On September 8, 2015, Admiral Mike Rogers, NSA Director and Commanding Office of US Cybercommand, conducted a briefing at the Wilson Center. During that briefing he was asked about the recent breach of the Joint Staff by a spearphishing attack. You can view the entire event at the Wilson Center website.

The US Government does a very good job of technically securing its systems. There is rarely a report of attackers compromising US Government computers through technical exploits. So, how do attackers do it? A recent report in The Hill describes how Chinese and Russian cyberwarriors are using the same tactics to cyberattack the United States Government. What are these common tactics? Spearphishing emails. Why would two adversaries adopt identical tactics? About 2,500 years ago Sun Tzu, the Chinese general, strategist and tactician, wrote what is considered by many to be the definitive work on military strategy and tactics -- the Art of [...]

The Pentagon has been infiltrated by a spearphishing attack that targeted the Joint Chiefs. CNN is reporting that the unclassified email system used by 4,000 users on the Defense Department network has been down for more than 10 days following a sophisticated cyber attack that used spearphishing to compromise the system.  Sources suspect that the attack came from China or Russia and are pointing the finger at Russia because of details of the attack that differ from typical Chinese attacks. Quoting CNN: All of the required cyber protection and patches were in place, but the attack still was able to [...]

Yesterday, Aaron Boyd, a reporter at the Federal Times, wrote that someone tried to plant malware on his system through the use of a fake State Department email. Mr. Boyd reports: Among the many emails waiting in my inbox this morning was one that seemed to come through a State Department .gov domain address. It purported to be a fax from a State Department machine, containing a PDF file...Getting an unsolicited email or document isn't that unusual in the day-to-day of a reporter. However, the link to download the document went to a .org site (not the actual State Department site) [...]

OPM Director Katherine Archuleta resigned last week in the wake of the loss of millions of personnel records. Here’s the latest tally of lost records according to the Washington Post: Of those whose data was in the OPM background-check system, 19.7 million had applied for a security clearance. An additional 1.8 million were spouses, family members and other non-applicants, officials said. Also exposed were 1.1 million sets of fingerprints, detailed financial and health records, and computer usernames and passwords that applicants used to fill out their security-clearance forms online. Meeting with reporters last Thursday, FBI Director Comey said, It is [...]

Earlier this month, it was reported that the personnel records of 4 million federal employees had been compromised in a cyber attack on the Office of Personnel Management (OPM).  OPM is the US Government's HR department. As events unfold, it now appears that this breach was much worse than first reported.  The Washington Times is reporting that the breach may involve records of 32 million Americans. Office of Personnel Management Called Before Congress   All indications are that the attack was done by the same Chinese team that stole records from Anthem, the health insurance company, and that this attack [...]