Committee Grills DHS Official over EINSTEIN's Failure to Prevent OPM Attack

Representatives on Wednesday pointedly asked a Department of Homeland Security official why the department's multibillion-dollar cyber traffic-monitoring system known as EINSTEIN failed to prevent intruders from breaching the Office of Personnel Management and extracting sensitive files on millions of federal employees.

"There's been a lot of criticism . . . that EINSTEIN didn't work," said Rep. Dan Donovan, R-N.Y., referring to the DHS cyber program that monitors government network traffic. In the case of the OPM breach, he asked witnesses at a House Homeland Security subcommittee hearing, "did EINSTEIN actually do what it was created to do?"

It depends on what version of EINSTEIN you're talking about, DHS officials say. OPM and the Interior Department both deployed an earlier version of the tool, which is capable of identifying abnormal network traffic and detecting known malicious traffic. 

Assistant Secretary for DHS' Office of Cybersecurity and Communications Andy Ozment told members of the committee EINSTEIN did just that. 

But “OPM and the Department of the Interior are not covered by EINSTEIN 3 yet, the system that blocks intrusions," Ozment said. 

DHS is working with Interior to roll it out there soon, but it's not yet available to OPM "because we have not yet completed [work] with the Internet service provider who services OPM," he added. 

Ozment described EINSTEIN as DHS' “first line of defense, which protects agencies at their perimeters," recording all traffic and identifying anomalies.

A second version of the tool sends alerts if it detects suspicious intruders. EINSTEIN 3A -- a newer system -- is "like a guard post," Ozment said -- capable of blocking prohibited users from accessing a network. 

The use of EINSTEIN 1 helped DHS pinpoint what data was exfiltrated,  Ozment said, but added, "the trick with EINSTEIN is, as it currently is built, it has to know about a threat before it can detect or block it . . . One layer of depth we need to provide is a layer that will help us detect and block intrusions we have not previously seen."

Private sector researchers agree the tool isn't a panacea. During the same hearing, RAND Corporation staff member Daniel Gerstein testified EINSTEIN "still requires additional development and coordination, which will be contracted to implement the program . . . more will be needed to defend government networks in cyberspace.”

During a question-and-answer session, members of the committee suggested a range of potential fixes for shoring up agencies' cybersecurity shortcomings. 

Rep. John Ratcliffe, R-Texas, asked Ozment why OPM was storing information in unencrypted systems.

CIOs often face budget restrictions, and managing risk can be challenging in that environment, Ozment replied. He noted that in the case of the OPM intrusion, the adversary compromised an administrative credential -- almost like copying a superintendent's key to gain access to an apartment building, he said -- and "therefore had legitimate access to the information on the network." As a result, encryption may not have made a difference.  

When Ratcliffe later asked if multifactor authentication might have prevented some damage, Ozment answered that though it wouldn't have prevented an attack, some of the damage could have been mitigated.

What about beefing up DHS' role in enforcing cyber protocol across agencies, Rep. Scott Perry, R-Pa., wondered. 

DHS doesn't “have a stick to enforce that compulsory order,” Ozment said, adding, “I don’t know that it’s possible for one department to be given that sort of compulsory ability with some sort of budgetary authority over another department.”

Rep. Cedric Richmond, D-La., proposed DHS take an offensive approach to cybersecurity, perhaps agencies could “embed something in our information” that could wipe an extractor’s system clean, he proffered. 

“I would think that we should . . . be in a position that we can put landmines in all of our data that we can activate whenever we need to activate,” he said.

Such technology would likely need more development. 

“We need a robust research and development program that looks at all alternatives,” Gerstein, the RAND researcher, responded, pointing to commercially available technology that lets users activate a kill-switch, wiping devices clean of sensitive information if they’re stolen.