The recent cyber attacks on the US government raises many eyebrows. Government agencies around the world may be wondering how this information was extracted and what kind of threats may be directed their way.
A report by ‘Recorded Future’ shows that the login credentials of up to 47 US government agencies were found. This sensitive information was accessible online at Pastebin and other paste sites. A paste site is a source for hackers to dump data in plain text form. Some of these paste sites attempt to monitor their content, but far and wide, many do not. In this report it was found that 12 of these agencies had computer networks without a form of two-factor authentication.
Recorded Future advises agencies to implement two login components. Social engineering and phishing attackers can tap into this weakness and penetrate networks.
"It isn't that these agencies don't know what to do, it is just that they aren't implementing the changes," said Scott Donnelly, a senior analyst at Recorded Future.
Recorded Future probed 60,000 open web sources, focusing on ‘hard to navigate’ paste sites, to find this data.The analysis covered data that was retrieved from Nov 3,2013 to Nov 3, 2014. It is worth noting this as Recorded Future“focused on a small subset of our open Web data which suggests a much larger level of exposure than is currently identifiable.”
What can be learned from this attack is that as a target, governments must have ample security and surveillance to monitor threats. By not installing measures to heighten network safety leaves agencies vulnerable to cyberattackers. It is suggested that government agencies invest in:
● multi-factor authentication,
● defining use of government email address on third-party websites,
● federal and local cybersecurity teams,
● install a uniform template to combat intruders
● and evaluate which solutions are best for each agency scenario.
Making effective changes in the cybersecurity infrastructure of your agency will make a great difference.
