U.S. Government's Office Of Personnel Management (OPM) Provides Information About the Recent Cybersecurity Incident

The U.S. Government's Office of Personnel Management (OPM), offered the below information yesterday:

The U.S. Office of Personnel Management (OPM) recently became aware of a cybersecurity incident affecting its systems and data that may have compromised the personal information of current and former Federal employees.

Within the last year, OPM has undertaken an aggressive effort to update its cybersecurity posture, adding numerous tools and capabilities to its networks. As a result, in April 2015, OPM became aware of the incident affecting its information technology (IT) systems and data that predated the adoption of these security controls.

Since the incident was identified, OPM has partnered with the U.S. Department of Homeland Security’s U.S. Computer Emergency Readiness Team (US-CERT), and the Federal Bureau of Investigation to determine the impact to Federal personnel.  And OPM immediately implemented additional security measures to protect the sensitive information it manages.

Beginning June 8 and continuing through June 19, OPM will be sending notifications to approximately 4 million individuals whose Personally Identifiable Information was potentially compromised in this incident.  The email will come from opmcio@csid.com and it will contain information regarding credit monitoring and identity theft protection services being provided to those Federal employees impacted by the data breach. In the event OPM does not have an email address for the individual on file, a standard letter will be sent via the U.S. Postal Service.

In order to mitigate the risk of fraud and identity theft, OPM is offering affected individuals credit monitoring services and identity theft insurance with CSID, a company that specializes in identity theft protection and fraud resolution.  This comprehensive, 18-month membership includes credit report access, credit monitoring, identity theft insurance, and recovery services and is available immediately at no cost to affected individuals identified by OPM.

Additional information is available beginning at 8 a.m. CST on June 8, 2015 on the company’s website, www.csid.com/opm (external link), and by calling toll-free 844-222-2743 (International callers: call collect 512-327-0700).

Steps for Monitoring Your Identity and Financial Information

• Monitor financial account statements and immediately report any suspicious or unusual activity to financial institutions.
• Request a free credit report at www.AnnualCreditReport.com (external link) or by calling 1-877-322-8228.  Consumers are entitled by law to one free credit report per year from each of the three major credit bureaus – Equifax^®, Experian^®, and TransUnion^® – for a total of three reports every year.  Contact information for the credit bureaus can be found on the Federal Trade Commission (FTC) website, www.ftc.gov (external link).
• Review resources provided on the FTC identity theft website, www.identitytheft.gov (external link).  The FTC maintains a variety of consumer publications providing comprehensive information on computer intrusions and identity theft.
• You may place a fraud alert on your credit file to let creditors know to contact you before opening a new account in your name.  Simply call TransUnion^® at 1-800-680-7289 to place this alert.  TransUnion^® will then notify the other two credit bureaus on your behalf. 

Precautions to Help You Avoid Becoming a Victim

• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about you, your employees, your colleagues or any other internal information.  If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information.
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Do not send sensitive information over the Internet before checking a website’s security (for more information, see Protecting Your Privacy, www.us-cert.gov/ncas/tips/ST04-013 (external link)).
• Pay attention to the URL of a website.  Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).
• If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly.  Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information.  Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (www.antiphishing.org (external link)).
• Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (for more information, see Understanding Firewalls, www.us-cert.gov/ncas/tips/ST04-004 (external link); Understanding Anti-Virus Software, www.us-cert.gov/ncas/tips/ST04-005 (external link); and Reducing Spam, http://www.us-cert.gov/ncas/tips/ST04-007 (external link)).
• Take advantage of any anti-phishing features offered by your email client and web browser.
• Employees should take steps to monitor their personally identifiable information and report any suspected instances of identity theft to the FBI’s Internet Crime Complaint Center at www.ic3.gov (external link).
• Additional information about preventative steps by consulting the Federal Trade Commission’s website, www.identitytheft.gov (external link). The FTC also encourages those who discover that their information has been misused to file a complaint with the commission using the contact information below.
  
  Identity Theft Clearinghouse
  Federal Trade Commission
  600 Pennsylvania Avenue, NW
  Washington, DC 20580
  www.identitytheft.gov (external link)
  1-877-IDTHEFT (438-4338)
  TDD: 1-202-326-2502  

FBI's Cyber Action Team Responds Rapidly To Major Computer Intrusions

The FBI web site offers the below report:

It can be a company’s worst nightmare—the discovery that hackers have infiltrated their computer networks and made off with trade secrets, customers’ personal information, and other critical data.

When such intrusions happen—and unfortunately, they occur frequently—the FBI can respond with a range of investigative assets, including the little-known Cyber Action Team (CAT). This rapid deployment group of cyber experts can be on the scene just about anywhere in the world within 48 hours, providing investigative support and helping to answer critical questions that can quickly move a case forward.

“Our goal is to provide information that can be actioned immediately,” said Special Agent Chris Lamb, a CAT member since 2007. “A lot of the evidence in a cyber intrusion may only be there for a little while,” he said. “The trail can get cold pretty quickly.”

Established by the FBI’s Cyber Division in 2006 to provide rapid incident response on major computer intrusions and cyber-related emergencies, the team has approximately 50 members located in field offices around the country. They are either special agents or computer scientists, and all possess advanced training in computer languages, forensic investigations, and malware analysis.

“I call it speaking geek,” said Lamb, describing the skills CAT members must possess and maintain to be on the team. “You could compare it to an English speaker trying to learn Mandarin Chinese. You have to spend years immersing yourself in the language to become fluent. And then you have to keep practicing. But unlike Mandarin, which basically stays the same, the challenge for us is that the language of cyber is constantly changing.”

Since the Cyber Action Team’s inception, the FBI has investigated hundreds of cyber crimes. More than 50 of those cases were deemed of such significance that the rapid response and specialized skills of the Cyber Action Team were required. Some of those cases affected U.S. interests abroad, and the team deployed overseas, working through our legal attaché offices and with our international partners.

“Our job is to very quickly understand what the bad guy did and why,” said Lamb, who works out of our Kansas City Division. “We make an initial assessment to determine what we know and what we don’t know. Based on that assessment, we then call in other experts to fill whatever gaps we need to have filled.”

“Using cutting-edge tools, we look for a hacker’s signature,” he explained. In the cyber world, such signatures are called TTPs—tools, techniques, and procedures. The TTPs usually point to a specific group or person. The hackers may represent a criminal enterprise looking for financial gain or state-sponsored entities seeking a strategic advantage over the U.S.

Either way, victim companies are often surprised by how much of their networks have been compromised—and for how long. Some intrusions are not discovered until months or even years after the fact.

Hackers have become so sophisticated that they can overcome even the best network security measures, he noted. “We tell victims that it sometimes doesn’t matter how good your security is, the bad guys can still get in.”

My On Crime & Security Column: The FBI's InfraGard Program Teams With Small Businesses To Fight Economic Espionage

The national business web site AllBusiness.com posted my two-part On Crime & Security Columns   on the FBI's InfraGard program.

You can read my columns via the below links:

Small Business Plays a Role in Stopping Economic Espionage

http://www.allbusiness.com/operations/16739399-1.html

More On the FBI's InfraGard Program and Small Business

http://www.allbusiness.com/operations/16739400-1.html