Could a Free Tool Have Stopped the OPM Hack? (And How to Get One for Yourself)

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology and government. He is currently the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

The recent breach at the Office of Personnel Management that resulted in the theft of over 21 million personal records belonging to current and former government employees and their families is an unforgivable mess with reverberations that will be felt for years or even decades to come. Evidence already suggests the stolen data is possibly being used as an attack platform for new forays, and if that personal info ever gets into the wild, government employees will likely begin to experience a marked increase in targeted scams and identity theft dangers.

But it’s little wonder the attack was successful, given the low priority government has typically placed on cybersecurity funding. In fact, one of the most recent IG reports on OPM, from fiscal 2013, found OPM had only hired information system security officers for 17 of their 47 information systems. There were apparently plans to hire more, but the agency was prevented from doing so by budget constraints.

Good security personnel aren’t cheap, and there aren’t enough of them coming out of our colleges and trade schools. But the fact is, even if OPM was fully staffed, having a lone cybersecurity officer watching over a program or system probably wouldn’t have done much good. They need tools too, and normally these are even more expensive than the personnel.

There are a lot of defensive tools available, including intrusion prevention systems, intrusion detection systems, firewalls and security information and event management systems. Most large organizations also have a security operations center staffed 24 hours a day.

But here’s the thing, even with all those tools, it doesn’t guarantee security anymore. You can bet that firms like JPMorgan Chase had all of the above, and they still were recently breached.

I’m becoming increasingly convinced that what is needed is a way for security officials to generate actionable intelligence, connect the dots if you will, and find out about threats even as they are still emerging. To do that, government officials would need to find and field a Threat Intelligence Platform, or TIPs. There are quite a few TIPs in this emerging market, but they can be quite expensive. However, I found one that is completely free, can be used by anyone, and is actually pretty good at generating real, actionable intelligence.

Called Soltra Edge, it was created by two nonprofit companies, the Financial Services Information Sharing and Analysis Center and the Depository Trust & Clearing Corporation to protect the financial communities they serve. It’s done a pretty good job there so far, and is now available completely free to anyone who wants to set up a TIP on a limited or even a zero budget.

I had my copy up and running in under 10 minutes. There is not a lot to the interface, but with a little work you can begin pulling in lots of free threat feeds generated by everything from private companies, individuals and even universities.

With a little more work, you can tune the TIP to get data related to emerging threats based on your network, industry or areas of interest. Soltra uses the open source Structured Threat Intelligence eXpression language machines can use to communicate threat data to one another, so feeds easily go right into your emerging pool of threat intelligence.

I don’t know if a TIP, or Soltra specifically, could have stopped the breach at OPM from happening, but it might have made security teams more aware of an emerging threat against government networks before the actual attack.

Armies don’t fight well without intelligence helping to predict the moves of their enemy, and neither do cybersecurity teams that have to go about their jobs blindfolded to potential threats. Having government deploy a TIP might be the answer, and there is little reason not to check out this excellent free one to see where this new type of defense might fit into your overall security picture.