162 ms·

Huge data breach prompts resignation of OPM director

60 points by jackgavigan 11y ago

celticninja 11y ago
If governments cannot keep data like that safe what are the chances of most other data owners being able to do the same? The way that we need to give it out all over the Web is a recipe for disaster as we are shown time and time again.
- magicalist 11y ago
  Well the good news is that they were barely putting any effort into keeping it secure, so reasonable efforts are not in vain. The bad news is that almost your entire government is barely putting any effort into keeping your data secure.
adzicg 11y ago
> usernames and passwords that background investigation applicants used if this is correct, I guess that means passwords were stored in cleartext or reversibly encrypted. that is either epic stupidity, or someone wanted to keep passwords of potential employees so they could use them elsewhere
- eli 11y ago
  Malice is very unlikely. If I had to guess, maintaining interoperability with legacy systems probably played a role.
  - r00fus 11y ago
    Which points to corruption and inability to control your vendors (i.e., regulatory capture). Ultimately in large organizations like this that are arguably well funded, the answer often lies in corruption (and not necessarily just the bureaucracy, but also the legislators who earmark crazy stuff like specific vendors and specifications that are handpicked for their favorite funders).
    - cordite 11y ago
      Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product--instead of considering replacing the product where more than one can actually bid for it.
      - icebraining 11y ago
        Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product Why can it only be fulfilled by the authors?
        cordite 11y ago
        Because the authors don't have a contract licensing program for consultants
  - kevin_thibedeau 11y ago
    There wasn't that much legacy. The first web based form was rolled out in 2000-2001. Candidates wouldn't need to have credentials that worked on the legacy back end services. I wouldn't put it past them that they did this on purpose to have an easy route into online accounts since EO12333 gives them a blank check to do whatever they want when conducting a background investigation. They don't even have to line up for a rubber stamp from FISA.
    - dredmorbius 11y ago
      You're assuming there are no legacy back-end systems that those Web systems interact with. Not a particularly valid assumption.
      - kevin_thibedeau 11y ago
        OPM couldn't produce my paper SF-86 submitted from right before the switch to the web based system when I requested it a couple years ago. i.e. they never transcribed it for electronic storage, meaning there was no critical back end legacy in place to begin with. Candidates would never have credentials to a back end system in any case and wouldn't need to be recorded in a global "users" table. The process only requires logging into the front end for editing, review, and submission. Once that is complete there's nothing more to do. That doesn't require any sort of integration.
- Spooky23 11y ago
  It is what happens when you let contractors run everything. Nobody knows anything. When Republicans let slogans like "we need smaller government" define governance, this is a big part of what happens.
  - ams6110 11y ago
    Democrats have been running the show for the past 8 years.
    - Spooky23 11y ago
      The House of Representatives controls the purse strings, and is aggressive in their wielding of that power.
    - dredmorbius 11y ago
      Democrats have controlled the executive branch for the past 7 years. The Democrats had a filibuster-proof majority in the Senate -- for four months. From September 24, 2009, to February 4, 2010. Prior to then, the Deomocrats nominally had 60 seats in the Senate, but: Edward Kennedy was ill from the night of Obama's inaguration. Senator Al Franken's election was disputed for months. Arlen Specter switched from Republican to Democrat, in order to hold his seat, but didn't support the Democrats for filibusters. Senator Byrd was in hospital for much of 2009. Absent a filibuster-proof majority, the GOP could and did effectively block any legislative action, at will, to the point of shutting down the Federal government of the United States for two and a half weeks. http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-never-had-control-over-senate-%E2%80%93-not-once http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-n... No, the Democrats haven't been "running the show for the past 8 years."
  - adventured 11y ago
    In what way does the Federal Government lack the resources to secure OPM data? Whether we're talking about OPM's $2.x billion budget, or the NSA's budget, or a dozen other agencies that supposedly have something to do with security. The US spends more on domestic security theater than Germany or France spend on their entire military.
- KMag 11y ago
  My information is likely in the dump, due to some contractor work I did back in 2003-2005. My best guess is the leaked passwords are the passwords needed to decrypt the most confidential portions of the security clearance questionaires, which was (is?) distributed as a DOS binary. The protected data generally contains people's deepest darkest secrets, and information on where to begin digging for more information that could be used to blackmail them into working for a foreign power. This information is collected in order to estimate how succeptable the applicant would be to blackmail, but is also the perfect starting point for starting a campaign to blackmail current security clearance holders into spying for a foreign power. At least the way it worked in 2003 was that a security officer emailed you an old 16-color DOS application called EPSQ 2.2. As I remember, the application actually saved its data back into the binary, so people wouldn't be confused about what to email back to the security officer when they were done. The EPSQ questionaire had two sections... one contained some basic data that your employer needed to see, and one contained drug use, alcohol abuse, mental health, financial problems, legal problems, etc. You picked two passwords that were used to encrypt the two sections, filled out the questionire, and emailed it back. You then gave the less sensitive password to the security officer. I don't remember if I sent the more sensitive password to the OPM or if EPSQ 2.2 contained public key crypto/obfuscation so that the OPM could recover the sensitive information encryption key. In any case, the human-picked password/encryption key most definitely could be used to decrypt the most sensitive data (blackmail information) in order to facilitate saving a partially completed questionaire and finishing it up at a later date. These days, I really hope EPSQ is a web app that's accessed via a binary with a single TLS certificate authority hard-coded (and using perfect forward security), so copies of super-sensitive data aren't left in several mail queues protected only by (generally low-entropy) human-generated encryption keys.
CydeWeys 11y ago
Good. I last worked for the government in 2007 and all of my data was still included in the breach. Heads rolling is the very least of what needs to happen when a security error of this magnitude occurs.
- scrapcode 11y ago
  I'm in the same boat. I'm not sure if you've had any kind of clearance, or know what kind of info you have to give for the investigations (everything), but this will be terrible for generations I presume. Instead of offering us 18 measly months of credit monitoring, they should offer lifetime/18+ years credit monitoring for any dependents involved in the paperwork. I suspect this will cost their ass.
  - hrehhf 11y ago
    It sure would help all of us if that kind of background info were no longer used for verifying identity or granting credit. Info like SSNs, addresses, etc. never really was _secret_ anyway, it just wasn't all compiled into one place and for so many people.
    - scrapcode 11y ago
      Exactly my point. It has never been a good idea to use something like a social security number and the high school you graduated from to authenticate you as a person. But no one gives a shit because it works for the majority. But most importantly, because that problem isn't being addressed by anyone. Securing a bunch of G employee's information is much less exciting than building the newest SaaS app that gets a few million in funding.
  - engi_nerd 11y ago
    How do people take advantage of this 18 months of monitoring? My wife and I are almost certainly in the impacted population (and the fact that we've had 4 separate fradulent activities on our accounts in the past month isn't helping...)
appleflaxen 11y ago
Yes; this is exactly what her psychological profile suggested she would do. Excellent.
deepnet 11y ago
Plaintext in 2015 ! Inexcusable.
- steckerbrett 11y ago
  Shouting "encryption" isn't a whole lot better really. You can use "military grade encryption" all you want, but if the server it is stored on has the keys there's extremely little point except the feel-good vibes.
- sp332 11y ago
  The attackers stole legitimate login credentials. Encryption wouldn't help with that.
  - carbocation 11y ago
    I run a bunch of websites which store bcrypted hashes of users' passwords. If you had my SQL login, you'd just find bcrypted hashes. It would absolutely prevent you from discovering their actual passwords in a meaningful amount of time.
    - technion 11y ago
      You would, however, have plaintext copies of every piece of other sensitive information in that database. Who cares is passwords are harder to brute force, once an attacker has walked away with everything in the OPM leak? Don't get me wrong, I'm hugely in favour of hashed passwords. But with this sort of data it's a long way from making a complete database leak a nonissue.
      - carbocation 11y ago
        I was responding to a comment about plaintext login credentials. I'm not claiming that bcrypting passwords somehow makes a database full of exquisitely private details somehow unimportant.
magicalist 11y ago
For those that missed it, I suggest this look at how comically bad security was (is) at OPM, to the point there were security reports saying the loss of productivity by shutting down the database completely would be preferable to the ridiculously vulnerable state it was in. No one listened. http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
- droopybuns 11y ago
  TL;DR: No 2 factor auth, yer dead? I am having an impossible time following this story. So vague. Thanks for the most descriptive link yet (although still totally lacking). I watched the cspan event and all I could derive was that inadequate logging meant they couldn't say how bad the event was. Totally unclear.
  - higherpurpose 11y ago
    If you have 4 hours to kill, this House hearing video clears many things (about how incompetent, but also how dismissive both Archuleta and Donna Seymour, the CIO, were - Seymour still not fired yet). https://www.youtube.com/watch?v=pVPPTooB80E https://www.youtube.com/watch?v=pVPPTooB80E And this is part 1: https://www.youtube.com/watch?v=Ass73n7lH0c https://www.youtube.com/watch?v=Ass73n7lH0c
scrapcode 11y ago
I hope we can use a breach of this magnitude to really start thinking about how we authenticate in real life. The current system is broken. The whole SSN thing is bad enough in and of itsself. Anything you can ask from me to authenticate myself: copy of a birth certificate, copy of my drivers license, social security number, information about where i grew up or my family... someone else has all of that now, which means they can now easily get original copies.
rebootthesystem 11y ago
What I want to know if if she resigned and was immediately re-hired at another cushy high-paying government job. In other words a transition with no financial consequences whatsoever. The correct consequence is that this woman ought to be kicked out on her ass, lose her pension and go out there in the open market to find a non-government job matching her degree of incompetence. To a large extent firings or layoffs in government amount to shuffling people around rather than what most would conclude from such a headline. How many additional OPM's and Healtcare.gov's do we have to witness before people revolt and demand excellence out of government? Today we seem to be content with the idea that government operates at precisely the opposite end of the scale, a place where a range of behaviors from sucking at your job to lying and criminal behavior seem to be considered virtues. And what's worst, there are no consequences for being utterly incompetent, lying or acting criminally? The breach wasn't the problem. The problem is how fucked government is at nearly every level. That's what needs fixing.
caseysoftware 11y ago
I wrote about this one almost a month ago: http://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined http://caseysoftware.com/blog/why-this-security-breach-is-wo... (spent a day on the front page here) Every time OPM says "it was only X" it comes out a few days later that they're lying. My original statements have applied since day one: "Whoever took this data has all the relevant information on anyone (and their families and their friends) who has received a security clearance. Not some. Not parts. ALL." and "If someone just steals your identity, consider yourself lucky." It was also uncovered that the so-called "hackers" had read/write access to the system so therefore EVERYTHING in it - whether good or bad - should be considered suspicious. People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked.
- mokus 11y ago
  Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (potential to cause "exceptionally grave harm" if compromised). I really think Archuleta and Seymour should be brought up on criminal charges for mishandling information that should have been classified Top Secret and likely also should have been associated with a special-access program. Even if the records for an individual person don't rise to that level, 20-ish million of them together absolutely do. That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.
  - x0x0 11y ago
    Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
WalterBright 11y ago
Looks like they missed a basic aspect of operational security - compartmentalization. Sensitive databases must be compartmentalized so a breach in one is not a breach in all. No login credential, for example, should grant access to all of the database.
dsq 11y ago
Political loyalists appointed by lawyers. No more explanation necessary.

60 points by jackgavigan 11y ago

If governments cannot keep data like that safe what are the chances of most other data owners being able to do the same? The way that we need to give it out all over the Web is a recipe for disaster as we are shown time and time again.

magicalist 11y ago
Well the good news is that they were barely putting any effort into keeping it secure, so reasonable efforts are not in vain. The bad news is that almost your entire government is barely putting any effort into keeping your data secure.

adzicg 11y ago

> usernames and passwords that background investigation applicants used if this is correct, I guess that means passwords were stored in cleartext or reversibly encrypted. that is either epic stupidity, or someone wanted to keep passwords of potential employees so they could use them elsewhere

eli 11y ago
Malice is very unlikely. If I had to guess, maintaining interoperability with legacy systems probably played a role.
- r00fus 11y ago
  Which points to corruption and inability to control your vendors (i.e., regulatory capture). Ultimately in large organizations like this that are arguably well funded, the answer often lies in corruption (and not necessarily just the bureaucracy, but also the legislators who earmark crazy stuff like specific vendors and specifications that are handpicked for their favorite funders).
  - cordite 11y ago
    Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product--instead of considering replacing the product where more than one can actually bid for it.
    - icebraining 11y ago
      Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product Why can it only be fulfilled by the authors?
      - cordite 11y ago
        Because the authors don't have a contract licensing program for consultants
- kevin_thibedeau 11y ago
  There wasn't that much legacy. The first web based form was rolled out in 2000-2001. Candidates wouldn't need to have credentials that worked on the legacy back end services. I wouldn't put it past them that they did this on purpose to have an easy route into online accounts since EO12333 gives them a blank check to do whatever they want when conducting a background investigation. They don't even have to line up for a rubber stamp from FISA.
  - dredmorbius 11y ago
    You're assuming there are no legacy back-end systems that those Web systems interact with. Not a particularly valid assumption.
    - kevin_thibedeau 11y ago
      OPM couldn't produce my paper SF-86 submitted from right before the switch to the web based system when I requested it a couple years ago. i.e. they never transcribed it for electronic storage, meaning there was no critical back end legacy in place to begin with. Candidates would never have credentials to a back end system in any case and wouldn't need to be recorded in a global "users" table. The process only requires logging into the front end for editing, review, and submission. Once that is complete there's nothing more to do. That doesn't require any sort of integration.
Spooky23 11y ago
It is what happens when you let contractors run everything. Nobody knows anything. When Republicans let slogans like "we need smaller government" define governance, this is a big part of what happens.
- ams6110 11y ago
  Democrats have been running the show for the past 8 years.
  - Spooky23 11y ago
    The House of Representatives controls the purse strings, and is aggressive in their wielding of that power.
  - dredmorbius 11y ago
    Democrats have controlled the executive branch for the past 7 years. The Democrats had a filibuster-proof majority in the Senate -- for four months. From September 24, 2009, to February 4, 2010. Prior to then, the Deomocrats nominally had 60 seats in the Senate, but: Edward Kennedy was ill from the night of Obama's inaguration. Senator Al Franken's election was disputed for months. Arlen Specter switched from Republican to Democrat, in order to hold his seat, but didn't support the Democrats for filibusters. Senator Byrd was in hospital for much of 2009. Absent a filibuster-proof majority, the GOP could and did effectively block any legislative action, at will, to the point of shutting down the Federal government of the United States for two and a half weeks. http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-never-had-control-over-senate-%E2%80%93-not-once http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-n... No, the Democrats haven't been "running the show for the past 8 years."
- adventured 11y ago
  In what way does the Federal Government lack the resources to secure OPM data? Whether we're talking about OPM's $2.x billion budget, or the NSA's budget, or a dozen other agencies that supposedly have something to do with security. The US spends more on domestic security theater than Germany or France spend on their entire military.
KMag 11y ago
My information is likely in the dump, due to some contractor work I did back in 2003-2005. My best guess is the leaked passwords are the passwords needed to decrypt the most confidential portions of the security clearance questionaires, which was (is?) distributed as a DOS binary. The protected data generally contains people's deepest darkest secrets, and information on where to begin digging for more information that could be used to blackmail them into working for a foreign power. This information is collected in order to estimate how succeptable the applicant would be to blackmail, but is also the perfect starting point for starting a campaign to blackmail current security clearance holders into spying for a foreign power. At least the way it worked in 2003 was that a security officer emailed you an old 16-color DOS application called EPSQ 2.2. As I remember, the application actually saved its data back into the binary, so people wouldn't be confused about what to email back to the security officer when they were done. The EPSQ questionaire had two sections... one contained some basic data that your employer needed to see, and one contained drug use, alcohol abuse, mental health, financial problems, legal problems, etc. You picked two passwords that were used to encrypt the two sections, filled out the questionire, and emailed it back. You then gave the less sensitive password to the security officer. I don't remember if I sent the more sensitive password to the OPM or if EPSQ 2.2 contained public key crypto/obfuscation so that the OPM could recover the sensitive information encryption key. In any case, the human-picked password/encryption key most definitely could be used to decrypt the most sensitive data (blackmail information) in order to facilitate saving a partially completed questionaire and finishing it up at a later date. These days, I really hope EPSQ is a web app that's accessed via a binary with a single TLS certificate authority hard-coded (and using perfect forward security), so copies of super-sensitive data aren't left in several mail queues protected only by (generally low-entropy) human-generated encryption keys.

CydeWeys 11y ago

Good. I last worked for the government in 2007 and all of my data was still included in the breach. Heads rolling is the very least of what needs to happen when a security error of this magnitude occurs.

scrapcode 11y ago
I'm in the same boat. I'm not sure if you've had any kind of clearance, or know what kind of info you have to give for the investigations (everything), but this will be terrible for generations I presume. Instead of offering us 18 measly months of credit monitoring, they should offer lifetime/18+ years credit monitoring for any dependents involved in the paperwork. I suspect this will cost their ass.
- hrehhf 11y ago
  It sure would help all of us if that kind of background info were no longer used for verifying identity or granting credit. Info like SSNs, addresses, etc. never really was _secret_ anyway, it just wasn't all compiled into one place and for so many people.
  - scrapcode 11y ago
    Exactly my point. It has never been a good idea to use something like a social security number and the high school you graduated from to authenticate you as a person. But no one gives a shit because it works for the majority. But most importantly, because that problem isn't being addressed by anyone. Securing a bunch of G employee's information is much less exciting than building the newest SaaS app that gets a few million in funding.
- engi_nerd 11y ago
  How do people take advantage of this 18 months of monitoring? My wife and I are almost certainly in the impacted population (and the fact that we've had 4 separate fradulent activities on our accounts in the past month isn't helping...)

appleflaxen 11y ago

Yes; this is exactly what her psychological profile suggested she would do. Excellent.

deepnet 11y ago

Plaintext in 2015 ! Inexcusable.

steckerbrett 11y ago
Shouting "encryption" isn't a whole lot better really. You can use "military grade encryption" all you want, but if the server it is stored on has the keys there's extremely little point except the feel-good vibes.
sp332 11y ago
The attackers stole legitimate login credentials. Encryption wouldn't help with that.
- carbocation 11y ago
  I run a bunch of websites which store bcrypted hashes of users' passwords. If you had my SQL login, you'd just find bcrypted hashes. It would absolutely prevent you from discovering their actual passwords in a meaningful amount of time.
  - technion 11y ago
    You would, however, have plaintext copies of every piece of other sensitive information in that database. Who cares is passwords are harder to brute force, once an attacker has walked away with everything in the OPM leak? Don't get me wrong, I'm hugely in favour of hashed passwords. But with this sort of data it's a long way from making a complete database leak a nonissue.
    - carbocation 11y ago
      I was responding to a comment about plaintext login credentials. I'm not claiming that bcrypting passwords somehow makes a database full of exquisitely private details somehow unimportant.

magicalist 11y ago

For those that missed it, I suggest this look at how comically bad security was (is) at OPM, to the point there were security reports saying the loss of productivity by shutting down the database completely would be preferable to the ridiculously vulnerable state it was in. No one listened. http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...

droopybuns 11y ago
TL;DR: No 2 factor auth, yer dead? I am having an impossible time following this story. So vague. Thanks for the most descriptive link yet (although still totally lacking). I watched the cspan event and all I could derive was that inadequate logging meant they couldn't say how bad the event was. Totally unclear.
- higherpurpose 11y ago
  If you have 4 hours to kill, this House hearing video clears many things (about how incompetent, but also how dismissive both Archuleta and Donna Seymour, the CIO, were - Seymour still not fired yet). https://www.youtube.com/watch?v=pVPPTooB80E https://www.youtube.com/watch?v=pVPPTooB80E And this is part 1: https://www.youtube.com/watch?v=Ass73n7lH0c https://www.youtube.com/watch?v=Ass73n7lH0c

scrapcode 11y ago

I hope we can use a breach of this magnitude to really start thinking about how we authenticate in real life. The current system is broken. The whole SSN thing is bad enough in and of itsself. Anything you can ask from me to authenticate myself: copy of a birth certificate, copy of my drivers license, social security number, information about where i grew up or my family... someone else has all of that now, which means they can now easily get original copies.

rebootthesystem 11y ago

What I want to know if if she resigned and was immediately re-hired at another cushy high-paying government job. In other words a transition with no financial consequences whatsoever. The correct consequence is that this woman ought to be kicked out on her ass, lose her pension and go out there in the open market to find a non-government job matching her degree of incompetence. To a large extent firings or layoffs in government amount to shuffling people around rather than what most would conclude from such a headline. How many additional OPM's and Healtcare.gov's do we have to witness before people revolt and demand excellence out of government? Today we seem to be content with the idea that government operates at precisely the opposite end of the scale, a place where a range of behaviors from sucking at your job to lying and criminal behavior seem to be considered virtues. And what's worst, there are no consequences for being utterly incompetent, lying or acting criminally? The breach wasn't the problem. The problem is how fucked government is at nearly every level. That's what needs fixing.

caseysoftware 11y ago

I wrote about this one almost a month ago: http://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined http://caseysoftware.com/blog/why-this-security-breach-is-wo... (spent a day on the front page here) Every time OPM says "it was only X" it comes out a few days later that they're lying. My original statements have applied since day one: "Whoever took this data has all the relevant information on anyone (and their families and their friends) who has received a security clearance. Not some. Not parts. ALL." and "If someone just steals your identity, consider yourself lucky." It was also uncovered that the so-called "hackers" had read/write access to the system so therefore EVERYTHING in it - whether good or bad - should be considered suspicious. People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked.

mokus 11y ago
Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (potential to cause "exceptionally grave harm" if compromised). I really think Archuleta and Seymour should be brought up on criminal charges for mishandling information that should have been classified Top Secret and likely also should have been associated with a special-access program. Even if the records for an individual person don't rise to that level, 20-ish million of them together absolutely do. That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.
- x0x0 11y ago
  Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...

WalterBright 11y ago

Looks like they missed a basic aspect of operational security - compartmentalization. Sensitive databases must be compartmentalized so a breach in one is not a breach in all. No login credential, for example, should grant access to all of the database.

dsq 11y ago

Political loyalists appointed by lawyers. No more explanation necessary.