do have to say that the credit monitoring they offered is pretty top notch.
 
{NG}Fidel said:
The government doesn't understand it at basic levels.
Click to expand...
Actually its mostly a funding issue at this point.

They know what they have to do, they just can't get it funded well enough to implement it properly. Which is a big part of the reason why updates are so slow and often implemented in a half assed piecemeal manner that ends up costing more in the long run.

That is up to Congress to make happen and they cut tens of millions to the update program in 2017.
 
You must log in or register to reply here.
Back
Top