With many Federal agencies moving to a mostly or entirely remote work environment in 2020, keeping workplaces and data secure and safe from breaches was harder than ever before. New research from the Ponemon Institute – which focuses on Federal information and privacy management – revealed just how widespread data breaches have been in the last two years.
Dr. Larry Ponemon – the institute’s founder and namesake – revealed the results of a new study the institute at a March 16 ATARC event focused on preventing these very types of data breaches. According to the study, 61 percent of agencies who responded reported a breach that led to loss or theft of records with sensitive or confidential information over the last two years.
Of the 61 percent that experienced a breach, 88 percent of respondents reported more than one “significant data breach” over the same period. When looking at 2020 specifically, the number of attacks also went up.
“63 percent of agencies reported the number of cybersecurity incidents increased in the past year, and 65 percent reported the severity has also increased,” Ponemon said on the webinar. “Now we’ve measured severity, in terms of IT infrastructure, damage to the infrastructure, leakage of high-value assets -information assets, time to discover, and time to contain.”
In response to the data from Ponemon, Gregory Crabb, chief information security officer and vice president of the United States Postal Service, compared the job of agency CISOs to a CFO at a company. Crabb also noted the difficulty of fighting a cyber war – compared to a physical war – where there are no indications of threat size online compared to seeing tanks on the battlefield.
“No CFO can provide 100% assurance about the effectiveness of the controls that they put in place in order to be able to stop fraud or abuse in the financial system. And I think that when you compare the tools and techniques that an information security practice can employ, you’ve got the same framework,” Crabb said.
“We’re trying to defend our nation against threat actors such as nation-states that are applying massive amounts of resources,” Crabb added.
Claire Barrett, chief privacy and information asset officer at the Department of Transportation (DoT), had her own analogy – likening it to riding a motorcycle. After a webinar poll showed that many viewers felt their agencies were mature in the digital transformation process, Barrett also spoke on that disconnect between the webinar poll and the Ponemon study.
“It’s not a question of if you go down, it’s when you go down, and then the question becomes … how good is your padding,” Barrett said. “I don’t see it as a disparity … you can be very technologically innovative and advanced and mature, while still having immature cybersecurity programs.”
In talking about strategies for improving breach detection and response, Barrett emphasized the importance of understanding how data moves normally to help understand when something has gone wrong and commented on the evolving threat landscape.
“When I started in cybersecurity 25 years ago or so … it was a lot of ransomware,” Barrett said. “Well the next threat in my mind, and what we’re starting to see is … manipulating your data and populating that through the system. That has real impacts in and of itself.”
“This is a significant threat space, I think, for government – managing not only the security of the data [and] who can get to it but … the integrity of that data as it moves through the channels,” Barrett added. “It’s not just your system architecture, it’s your data architectures, and understanding the flow of data … what systems are relying upon each other.”
