I hope this talk will end up being like some sort of a rampage of some sort.
And so the next, seriously, I hope this next talk will go, I mean, well, I guess, I mean, the title could not be more blunt.
Like, what the hell happened? Ron Taylor.
Thanks, Ming.
Yeah, so I want to set the expectations really low.
I've gotten about 12 hours of sleep over the last three days, like most of you.
So who am I?
My name is Ron Taylor.
I've been in security for about 20 years on the offensive and defensive side, doing a little bit of everything.
You can find me on Twitter under Gus Gorman.
Does anyone know where that name Gus Gorman comes from?
Come on.
It's like one of the earliest hackers in movies.
Richard Pryor played the character.
Superman.
Yep, that's right.
So that's where it comes from.
You can also find me on MySpace.
You guys don't use MySpace?
It's coming back.
I'm telling you right now.
I've...
So I say that...
I've been a hacker for 39 years because my mom says I've been breaking shit since I was born.
That's probably right.
Actually, I got to update that.
Unfortunately, in a couple weeks, I turned 40.
Sad face.
I'm a member of the Packet Hacking Village.
Like Ming said, we do a lot of work here to be ready for the talks, the challenges and everything.
And we appreciate you guys coming out and making it successful.
I also run a B2B.
I run a B-Sides conference in Raleigh.
So if anyone's in that general area, reach out to me.
We'd love to have you come or speak there.
So what we're here for.
First of all, I need to give you a disclaimer.
So I first want to start out by saying that in no way am I bashing the boots-on-the-ground people involved with OPM.
We all know that when it comes to information security,
even if you want to do the right thing, a lot of times it's not possible,
whether it's financial reasons or political reasons.
But we've all been in a situation where we've been financially or politically hindered from doing the right thing.
So if anyone's ever worked for OPM or does work for OPM, please don't take offense to this.
We all know that it's likely someone above your pay grade made the decision.
So it led to this catastrophe.
It's a really long week.
So first of all, who is OPM?
OPM is the Office of Personnel Management.
They are the human resources division for the civilian agencies in the federal government.
They do a few other things.
In 2005, they took the responsibility on to do backstabbing.
They did background checks for the Department of Defense.
Well, they took it from the Department of Defense Security Service before that's DSS was who was doing it, right?
So, you know, that data is kind of key because you'll see while we go through this,
there's a lot of, you know, things that happened during that time frame.
So what was lost in the breach?
A lot.
Twenty-five point, twenty-one point five million SF-86 forms.
Twenty-one point five million SF-86 forms.
Okay.
So what is an SF-86 form?
Has anyone here filled out an SF-86 form?
Yeah.
If you've ever tried to work for the government,
if you've ever just filled out an application, didn't even get the job,
that's in their database, okay?
That was lost.
It has a lot of information in there,
information about your family members, friends,
psychological information, I'll show you in the next slide a little bit more about that,
but aside from that, four point two million personnel files containing information,
essentially, you know, all of your personal information about your military records,
things like that, and on top of it, five point six million sets of fingerprints.
So why is that bad?
You can't change them.
You can't change them.
You can't change that, right?
Yeah, you lose a username and password, you can change that.
You can't change your fingerprints.
So now, five point six million people,
their fingerprint data is essentially compromised, right?
So, you know, when we talk about the next generation of authentication,
how can we really trust biometrics or fingerprints or biometrics?
Can't.
So that's a big problem.
Note on the bottom here, I don't know if you can see that, but,
the CIA, actually, does not use OPM for their data breaches or for their data breaches,
yeah, I'm sure, of course they don't.
For their background investigations.
So it's interesting, but, you know, one of the articles that I read kind of pointed out
something interesting that the fact that they didn't, you know, if someone, whoever
has this data could essentially discern from that information, you know, if this person
and is not in the database that I just stole,
then that may mean they work for the CIA.
So there was a report that right after the breach,
a lot of the CIA folks were pulled out of places like China.
Do you have a question?
Yeah, it's interesting.
So a little bit more about the SF-86.
Shoot, you can't see that red very well.
So to get a security clearance, you have to fill out an SF-86 form.
I think the key things, there's a lot of information on here,
and it's not meant to really go through all of it,
but I think the key things is the investigations,
they're designed to identify the type of information
that could be used to coerce someone.
To find out, is there a way that I can coerce them
into betraying my country?
That's what the SF-86 is for.
And it also asks individuals to turn over the most personal data,
details about their life.
So you can kind of understand how this information,
just start thinking about how this information,
might be used against you, right?
These are just some things out of the report,
which we'll talk about,
but some quotes from, so James Comey,
he's someone who is fairly well known now,
but he said the SF-86 lists every place he's ever lived
since he was 18.
His family members, siblings, all their information, of course.
So it's,
it's not just that individual person who filled out the SF-86,
it's all their friends and family members
that are affected by it as well.
So, bad news.
So here's where we're going to start kind
of drawing other assertions about how this data is being used.
So around the same time, there were a few other breaches
that happened, large data breaches.
So first of all, USIS, it was an OPM contract,
it was an OPM contract.
It was an OPM contractor that was actually doing
background investigation stuff for OPM.
They were breached in 2014, lost a ton of information.
In December 2014, the other OPM contractor that they used
was also breached, okay?
So, you know, there should have been some sort of indication
that OPM was a target around this time, right?
All right.
Anthem.
Anthem, Primera, Empire, these are all other breaches
that happened, and these same companies,
they provide services for the government, right?
So more information they're pulling together.
Of course, Ashley Madison.
Who was affected by the Ashley Madison breach?
Anyone?
I know you were, Greg.
I know that guy was right there.
Well, this is, it's important, and I'll tell you why in a second.
And then, of course, between 2012 and 2015,
that time frame, the OPM breach happened.
So if you look at this, this was from, I think,
the Washington Post.
I should have, you know, looked into it more.
But anyway, the person in the article kind of made this
assertion that what they're doing is they're taking
all these data breaches, and they're pulling all the information
out of them.
So they can correlate between them and say, hey,
this person over here matches this person in this data breach
that I found.
How can we use that information against them, right?
So if they, the SF-86 form says this person has, you know,
a wife and three kids and lives, you know, wherever.
This is his wife's information.
And then he goes over to the Ashley Madison database
and finds that same guy's information.
He can coerce him basically by saying, hey,
I'm going to tell your wife you're cheating on her, right?
I mean, that's just one example of how this information
can be used.
But what they're doing is they're essentially building
a dossier about each person in those databases, right?
All that information is pulled into a database.
And that database likely will be used in some way.
Now, we'll talk a little bit more about whether it's being used
and if we have any clues of how it's being used.
But you can get an idea based on the different information
that's been stolen, what's out there, right?
So let's talk about the report.
The majority of the information,
the information that's here that I'm gonna talk about
is based on this report.
It's all open information, public information.
I don't have any insider information at all.
But I think it's really interesting.
I started talking to a lot of folks about,
who had been affected by it, and they really didn't,
you know, we talked about this report.
They really had no idea the impact of it.
So that's kinda how this, you know,
this topic is being brought up.
talk came about was they didn't realize how bad, you know, OPM screwed up. And then that's
kind of what we're going to talk about. So actually let me back up. So the report came
out in December of 2016, right? So just last year. And it was done by the House Oversight
Committee. This is the same group who investigated like Benghazi and things like that, okay? So
they took, I think, three years, two and a half years to go through and investigate everything
that happened and to determine, you know, kind of a timeline. So that's what we're going to talk
about first is that timeline. Now, when we talk about the timeline here, I don't want you to
think, you know, that they actually, this is when they found out the information. Most of what
they found out was that it was a mistake. It was a mistake. It was a mistake. It was a
mistake. It was a mistake. And I think that's what they thought it was after the report, after
they did an investigation, okay? Because they really, they weren't monitoring anything. So
first of all, the warnings were there, okay? The warnings were there before the breach. First
of all, since early on, I think 2007 was probably the first time when they were really talking
about APTs. And, you know, the government was warning agencies, hey, there's these threats out
there. You need to be careful. You need to be careful. You need to be careful. You need to
concerned about right but going back to 2005 the inspector general who's you
know internal to OPM inspector general was was was telling them hey you are you
have you know really bad security posture you're not doing two-factor
authentication you know things like that and over and over again over the years
you can see from 2005 to 2007 and then in 2008 2009 2010 they continued to raise
that alert level saying hey you really need to do something here okay they
ignored it and that's what we're going to talk about is exactly you know what
happened so this all works out hey animations but this was a fun one to do
so
2000 July
2012 so this is with first known adversary access to the network now they
didn't find it in 2012 of course they didn't realize this until they did
forensics and I think that the you know they actually found a piece of malware
that they tied it tied them back to 2012 that's how they figured out that you
know that was likely when they first got in
between November in December 2013 I don't know the specific mm-hmm specific
information they likely have found some sort of log or timestamp on on on
TUbal where the indicated that they were moving around the network right so
that for timeframes was where they realized
someone is actually in their network know again they didn't realize that at
that time.
They, you know wanted the FBI but they, you know, not their you know, own literally anything that's equal.
This is from the investigation.
March 2014, the U.S. CERT notifies OPM and says, hey, your data is out there on the Internet.
So someone is exfilling data from your network.
So at that point, OPM actually did start to monitor their network, right?
And they identified Adversary 1.
In the report, I think they call it something else, but Adversary 1.
That was the first.
That's when they started monitoring them, okay?
At the same time, while they're monitoring them, like, literally, they're watching them exfiltrate data.
But they're like, well, that's not information.
It's not really important information.
They were monitoring them to see how close they got to, like, the background databases, okay?
But they said, okay, that's not that.
That's not that big of a deal.
And they were coming up with a plan to, you know, kill them, you know, get them out of their network.
But at the same time, they did exfiltrate some data.
What that data was was essentially the blueprints to their network.
It had network diagrams, usernames, passwords, things like that, right?
It was all the information that they needed to continue their attack, right?
I mean, just keep in mind, this attack happened over a minute.
It happened over many years.
And that's usually how, you know, APT-type attacks work, right?
I mean, they get in.
They start moving around.
They escalate privileges.
They try to save stealth, exfiltrate data when they can.
Just try not to get caught.
So now they have enough information to continue moving through the network.
They know where the crown jewels are.
They just need to get there.
So.
So around that same time, May 2014, a second adversary, which likely is connected.
We'll talk about that later.
Can you guys hear me okay?
Like, I feel like this mic is like, okay, good.
Do I even need the mic?
It's on a better day.
This is better.
No, when you're up close.
Okay, you need the mic?
Yeah.
Okay.
Okay.
I'll try.
I hate holding mics.
So anyway, around that time, they gained another foothold.
Okay.
Now, remember, the contractors had been already breached at this point.
Okay.
What OPM was doing was to give their contractors access to the network.
They were giving them a username and password to VPN in, connecting to their network.
Well, likely, what Adversary 2 did was use that information to access the OPM network,
which they later.
Figured out that it was, oh, sorry, let me back up.
So they gained a foothold, got into the network.
So now at this point, if they kick out the other guy, it's okay because they have another foothold.
And the other point about this foothold is that they look like a normal user.
Okay.
They're logging in from, you know, using credentials of a contractor.
So that's bad.
Okay.
What would have fixed that?
Two-factor authentication, maybe?
Well, they weren't doing that.
Their master plan to mitigate this issue with Adversary 1 was called the Big Bang.
Okay.
And when they noticed the Adversary 1 getting closer to the crown jewels,
then they executed this plan and, you know, kicked them off the network.
But as we know, it doesn't really matter.
It doesn't really matter because they already had other footholds.
And they weren't monitoring those.
So between June and August of 2014, Adversary 2 starts moving throughout the network.
Okay.
It gets to the point where he's found the investigation data and starts exfiltrating that out of our network,
out of their network.
Okay.
Okay.
And so at that point, the data was out there, okay?
And OPM has to come out and say, okay, we acknowledge that there was a breach.
Actually, it was more, like it says here in response to press reports,
because people found out, hey, I think OPM has a breach.
They didn't want to talk about it, but eventually they had to kind of own up to it.
But they didn't really say, oh, yeah,
we lost background data.
Matter of fact, what they did was they said, oh, it's just some old manuals.
It wasn't, you know, really important information, so don't worry about it.
Okay.
Is that because they didn't know?
They only thought that the network diagrams and the manuals were the only things stolen at that point?
They were eager to the fact that Adversary 2 had actually exfiltrated that data?
Yeah.
It's still kind of unclear as to exactly what they knew.
But, yeah, most likely they knew that.
I mean, after the investigation, which we'll talk about a little bit more.
And here's the thing.
I should have put this in my disclaimer.
There's a lot of political aspects to this situation.
I'm not going to get into that stuff.
I think it's worth you guys reading the report.
It's only 240-something pages, but it's a page turner.
Let me tell you, it's actually really interesting.
But that information is interesting.
I mean, it's a lot of information that's in there, too, where they kind of make, you know,
they talk about the political aspect of it and exactly why decisions were made and who lied to who and things like that.
But, anyway, I'm not going to talk about that.
Okay.
So moving forward, in December 2014, you know, they've pilfered the OPM network at this point,
got all the information they needed there,
and they finally made their way over to the...
the Department of Interior's data center,
and this is where they started exfiltrating personnel data records, okay?
That's where all that stuff was stored.
So they exfiltrate that data.
In March 2016, so, like, OPM at this point, they have no idea, right?
They thought, hey, we got this guy out, no big deal, right?
Everything's good.
They didn't...
they weren't monitoring anything.
They didn't put any extra controls in place to, you know,
to make sure that no one else is in their network.
At this point, they still think, hey, we kicked that guy out.
We know what we're doing, right?
Well, they didn't, okay?
And they continued to pilfer even more information.
They found fingerprint databases, like we said.
I mean, that's...
that's pretty serious.
In April,
April 2015, an IT contractor, essentially, stumbles upon something that might be interesting, okay?
They, you know, they weren't monitoring anything.
They didn't have the controls in place to figure out, you know, is there an insider threat?
So is there a compromised machine on my network?
They didn't really know, okay?
So they just stumbled upon it.
And the way that he stumbled upon it was there was a call out to OPM, right?
OPMsecurity.org.
Sounds legit, right?
But this guy actually, he knew.
He said, wait, we don't have that domain.
That's kind of weird.
So, you know, at that point, they start investigating it because they said, something's wrong here, you know?
And, well, at that point, you know, they had the oh, shit moment, right?
And they said, okay, we got a problem.
They're still in our network.
And they've been there for a long time.
So we need some help.
So moving forward, April 2016, at that point, they actually called in Silence.
They had been working with Silence in the past.
And they just decided, we're not going to deploy their protection tools, okay?
They could have.
And back in 2014, they were playing.
There were people who were saying, hey, we need to put this in place.
But they didn't.
Even though they knew that there were adversaries in their network, they knew that they were a target.
They didn't do it.
And like I said, whether or not that was politically motivated, it's different.
And then, of course, pretty quickly, once they realized, hey, we've got a problem.
Now we need help.
We need to get this first.
We need to get this person out of the network.
Of course, they deployed the solution, the Silence Protect, and started identifying stuff.
And I like this quote right here.
The engineer that came in from Silence, he said, literally, the tool lit up like a Christmas tree.
They found so much stuff within hours that it just lit up like a Christmas tree.
So.
Of course, I'm sure they had another oh, shit moment there, too.
And May 20th, 2015, OPM, of course, now at this point, they've determined, yeah, we've got a problem.
We've got malware all over our network.
People have owned us left and right.
I think we have to notify Congress.
Because they actually have a requirement to notify Congress when something like this happens.
Which is likely why they were downplaying it for so long.
So they notify Congress on May 27th.
OPM briefs the media.
So at this point, they come out and they say, listen, we're sorry.
We're so sorry.
We lost your data.
It's about 4.2 million records.
Of course, we know now it was a lot more than that.
Okay.
And they kind of downplay it the whole time, right?
You know, they're trying to downplay it.
And not make it seem so serious.
At this point, so USR comes in.
And, you know, they're doing their investigation as well.
And they also realize, hey, it's not just this 4.2 million, you know, records.
There's also background data investigation that was stolen.
Another oh, shit moment.
At that point, the director, who was Director Archuleta,
she says, okay, yeah, we lost the background data information, too.
So she's kind of forced to acknowledge that.
So in June, after 74 days of deployment of the Cylance Protect software,
they deployed it on 10,000-something computers.
They found 2,000 pieces of malware.
Nearly one.
One piece of malware for every five computer devices.
That's a lot of malware on a network.
And who knows how long it was there.
Right now, we know, after the investigation, the first piece they found in 2012.
You know, if you work in defense, you know, time to remediation, time to detection is key.
If you don't find it within, you know, within hours, likely they've already started taking your data.
Okay.
And gaining a better foothold.
So their network's completely rooted at this point.
It's owned.
What do they do?
Okay.
I would pull the plug.
But, you know, at this point, you know, what's the point?
But in July, OPM comes out and says, hey, yeah, we need to update that number.
It wasn't as small as we thought.
It was actually 21.5 million people compromised.
And, of course, July 10th.
Director Archuleta resigns.
Very convenient.
September 23rd, OPM updates the estimate about the fingerprints.
Because originally they said, yeah, it was like 1.1 million fingerprints.
Now they say, no, it's actually about 5 million.
But, you know, give or take a couple million.
What does it matter?
You know?
Yeah.
And then, prior to testifying before the committee, the CIO.
Donna Seymour resigns. So again that's convenient. Which delayed the investigation because now
she's not there. Anyway, I won't talk, I won't go down that rat hole. But like I said, read the
report. This is more information, interesting information there. Okay. So again from the
report, the key findings, they had, first of all, they failed to prioritize their data. In 2005
they took on all this background information investigation. They took on the responsibility of
doing the background investigation and storing it. Right? They had to secure it. That was their
responsibility. But they never changed, when they did that they never changed their security
posture. They never said, hey, we're going to do this. And they're always trying to do it.
we have really even more important information, we need to secure it better.
We need to put other mechanisms in place.
So, you know, that's a key finding there.
Multi-factor authentication.
So I think the federal government started requiring multi-factor authentication, I don't know, 2005, 2007.
If anyone, you know, is involved with, like, DISA STIGs and requirements like that, you know, it's been there for a long time, okay?
They weren't doing it, you know?
The inspector general said since 2005, hey, you've got to do this, you've got to put this in place.
They still didn't, okay?
Even after this compromise in 2015, they still hadn't done it.
I mean, come on.
Usernames and passwords get stolen.
They knew that.
They knew that they were stolen, okay?
But they still didn't put this in place.
So that's a pretty serious thing, right?
To me, it's negligence.
They didn't encrypt the database.
I mean, they've, yeah.
So that's what they said.
They said, well, and actually, if you can go on YouTube and watch the proceedings from when Congress was grilling them,
and some of it was really, really entertaining.
But they essentially said, well, our systems are too old to do encryption.
Okay.
Well, that's a problem.
We get that.
But that still doesn't mean it's okay, right?
I mean, this is information that if stolen can affect lots of lives in different ways.
So, again, another major finding that they weren't encrypting anything.
Yeah.
So, sorry.
I kind of already said this.
Legacy systems was their excuse.
So, like I said, they just didn't listen to the inspector general.
Another thing you'll find in the report is that there really wasn't a good relationship between the inspector general and the OPMCIO, right?
Which caused a lot of political issues.
And essentially, they were just ignoring everything they said.
The inspector general came in and said, hey.
You guys got to do this, this, this.
And we recommend this.
They just said, okay.
Whatever.
We'll do it.
Don't worry about it.
They had, they didn't even have an inventory of what was on their network.
Okay.
If you're in defense, you know.
If you don't know it's there, you can't defend it.
Okay.
I mean, it's key.
Visibility on your network is key.
So, they had no inventory of what was on their network.
Okay.
Big problem.
So, another key thing here, which is, you know, it's not a technical finding, but what they had found was that they looked at it and they said, OPM is only spending $7 million a year on cybersecurity.
They were actually at the lowest level of all the agencies, you know.
And I'm just thinking about, you know, one of the Staples commercials, you know, where the guy's like, hey, I just saved us all this money by shopping at Staples, right?
Just think about that one.
You know.
You know, they were probably like, hey, we only save, our budget is really low and, you know, we don't have to, we don't spend that much money.
Well, that's a problem because that just shows that they weren't putting, you know, they didn't value that data.
They didn't see the value in spending money on cybersecurity.
They were essentially the biggest target of all the agencies and they just, they didn't protect it in that way.
Two-factor authentication, that was one of the critical security controls, but there was a lot of other things.
Obviously, if they're not doing two-factor authentication, there's a lot of other things that they probably weren't doing.
So, this is an interesting thing.
If you work in government, there's a thing called authority to operate.
It's essentially kind of a sign-off where...
They say, okay, your networks, your systems are up to spec.
They meet the requirements.
You get a sign-off that says you can operate them, okay?
They didn't really care about that.
They basically were all the systems, especially the personnel investigations processing system, which is where they input all the data and everything, had no ATO, right?
They were ignoring it.
For a long time, which is, I mean, if anyone works in, you know, DOD or government, you know an ATO is really important.
So, you know, it's a big violation of it that way.
So, I thought this was a key thing.
It's hard to see here, but the fact that they had no logging.
I mean, they were really, they essentially were doing no logging on the network or the database.
There's really no way to know what documents that were stolen and what was, you know, the scope of the breach.
And another thing that they don't really point it out too much in the report, but the truth is because they don't have the logging, who's to say that they didn't modify any data, right?
And that's a whole other aspect.
They could have entered some, if it's a nation state, you know, you want to get someone implanted, you can, here's your security clearance right here, you know, you pass.
And they had no way to determine that because they weren't logging any of that information.
So, a little scary.
So, I skipped this slide.
Oh, I guess I didn't.
As far as attribution.
Oh, no.
Sorry.
Let me back up.
So, one of the indications, which, like I said, the report doesn't go too technical into exactly what the malware did and, you know, things like that.
But what they identified was that it was using, the malware they did find was using a version of HiKit A and HiKit B.
And I don't think I have a slide on it, but one of the interesting things that I found was,
I almost kind of feel like the attackers weren't that sophisticated because they were hiding it in a DLL that was, the name of it was linked to McAfee antivirus or McAfee security, whatever they call it.
And they weren't running that, right?
So, you know, OPM wasn't even running that.
So, that was kind of one of the indications, like, that, you know, that there was a malware problem because,
they found this file and they're like, wait, it's a McAfee file.
We don't run McAfee, right?
But the majority of the government and DOD does run McAfee.
I know U.S. Army, that's one of their, you know, main endpoint protection things, right?
So, it's kind of standardized.
So, anyway, they were kind of, they were guessing, but you would think that they would have done a little bit more recon to determine whether, what they were really running.
But, like I said, here's the other.
The other thing was, we talked about this a little bit more, but they were watching them take the data, okay?
But the truth is, they were never able to determine how they actually got entry.
Like I said, no logging.
So, they still don't really know how they, they know they were there.
They saw them exfiltrating data and eventually they found that they were monitoring.
But they still don't know, even after all this investigation, how they initially got in.
Likely it was a compromised machine, right?
Usually it was some sort of client-side attack over the web or email or something like that.
It's not too difficult to attack clients.
But another thing that they, you know, they realized, too, was later on they said, okay, yeah, maybe that the original data breach with the manuals and everything, maybe that really was a big problem.
So.
You know, they acknowledged later on that, yeah, that data was probably used to, the manuals and things like that, it was likely used for them to continue their attacks.
So, interesting stuff.
And, you know, because of that, they determined in the report that they likely could have stopped this.
When they initially were alerted by CERT that there was some exfiltration happening.
And when OPM came out and downplayed it and said, hey, yeah, it's not that big of a deal, it's just some old manuals.
If they had put in place protections at that point, they could have stopped it.
But instead, they downplayed it and, of course, all the rest of the data was stolen.
Which, you know, it's pretty serious.
I already talked about this one here with OPM security.
This is one of the things that I talked about a little bit.
But the silence tools were available to them as early as June 2014.
And like I said, they could have put those in place.
They could have deployed them.
But they decided not to.
Even after the big bang, they decided not to purchase.
They kind of quoted it and they evaluated it.
But they said, no, you know, we think we got the guy out.
So, we're not going to.
We're not going to buy it.
Oh, and so you see here, the CEO of Silence said that their excuse was that there were political challenges on the desktop.
So, if any of you have worked with government or in government IT, of course, you know there's a lot of, you know, segmentation.
And this group doesn't work well with this group.
And political reasons for not doing things.
Okay.
So, this is one.
Major aspect of it.
You know, once they put in the silence tools, they immediately found.
I don't work for silence.
But, you know, they should probably, you know, give me a T-shirt or something for talking about them.
But, yeah.
So, they implemented silence protect.
And it lit up like a Christmas tree.
So, as far as attribution.
Attribution is not easy.
When we hear things.
When I hear things on the news about, oh, yeah, there's attackers.
They came from Russia.
Listen, we all know that it's not easy to track things like these attacks back.
Especially if you're not doing logging and things like that.
So, I always think that that's interesting stuff.
But, what they were able to do is they essentially, they're kind of guessing, right?
But, based on the high kit malware, they said it's likely the Axiom group was the people who put that there.
Just based on the fact that it was there.
It doesn't really, they don't know that for sure.
Someone else could have been using that malware, of course.
But, they attributed back to that in the report.
And then, they also said that this other group, because they were involved with the WellPoint and Anthem breaches.
And they attributed it back to them as well.
They said likely there.
They're working together.
So, they essentially said, hey, we think these two groups were probably working together.
And, you know, there's tiebacks of those groups back to nation states.
So, that's when they start kind of saying, okay, you know, we think it might be China, you know.
So, in, I think, somewhere, 2015 time frame, the president of China was going to come over.
And he said, hey, we think these two groups were probably working together.
And he said, hey, we think these two groups were probably working together.
And, you know, they're going to visit with Obama.
And there's a little bit of tension about this, right?
Because at this point, you know, they're saying, oh, it was China.
It was China.
It was the nation.
You know, it was China's government that hacked us.
Whether or not that was true, we don't know.
But, so, there's a lot of pressure and a lot of tension.
So, China says, oh, we found them.
And we arrested them.
Don't worry.
We took care of it.
And, you know, they're saying, oh, it was China.
But the truth is, China's known for throwing people in prison for doing things that maybe
they did or didn't do. Or maybe they did something else and they said, well, let's just blame this
on them so that the U.S. is happy. So anyway, it's interesting. So the report continues. We
talked about the findings. But it goes on to make recommendations, of course, like any good
report should. I know this is like a ridiculously small or complex slide. And it's meant to be
because I honestly the stuff in the report, most of it the recommendations are political type
recommendations about CIOs and how you should hire them and make them accountable and make sure
that they're competent. So I thought I highlighted a few words, you know, in there in
this.
I thought that was interesting because they really did point a
lot of it back to, you know, the upper management, which is good
and that's why I put that disclaimer out there at the
beginning because, you know, we all know that it's, most of the
decisions are above our pay grade. But they also recommended
a zero trust model, you know. To them that was a new concept
but we know it's not. Accountability, that was a big,
that's a big piece of it, right? Which, you know, I thought it was
funny that it was in the report because, you know, there really
wasn't much accountability, which is the sad part because a
lot of people were affected by this. A lot of people are still
affected by it. I mean, if you had a clearance, had your SF-86
stolen, you know, a lot of people are looking over their
shoulders. You know, you have to travel abroad, travel to
China, you know, and you were affected, you're going to be
looking over your shoulder.
And be a little bit paranoid. And how do you fix that? You
don't. I mean, it's just, it's just out there, right? So it's,
you know, it's sad that no one was really, really held
accountable for the, what I think is the gross negligence.
But those are the recommendations that were in the
report. These are kind of my recommendations of how not to
become the next OPM.
First of all, you have to know the value of your data, okay? You
know, if you're hired into a company and, you know, your upper
management that's not in IT, in security says, yeah, we need you
to do this job, right? You know, the first thing you need to say
is, okay, well, what kind of data are you holding? What, you
know, what, you know, what information do we need to secure?
And based on that, that's how you kind of start prioritizing
things, right? Of course, you have to know the value of your
data. Of course, there's different regulations like PCI
and HIPAA and things like that. Regardless of those, you really
have to know the information that you're securing and
prioritize based on, you know, based on how that is, what
you're going to put in place and where you put those controls in
place. But regardless, you got to start with the basics. I mean,
like we said in the report, they weren't doing encryption,
okay? Encryption is not a new concept, people. It's a new
concept. You know, it's just ridiculous that they weren't
encrypting their databases at all. They likely weren't even
encrypting, I'm sure they weren't encrypting the traffic
over the network, but whatever. They just, you know, had the
keys to the front door anyway, so they went in and stole it. So
just, you know, it's information that they needed to
secure. Two-factor authentication, again, that's
pretty simple. You know, that's something that's not a new
concept. You know, it's not a new concept. It's not a new
concept. That's really important for, especially VPN
type access. You have a contractor giving them access to
their network. First of all, something I didn't add in here,
but you need to evaluate your contractors. If you're letting
contractors into your network, to your databases, you need to
evaluate their security, too. Don't just assume that they're
doing the right thing, okay? You need to just say, you know,
hey, you want to connect to our network, we need to know what
kind of thing, what you're doing for security, and we're going to
do our own audit on your network before you connect, okay? So
that's an important thing. Visibility. Visibility is key.
So, of course, we defend our networks. We put firewalls and
intrusion prevention and, you know, things like that in place.
But we all know that eventually we're going to be compromised,
regardless, okay? That's one of the things that we're going to
do. It's no longer, you know, if you will, it's when you'll be
compromised, okay? So having visibility in your network, east
and west traffic, not just north-south, okay? We know if
something calls us out to a C2 over our edge IPS, we might see
that. But what about the traffic when they're traversing in your
network? Once your system gets compromised, the first thing
that they're going to do is they're going to pivot, and
they're going to start moving laterally across the network,
pulling out data, and then they're going to be compromised.
Okay? How do you see that if you do not have that visibility on
your network? You know, I won't go into the technical details of
it, but there's a lot of, you know, a lot of things that you
can do. There's a lot of really good tools these days to be able
to identify that information. So, and at the very least, know
what's on your network, okay? Address the roadblocks. You
know, this is kind of a political type thing, but we all
have those roadblocks. And, you know, we all have those roadblocks
in our, you know, in our environments as far as how do I
get shit done, right? How do I convince my management that I
need to put in place these security controls? So you really
need to address that stuff. And a lot of it goes back to, you
know, knowing the value of your data, okay? If you can go back
to your management and say, okay, listen, this is the type of
information that we need to protect, and this is why, okay?
This is why we're a target. This is why we're a target. This is
why we're a target. That goes a long way towards, you know,
opening up those roadblocks. Plan for when you're, after you're
compromised. Most of the time when we spend money on security
controls and defense, it's defense, right? It's, it's, it's,
we're defending our network. Most of the time that money, that
bucket, the money we spend on after, you know, the remediation,
the forensics, the type, that type of stuff is very low. And we
usually don't think about it until after the fact. So, you
know, my recommendation is, you know, as far as architecting
your security solutions, think about that. Think about what
would I do if I was compromised already and build and architect
it from there. Accountability, that's the last thing on there.
It's really kind of complicated, right? Because, you
know, how do you hold people accountable for the fails? But
the truth is, you have to. You know, it's, it's really
challenging. It's a really challenging concept, but you have
to hold people accountable for what they're responsible for. And
that's, that's all I got.
Damn, that was perfect timing. I can't believe that.
Yes, actually, I have three or four questions, but let's start
with you, by the way. So, first thing, concerning contractors,
you said that the contractors should be securely aware, etc.,
etc. Do you think ISO 27000 is enough to make sure that the
contractor is compliant? No, I mean, I think, I think you've
got to start with requirements, guidelines, things like that. But
the truth is, you know, I think, I think you've got to start with
your, you know, treatments. A lot of people think it's
readable, and you're supposed to have ten fees and so on and so
forth. Yeah, but the truth is, the truth is, if you don't sort
structure, if you don't take into account everything, you know,
what'sying, you know, how the company Kush junction works and
stuff like that. And, you know, again, it's ok if you just get
to higher level, just take things as they are. But you know,
if you're just going to support the competition, I think it's
because of that solid form of life experience that you have. So,
again, I would be more than happy to support a company that has a
missed example because that's probably the category where you keep
Yeah. I mean that's another aspect that should have been on
that slide, the recommendation slide, air gap. I mean when it
comes to stuff like that, if your data is that important, that
sensitive, you need to have an air gap network. So, yeah.
Question. We got a question. You know, they didn't go into
that. I would love to know. Actually I was hoping that he
was here. I mean if you are, come tap on my shoulder over the
village. I'll be across the way. What were you looking for?
Huh? Who were you looking for? Like. No, he was talking about
the opium contractors. Oh, those. Yeah. They didn't talk
about that. But, yeah, I'd love to know as well. Any other, oh.
Like I said, I wasn't going to go into the political aspect of
it, but I'll give you my opinion. Yeah. Yeah. The accountability part of it, like,
I said, that was just another big fail. Right? They were, yeah,
exactly. Yeah. Yep. Exactly. Yeah, sure.
So, we are in pointing at these things. Okay, so let's, my points,
they are part of the reader should be the reader select of the
sending the, somebalanças in the chat those days, certainly there
is an interface that doesn't the distinction in nature when you are
using the database. And certainly, it might be, we have now the
boxes to this point. Yeah, yeah.
Already the credentials of the administrators hurt drinking. And
stuff crisp nicely. The audience gets the sense not to worry
What's the point? It's true. It's true. But as far as doing the
basics, they weren't even doing the basics. That was the point.
Right? I mean, it's all, it all works together. Right? Two
factor authentication, decryption. You're not doing the
basics, then everything is going to fail. Anyone else? All right.
Thanks, everyone. Ron Taylor, everyone. Thank you so much,
Ron.