Foreign Government Hackers Are the Gravest and Most Common Threat, Agencies Say

The gravest attacks -- and most common -- perpetrated against agency networks involved nation states, according to an audit that happened to be released amid accusations the Russian government allegedly hacked the Democratic National Committee. 

The Government Accountability Office assessment comes one year after the Office of Personnel Management disclosed the biggest known breach of government-held personal information, also allegedly a foreign job. 

OPM is one of four representative agencies scrutinized that still does not always use effective access controls, the February 2015-May 2016 audit found. The other departments studied were the Veterans Affairs, NASA and the Nuclear Regulatory Commission. 

All 18 agencies that operate high-impact systems vital to society cited nation-state attacks as the most serious threat. All but three departments said they happened most often.

Most frequently, agencies are alerted to incidents involving spearphishing emails with malicious links or attachments, GAO says. And those attacks -- emails tailored to deceive specific employees -- were rated the most serious at 17 of the 18 agencies. 

OPM and Auditors Dispute Findings of Security Testing

In response to a draft of the report, however, OPM argued the auditors did not supply the agency with enough details to cross-check the weaknesses categorized as "boundary protection" and "authorization” vulnerabilities.

The agency also contended GAO did not fully describe the nature of the security weaknesses until a week before a response to the draft was due May 2.

"However, we do not believe this is an accurate characterization of the situation," Gregory C. Wilshusen, GAO director for information security issues, and GAO Chief Technologist Nabajyoti Barkakati said in their final audit, issued on Tuesday.

It was all the way back on March 9 that the auditors briefed OPM on technical findings, the GAO officials said. A week later, OPM asked to see underlying materials that supported the findings.

“That same day, we informed agency personnel that they already had all of these materials, as they had provided them to us," Wilshusen and Barkakati said.

On Tuesday afternoon, OPM officials also disputed the final audit report.

“While OPM and GAO are in agreement on most of their recommendations, we continue to disagree with GAO’s security control assessments recommendation as written because it does not address the issues identified within the technical assessment, and suggests another cause for which no analysis was conducted and/or provided to OPM for review,” OPM spokesman Sam Schumach told Nextgov in an email.

On June 4, 2015, OPM officials announced the first wave of coordinated intrusions into employee background check systems that ultimately claimed at least 21.5 million individuals’ records. The Chinese government is widely believed to have orchestrated the hack.

Email the Most Frequent Avenue of Attack

The most severe and most frequent avenues of attack against high-impact systems were through email, the web, or an employee's improper use of technology, GAO says.

Governmentwide, there were 500 incidents in fiscal 2014 that involved the installation of malicious code at agencies holding information that could cause catastrophic harm to individuals or the nation if lost, GAO said.

At the four agencies GAO selected for testing, the departments hadn’t always installed effective system login restrictions or patched software flaws that could allow hackers inside.

Nor did they always have contingency plans in place to make sure the high-impact systems remained accessible, as well as maintained confidentiality and data integrity, the audit found.

"Until the selected agencies address weaknesses in access and other controls," the GAO officials said, "the sensitive data maintained on selected systems will be at increased risk of unauthorized access, modification and disclosure, and the systems at risk of disruption." 

Each of the chosen agencies has been hacked by suspected nation-states in recent years. 

One incident at NRC involved spearphishing emails sent to about 215 employees in a logon-credential harvesting attempt, according to an inspector general report Nextgov obtained through an open-records request. The messages baited personnel by asking them to verify their user accounts through clicking a link.

The link they clicked took victims to "a cloud-based Google spreadsheet." Investigators tracked the person who set up the spreadsheet to an unnamed foreign country.

Adversaries operating from a Chinese-based IP address in 2011 gained access to key systems of NASA’s Jet Propulsion Laboratory and high-level user accounts. "In other words," the space agency’s inspector general said at the time, "the attackers had full functional control over these networks."   

In 2013, a lawmaker said foreign actors had repeatedly compromised an unencrypted database maintained by VA containing personally identifiable information on roughly 20 million veterans. At the time, Rep. Michael Coffman, R-Colo., said China and possibly Russia were responsible for the hacking.