Encryption "would not have helped" at OPM, says DHS official
http://arstechnica.com/security/2015/06/encryption-would-not-have-helped-at-opm-says-dhs-official/
But even if the systems had been encrypted, it would have likely not
mattered. Department of Homeland Security Assistant Secretary for
Cybersecurity Dr. Andy Ozment testified that encryption would "not
have helped in this case" because the attackers had gained valid user
credentials to the systems that they attacked--likely through social
engineering. And because of the lack of multifactor authentication on
these systems, the attackers would have been able to use those
credentials at will to access systems from within and potentially even
from outside the network.
- - -
NO 2-FACTOR CREDENTIALS. Pretty much criminal negligence at
this point.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
