Thwarting the threat actors: What government can do

Few things have become as stealthy, pervasive and damaging in our society as cyberattacks. The effects can be devastating as criminals go undetected for months or years while they pilfer an organization’s data.

We may look back on 2015 as the year of government attacks. An intrusion on the IRS, exposed the tax returns of more than 300,000 people; hackers nabbed thousands of federal employees’ personal data from the U.S. Census Bureau -- and then made the information freely available on the web. Most damaging of all, 22.5 million government employees and their families had information stolen from the Office of Personnel Management and the Department of Defense.

The Government Accountability Office reported that federal agencies experienced 67,168 cybersecurity attacks involving personally identifiable information in fiscal year 2014, an increase of 1,121 percent since 2006. Add to this the fact that every state government experienced attempted or successful cyber invasions last year, and it’s clear that hackers have government agencies in their sights. It’s no wonder National Intelligence Director James Clapper said cyberattacks are the greatest threat to government.

Who’s behind the ambushes on government?

Attacks on government come in a variety of forms, including spamming emails, viruses, external probes to a network and distributed denial-of-service attacks designed to take the targeted website offline. They originate from a variety of threat actors, the people or organizations responsible for launching cyberattacks. The three most common threat actors are:

Commodity, or sport, threat actors, who typically operate alone, launching broad-based attacks in an attempt to hit as many targets as possible. They may initiate attacks to check their personal hacking skills, sometimes as a way to impress other hackers or prepare for a more complex onslaught against a designated target. While commodity threat actors should be taken seriously, the more sophisticated attacks on government tend to be carried out by the next two categories of threat actors. 

Hacktivists, who use attacks to advance political or social agendas or to express displeasure with government policies. One of the better-known hacktivist groups, Anonymous, has launched repeated assaults on federal and state government agencies over the years. For example, Anonymous claimed responsibility for the Census Bureau breach mentioned above and said it struck because of its opposition to the Transatlantic Trade and Investment Partnership and Trans-Pacific Partnership trade negotiations. Many other hacktivist collectives, while not as well known as Anonymous, also regularly focus their efforts on government agencies.

Nation-state threat actors, who are typically sponsored by hostile foreign governments and unleash highly targeted attacks as a means of espionage to steal intellectual property, military intelligence or gain tactical advantage. For example, last year’s enormous Office of Public Management breach is widely thought to have been perpetrated by the Chinese government. Late last year, Richard Ledgett, deputy director of the National Security Agency, warned that the danger of nation-state attacks is growing and that the attacks are becoming increasingly destructive.

How should government respond to increasing threats?

It is almost impossible to quantify the risk of a breach to government agencies. Besides the threat of losing data and public trust and exposing private citizen information or intelligence secrets, costs can mount quickly if an agency is forced to redirect IT staff from other projects to deal with a breach, hire a third-party forensic company to investigate how a breach occurred and pay to have the mess cleaned up.

While there are no steps that can be taken to guarantee data will be 100 percent secure, agencies can take steps to make it as difficult as possible for hackers to gain access to services and systems. No single security technology or set of policies will protect against every threat, but the five strategies below will help strengthen a government agency’s cybersecurity posture.

1. Store data in multiple data centers to limit the information a threat actor would be able to access in any single successful attack.

2. Maintain always-on system monitoring to increase the chance of quickly detecting an attempted attack.

3. Protect the “gold mine.” Ultimately, hackers are after data, which should be stored in an encrypted format so attackers can’t use the data even if they get it.

4. Have both internal and externals team at the ready. Third-party providers -- perhaps the same ones already charged with monitoring the network -- can work with an agency’s IT staff to respond immediately to a cyber invasion.

5. Learn from an attack. After an incursion is contained and mitigated, investigate where the agency’s weaknesses were and implement technologies and processes that will prevent those vulnerabilities from being exploited in the future.

The number of attempted and successful cyber strikes on government agencies has risen every year, and the trend will continue in 2016. While it is virtually impossible to know when cybercriminals will attack, taking certain preventative actions before an attack can certainly reduce the risk of damage.