Following attack, intruders still cooling in State Department network
Connecting state and local government leaders
Four months after a breach and takedown of its unclassified email networks, the State Department has not been able to rid its network of hackers.
The State Department has not been able to oust hackers from its unclassified email system three months after the agency confirmed an infiltration of its network, according to recent news reports.
The department said it had locked down the email network after a cyberattack in October. At the time, the department said it “detected an “activity of concern” in its unclassified email systems. In addressing the October attack, State said that among other measures it conducted a security upgrade to its main unclassified networks.
However, there remain signs of unauthorized activity on the email network, according to Feb. 20 reports by the Wall Street Journal and NextGov.
Working with the National Security Agency and commercial contractors, the department had scanned and locked down pieces of the network. Yet signs of unauthorized of activity persist, according to the reports, including instances when intruders have circumvented or responded to security obstacles placed in their path, the Wall Street Journal reported.
In cleaning up after the October attack, the State Department replaced about 30,000 digital log-in “fobs” used to access department systems remotely, Next.gov reported.
The department also required all users to create new password and PIN numbers using new formats to make them more secure, according to the report, which also noted that over half the credentials were “soft tokens” used as a second layer of authentication.
The decision to switch out the passcodes and two-step credentials was based on “sound cybersecurity best practices,” a State Department official told NextGov.
Cleaning up after a significant cyber attack is no small undertaking. “Restoring trust after a data breach can be really frustrating because it feels like a game of whack-a-mole. As you clean up one system, it gets re-infected by another,” said Dwayne Melancon, CTO of Tripwire, an IT security and compliance firm.
“Even worse, if an attacker gains a foothold inside of your network they can wait until your attention has shifted to other things before infecting a new machine, making it much easier for them to move around in your infrastructure,” he said.
Melancon recommended steps be taken, including establishment of “a known and trusted set of standards and configurations that you can evaluate all of your infrastructure against.” Network segmentation can also help, he said, because it minimizes the chance of a single infected machine compromising the entire network.
Investigators contacted by the Journal said they believe the network was compromised in a phishing attack, a method used to trick a user into clicking a insecure email link. In doing so, malicious software entered the network, providing access to thousands of computers and sub-networks.
The size of the State Department has made the cleanup challenging, according to the Journal report, citing sources who said taking down the department’s network even a couple of days is not easy. It is still not clear what parts of the network is free from intruders, they said.
The State Department adopted a posture of confidence on Friday. “We deal successfully with thousands of attacks every day,” State Department spokeswoman Marie Harf said in a written statement. “We take any possible cyber intrusion very serious … and we deal with them in conjunction with other relevant government agencies.”
NEXT STORY: ORNL licenses malware detection technology