SECURITY INFLUENCERS BLOG

Security influencers provide real-world insight and “in-the-trenches” experiences on topics ranging from application security to DevOps and risk management

START FREE TRIAL

Point of View: Army's Public Website Hacked by Unknown Intruders

pov-hero

All breaches are not created equal. The Army breach is actually considerably more disturbing than the IRS breach.  

In the Army breach, attackers defaced the website, and so people will evaluate the severity based on what they did.  But we should evaluate the severity based on what they COULD have done.  In this case, the hackers had access that would've allowed them to do much more serious damage. They could have used their access to install malicious software that attacks users of the website, installs malware in their browser, or to escalate their attack two more sensitive army systems.  We are lucky they weren't a little more malicious or creative. 

The OPM breach is unclear. All we know is that the ended up with data. We don't know the full extent of what else they could have done.

The military should prepare themselves for considerably more attacks in the coming years.  While I suspect that the response will largely be focused on the threat, with calls to go after the attackers and attack back, that's the cyber equivalent of bombing a desert.  A much more productive approach will be to focus on defense and detection, and instrumenting visibility into the military software infrastructure.

There isn't a quick fix here, but to stay a cyber superpower, we have to do a lot better.

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. Previously, Jeff was co-founder and CEO of Aspect Security, a successful and innovative application security consulting company acquired by Ernst & Young. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years.

SUBSCRIBE TO THE BLOG