*"Hmm. Got a personal Christmas card from the President of the United States here. Maybe I should ignore that for cogent security reasons."
via SANS
TOP OF THE NEWS
–State Department System That Held Leaked Cables Lacked Certain
Security Features (((among the millions available)))
(December 31, 2010)
The State Department computer system from which diplomatic cables were
obtained and released by WikiLeaks did not have the capability to detect
unauthorized downloading by employees or by others. The system, called
Net-Centric Diplomacy, grew out of the need for rapid information
sharing between government agencies after the September 11, 2001
attacks. Net-Centric Diplomacy was tied into the DoD's Secret Internet
Protocol Router Network (SIPRnet), so the information the system
contained could be accessible to nearly half a million government
employees and contractors with the appropriate clearances. Following
the leak of the cables, the State Department suspended outside access
to Net-Centric Diplomacy.
http://www.washingtonpost.com/wp-dyn/content/article/2010/12/30/AR2010123004962_pf.html
[Editor's Note (Schultz): When it comes to information sharing within
the U.S. government (or anywhere else, really), it's "damned if you do,
damned if you don't." Limited sharing produces fewer unauthorized data
links, but also increases the probability that those who genuinely need
information will not get it. On the other hand, making information more
freely available increases the likelihood that those who really need it
will get it, but also raises the probability that information will fall
into the wrong hands.
(Paller): Data leakage protection (DLP) is one of the key requirements
defined in the 20 Critical Controls. Although State had not yet
implemented DLP monitoring, it was far ahead of most other federal
agencies in the other critical controls. This experience emphasizes why
agencies MUST shift from C&A to continuous monitoring and to do so
comprehensively and quickly.]
(((Yeah, like all half-million of those guys are never gonna fall for spearphishing
or lose a laptop.)))
THE REST OF THE WEEK'S NEWS
–"White House" eCard Carries Malware
(January 3, 2011)
An email Christmas card that appeared to come from The White House
actually contained malware that succeeded in stealing sensitive
documents from recipients, some of whom are government employees and
contractors working on cyber security issues. (((Oh really.))) The malicious ecard
offered links that infected users' computers with a variant of the ZeuS
malware. This version steals information and sends it back to a server
that appears to be in Belarus. (((Who is sitting on top of that stolen
leakfare right now, one wonders idly.)))
http://krebsonsecurity.com/2011/01/white-house-ecard-dupes-dot-gov-geeks/
