Case Study U.S. Office of Personnel Management Data Breach: No Routine Hack The U.S. Office of Personnel Management (OPM) is responsible for recruit

Case Study U.S. Office of Personnel Management Data Breach: No Routine Hack

The U.S. Office of Personnel Management (OPM) is responsible for recruiting and retaining a world-class workforce to serve the American people and is also responsible for background investigations on

prospective employees and security clearances. In June 2015, the OPM announced that it had been the target of a data breach targeting the records of as many as 4 million people. In the following months, the

number of stolen records was upped to 21.5 million. This was no routine hack. It is the greatest theft of sensitive personnel data in history.

Information targeted in the breach included personally identifiable information such as social security numbers as well as names, dates and places of birth, and addresses. Also stolen was detailed security

clearance–related background information. This included records of people who had undergone background checks but who were not necessarily current or former government employees.

The data breach is believed to have begun in March 2014 and perhaps earlier, but it was not noticed by the

OPM until April 2015, and it is unclear how it was actually discovered. The intrusion occurred before OPM had finished implementing new security procedures that restricted remote access for network administrators

and reviewed all Internet connections to the outside world.

U.S. government officials suspect that the breach was the work of Chinese hackers, although there is no

proof that it was actually sponsored by the Chinese government. Chinese officials have denied involvement. The attackers had stolen user credentials from contractor KeyPoint Government Solutions to access OPM

networks, most likely through social engineering. The hackers then planted malware, which installed itself within OPM’s network and established a backdoor for plundering data. From there, attackers escalated their

privileges to gain access to a wide range of OPM systems.

The hackers’ biggest prize was probably more than 20 years of background check data on the highly

sensitive 127-page Standard Forms SF-86 Questionnaire for National Security Positions. SF-86 forms contain information about family members, college roommates, foreign contacts, and psychological

information. OPM information related to the background investigations of current, former, and prospective federal government employees, including U.S. military personnel, and those for whom a federal background

investigation was conducted, may have been extracted. Government officials say that the exposure of security clearance information could pose a problem for years.

The Central Intelligence Agency (CIA) does not use the OPM system, and its records were protected during the breach. However, intelligence and congressional officials worried that the hackers or Chinese

intelligence operatives could still use the detailed OPM information they did obtain to identify U.S. spies by process of elimination. If they combined the stolen data with other information gathered over time, they could

use big data analytics to identify operatives.

The potential exposure of U.S. intelligence officers could prevent many of them from ever being posted

abroad again. Adm. Michael S. Rogers, director of the National Security Agency, suggested that the personnel data could also be used to develop “spear phishing” attacks on government officials. In such

attacks, victims are duped into clicking on what appear to be emails from people they know, allowing

malware into their computer networks.

The stolen data also included 5.6 million sets of fingerprints. According to biometrics expert Ramesh Kesanupalli, this could compromise secret agents because they could be identified by their fingerprints even

if their names had been changed.

The OPM had been warned multiple times of security vulnerabilities and failings. A March 2015 OPM Office

of the Inspector General semiannual report to Congress mentioned persistent deficiencies in OPM’s information system security program, including incomplete security authorization packages, weaknesses in

testing information security controls, and inaccurate plans of action and milestones.

Security experts have stated that the biggest problem with the breach was not OPM’s failure to prevent

remote break-ins but the absence of mechanisms to detect outside intrusion and inadequate encryption of sensitive data. Assistant Secretary for Cybersecurity and Communications Andy Ozment pointed out that if

someone has the credentials of a user on the network, then he or she can access data even if they are encrypted, so encryption in this instance would not have protected the OPM data.

OPM was saddled with outdated technology and weak management. A DHS Federal Information Security Management Act (FISMA) Audit for fiscal year 2014 and audit of the Office of the Inspector General found

serious flaws in OPM’s network and the way it was managed. OPM did not maintain an inventory of systems and baseline configurations, with 11 servers operating without valid authorization. The auditors could not

independently verify OPM’s monthly automated vulnerability scanning program for all servers. There was no senior information security specialist or chief information security officer (CISO) responsible for network

security. OPM lacked an effective multifactor authentication strategy and had poor management of user rights, inadequate monitoring of multiple systems, many unpatched computers, and a decentralized and

ineffective cybersecurity function. Sensitive data were unencrypted and stored in old database systems that were vulnerable. What’s more, OPM used contractors in China to manage some of its databases. These

deficiencies had been pointed out to OPM over and over again since a FISMA audit in 2007. OPM had the vulnerabilities, no security-oriented leadership, and a skillful and motivated adversary.

Some security experts see OPM’s vulnerabilities as a sign of the times, a reflection of large volumes of data, contemporary network complexity, weak organizational and cultural practices, and a legacy of outdated and

poorly written software. As Thomas Bayer, CIO at Standard & Poor’s Ratings, explained, until you have a serious data breach like the OPM hack, everyone invests in other things. It’s only when a massive data

breach occurs that organizations focus on their infrastructure. The expertise and technology for halting or slowing down cyberattacks such as that on OPM are not a mystery, and many companies and some

government organizations are effectively defending themselves against most of the risks they face.

OPM lacked leadership and accountability. The prevailing mentality was for everyone to sit and bide their

time. The CEO, CIO, and CISO in a private organization would be held accountable by the board of directors.

OPM is a top-heavy organization, with a large management layer of senior advisers to the director. For

example, CIO Donna Seymour has 28 staff members under her and four direct reporting organizations, none of which is security-focused. There is no listed CISO function. OPM’s director has 62 senior leaders in four

groups. Many OPM managers are politically appointed and lack the expertise to make informed decisions about cybersecurity. It’s only when managers in an organization understand and appreciate information

security risks that they will authorize their IT department to develop an effective set of controls.

Most directors in the U.S. government do not have people in their organizations with the expertise and power to make changes, and many staff members are just not right for the job. OPM director Katherine

Archuleta had formerly been the National Political Director for Barak Obama’s 2012 presidential reelection campaign. CIO Donna Seymour, who was supposed to advise Archuleta on how to manage risk in IT

systems, was a career government employee for more than 34 years. She had some IT and management roles at the Department of Defense and other agencies and has a degree in computer science but no

specific expertise in cybersecurity. It is also difficult to bring in experienced managers from the business world because federal government pay scales are so low. A chief information officer (CIO) or chief

information security officer (CISO) in the federal government would probably be paid about $168,000 annually, whereas an equivalent position in the private sector would probably have annual compensation of

$400,000.

Since the OPM break-in, there has been a massive effort to rectify years of poor IT management. OPM is

moving toward more centralized management of security. Information system security officers (ISSOs) report directly to a CISO. These positions are filled by individuals with professional security backgrounds. OPM

hired a cybersecurity advisor, Clifton Triplett, and increased its IT modernization budget from $31 million to $87 million, with another $21 million scheduled for 2016.

OPM told current and former federal employees they could have free credit monitoring for 18 months to make sure their identities had not been stolen, but it has been slapped with numerous lawsuits from victims.

Seymour faces a lawsuit for her role in failing to protect millions of personal employee data files, and Archuleta had to resign.

The FBI and Department of Homeland Security released a “cyber alert” memo describing lessons learned from the OPM hack. The memo lists generally recommended security practices for OPM to adopt, including

encrypting data, activating a personal firewall at agency workstations, monitoring users’ online habits, and blocking potentially malicious sites. The Obama administration ordered a 30-day Cybersecurity Sprint across

all agencies to try to fix the big problems. Without a strong foundation, this investment could prove futile in the long run. OPM and the federal government as a whole need to invest more in managers with IT security

expertise and give those individuals real authority to act.

What about other federal agencies storing sensitive information? The news is not good. An audit issued

before the Chinese attacks pointed to lax security at the Internal Revenue Service, the Nuclear Regulatory Commission, the Energy Department, the Securities and Exchange Commission, and even the Department

of Homeland Security, which is responsible for securing the nation’s critical networks and infrastructure. Computer security failure remains across agencies even though the U.S. government has spent at least $65

billion on security since 2006.

Sources: Sean Lyngaas, “What DHS and the FBI Learned from the OPM Breach,” FCW, January 11, 2016; Brendan L. Koerner, “Inside the Cyberattack that Shocked

the U.S. Government,” Wired, October 23, 2016; Michael Adams, “Why the OPM Hack Is Worse Than You Imagined,” Lawfare, March 11, 2016; Adam Rice, “Warnings,

Neglect and a Massive OPM Breach,” SearchSecurity.com, accessed June 15, 2016; Steve Rosenbush, “The Morning Download: Outdated Tech Infrastructure Led to

Massive OPM Breach,” Wall Street Journal, July 10, 2015; Mark Mazzette and David E. Sanger, “U.S. Fears Data Stolen by Chinese Hacker Could Identify Spies,” New

York Times, July 24, 2015; Damian Paletta and Danny Yadron, “OPM Ratches Up Estimate of Hack’s Scope” Wall Street Journal, July 9, 2015; and David E. Sanger,

Nicole Perlroth, and Michael D. Shear, “Attack Gave Chinese Hackers Privileged Access to U.S. Systems,” New York Times, June 20, 2015.

Case Study Questions

MyLab MIS

Go to the Assignments section of MyLab MIS to complete these writing exercises.

8-13 List and describe the security and control weaknesses at OPM that are discussed in this case.

8-14 What people, organization, and technology factors contributed to these problems? How much was management responsible?

8-15 What was the impact of the OPM hack? 8-16 Is there a solution to this problem? Explain your answer.

8-17 Describe three spoofing tactics employed in identity theft by using information systems. 8-18 Describe four reasons mobile devices used in business are difficult to secure.