Aliya Sternstein | Nextgov | June 21, 2016 | 0 Comments

Foreign Government Hackers Are the Gravest and Most Common Threat, Agencies Say

The gravest attacks -- and most common -- perpetrated against agency networks involved nation states, according to an audit that happened to be released amid accusations the Russian government allegedly hacked the Democratic National Committee. 

The Government Accountability Office assessment comes one year after the Office of Personnel Management disclosed the biggest known breach of government-held personal information, also allegedly a foreign job. 

OPM is one of four representative agencies scrutinized that still does not always use effective access controls, the February 2015-May 2016 audit found. The other departments studied were the Veterans Affairs, NASA and the Nuclear Regulatory Commission. 

All 18 agencies that operate high-impact systems vital to society cited nation-state attacks as the most serious threat. All but three departments said they happened most often.

Most frequently, agencies are alerted to incidents involving spearphishing emails with malicious links or attachments, GAO says. And those attacks -- emails tailored to deceive specific employees -- were rated the most serious at 17 of the 18 agencies. 

OPM and Auditors Dispute Findings of Security Testing

In response to a draft of the report, however, OPM argued the auditors did not supply the agency with enough details to cross-check the weaknesses categorized as "boundary protection" and "authorization” vulnerabilities.

The agency also contended GAO did not fully describe the nature of the security weaknesses until a week before a response to the draft was due May 2.

"However, we do not believe this is an accurate characterization of the situation," Gregory C. Wilshusen, GAO director for information security issues, and GAO Chief Technologist Nabajyoti Barkakati said in their final audit, issued on Tuesday.

It was all the way back on March 9 that the auditors briefed OPM on technical findings, the GAO officials said. A week later, OPM asked to see underlying materials that supported the findings.

“That same day, we informed agency personnel that they already had all of these materials, as they had provided them to us," Wilshusen and Barkakati said.

On Tuesday afternoon, OPM officials also disputed the final audit report.

“While OPM and GAO are in agreement on most of their recommendations, we continue to disagree with GAO’s security control assessments recommendation as written because it does not address the issues identified within the technical assessment, and suggests another cause for which no analysis was conducted and/or provided to OPM for review,” OPM spokesman Sam Schumach told Nextgov in an email.

On June 4, 2015, OPM officials announced the first wave of coordinated intrusions into employee background check systems that ultimately claimed at least 21.5 million individuals’ records. The Chinese government is widely believed to have orchestrated the hack.

Email the Most Frequent Avenue of Attack

The most severe and most frequent avenues of attack against high-impact systems were through email, the web, or an employee's improper use of technology, GAO says.

Governmentwide, there were 500 incidents in fiscal 2014 that involved the installation of malicious code at agencies holding information that could cause catastrophic harm to individuals or the nation if lost, GAO said.

At the four agencies GAO selected for testing, the departments hadn’t always installed effective system login restrictions or patched software flaws that could allow hackers inside.

Nor did they always have contingency plans in place to make sure the high-impact systems remained accessible, as well as maintained confidentiality and data integrity, the audit found.

"Until the selected agencies address weaknesses in access and other controls," the GAO officials said, "the sensitive data maintained on selected systems will be at increased risk of unauthorized access, modification and disclosure, and the systems at risk of disruption." 

Each of the chosen agencies has been hacked by suspected nation-states in recent years. 

One incident at NRC involved spearphishing emails sent to about 215 employees in a logon-credential harvesting attempt, according to an inspector general report Nextgov obtained through an open-records request. The messages baited personnel by asking them to verify their user accounts through clicking a link.

The link they clicked took victims to "a cloud-based Google spreadsheet." Investigators tracked the person who set up the spreadsheet to an unnamed foreign country.

Adversaries operating from a Chinese-based IP address in 2011 gained access to key systems of NASA’s Jet Propulsion Laboratory and high-level user accounts. "In other words," the space agency’s inspector general said at the time, "the attackers had full functional control over these networks."   

In 2013, a lawmaker said foreign actors had repeatedly compromised an unencrypted database maintained by VA containing personally identifiable information on roughly 20 million veterans. At the time, Rep. Michael Coffman, R-Colo., said China and possibly Russia were responsible for the hacking.


Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.