The figures are staggering: 21.5 million records containing social security numbers, names, places of birth, addresses, fingerprints, and other highly sensitive personal data—stolen by cyber attackers. And details continue to emerge around U.S. Office of Personnel Management (OPM) compromise that reveal the true scope of damage caused by the breach: on Christmas Eve, the National Nuclear Security Administration confirmed the OPM breach affected some employees at the Pantex Plant—the United States' only nuclear weapons assembly and disassembly facility. What are the risks and implications of employee data at the highly sensitive nuclear facility falling into the wrong hands?
Though the U.S. has long suspected that the Chinese government was responsible for the breach, bad actors in the cyber landscape are a-plenty; additionally, the OPM has long been been criticized for critical weaknesses in its IT security controls. Months before the breach, the Office of the Inspector General even submitted a report to Congress warning of "persistent deficiencies in OPM's information system security program," to include "incomplete security authorization packages, weaknesses in testing of information security controls, and inaccurate Plans of Action and Milestones." Forensic analysis of the breach also indicated that the bad actors were inside the privileged systems for months before they were ultimately detected.
As the tip of the iceberg recedes, we start to see just how broad a cross-section of federal employees and civilians were impacted: from the Marine sergeant to the IRS customer service rep, a plethora of highly sensitive government data may now be up for grabs on the black market. This also includes information regarding current and previous applicants to federal job openings, as well as information of friends and family referenced in security clearance requests. With the announcement of the OPM data breach's impact on the Pantex plant last week, a host of new critical concerns are surfacing—including whether or not data/identity theft could lead to compromises in security around nuclear facilities. Such data would no doubt be of high value to deep-pocketed organizations such as opposing nation states and terrorists.
Federal plant workers assembling weapons at the Pantex plant in 1944. Source: Wikimedia Commons.
No other details are available at this time. The U.S. Department of Energy secretary Ernest Moniz commented on the situation around the Pantex plant:
"Pantex Plant personnel took action in response to some of the concerns identified, but significant concerns still exist."
Organizations—both in public and private sector—must couple their dependence on digital technology with new models of IT security to protect themselves against a new generation of sophisticated cyber threats, the likes of which have never been seen. That said, the majority of breaches occur due to sub-standard security controls, misconfigurations, and security flaws that could otherwise be prevented through general security practices and good measures. This includes the use of a continuous security monitoring platform like UpGuard to keep a vigiliant watch over system states and configurations, ensuring that all infrastructure changes are valid and tracked.
All the information needed to perform a CSTAR assessment is bundled into the UpGuard platform. Learn more about CSTAR.
Read Blog >
The UpGuard Website Risk Grader provides a low friction way to get an initial assessment of a business' risk profile.
Read Blog >