Public sector competence and the sighting of unicorns

Following the hacking story from the US is beyond incredible. I mean really, who would have thought that the IRS story, sickening and disgusting as it is, could be superseded. Hackers (i.e. the Chinese) have the records of every single American public service employee, right down to their applications to work in the foreign service, where they are asked to list any possible issues in their lives that others could use to blackmail them. But who has to hack when they are building the system themselves. Here’s the latest: Encryption “would not have helped” at OPM, says DHS official

But even if the systems had been encrypted, it likely wouldn’t have mattered. Department of Homeland Security Assistant Secretary for Cybersecurity Dr. Andy Ozment testified that encryption would “not have helped in this case” because the attackers had gained valid user credentials to the systems that they attacked—likely through social engineering. And because of the lack of multifactor authentication on these systems, the attackers would have been able to use those credentials at will to access systems from within and potentially even from outside the network. . . .

Some of the contractors that have helped OPM with managing internal data have had security issues of their own—including potentially giving foreign governments direct access to data long before the recent reported breaches. A consultant who did some work with a company contracted by OPM to manage personnel records for a number of agencies told Ars that he found the Unix systems administrator for the project “was in Argentina and his co-worker was physically located in the [People’s Republic of China]. Both had direct access to every row of data in every database: they were root. Another team that worked with these databases had at its head two team members with PRC passports. I know that because I challenged them personally and revoked their privileges. From my perspective, OPM compromised this information more than three years ago and my take on the current breach is ‘so what’s new?'”

They’re incompetent, you can’t trust them and they are socialists. What’s left to go wrong from here?

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.