As the media focused on the recent cyberattack on Sony Entertainment, the agencies our federal employment attorneys and staff members deal with day in and day out were grappling with a cybersecurity breach at a personnel contractor that may have exposed the personal information of around 48,000 federal employees.
The Breach
The breach occurred in mid-December in 2015. Oddly enough, just one month earlier, the Associated Press reported on the fact that federal employees and contractors have been responsible “for at least half of federal cyberincidents each year since 2010.”
The federal government is not required to publicize its data losses, the AP reported. So, the AP had to make multiple Freedom of Information Act (FOIA) requests and do additional reporting to uncover the fact that “cyberincidents” involving federal computer networks (.gov and .mil) and other federal agency systems had more than doubled since 2009 to more than 228,000 in a year.
“[E]mployees are to blame for at least half of the problems,” the AP reported.
According to the news outlet, federal cybersecurity breaches in 2013 were due to employees who:
| Employee action | Pct. of breaches |
| Violated policies | 21% |
| Lost devices or (or had them stolen) | 16% |
| Improperly handled printed info | 12% |
| Ran or installed malicious software | 8% |
| Were enticed to share private info | 6% |
The federal government’s General Services Administration (GSA) urges departments and agencies to implement cost-effective and efficient cybersecurity controls for federal information systems. The GSA also provides programs to assist them in doing so.
How Can Employees Prevent Cybersecurity Issues?
The FBI, the federal government’s OnGuardOnline.gov site and the The Next Web blog offer advice good for federal employees to guard against cyberattacks – whether they are using a computer at work or at home:
- Establish a strong password. Passwords should use a combination of letters, numbers and symbols. Use different passwords for different devices. Online password managers can randomly generate alpha-numeric passwords for you that are at least 20 characters long and warn you when you are using the same password on multiple sites.
- Keep your firewall turned on. Firewalls keep others out of your computer. A firewall can protect a single computer. Multiple networked computers can be protected via firewall protection in the router.
- Encrypt your data. Encryption, which scrambles the information you send over the Internet, is the most effective way to secure your network from intruders. Your computer, router and other equipment must use the same encryption – either Wi-Fi Protected Access (WPA) or Wired Equivalent Privacy (WEP). WPA2 is strongest. Remember: For most routers, you have to turn the encryption on. The router’s instructions should explain how to do that.
- Know who is in your network. Make sure computers on your network are assigned and authorized. Every computer in a single network is assigned a unique Media Access Control (MAC) address. Wireless routers usually have a mechanism to allow only devices with particular MAC addresses to access the network. Some hackers have mimicked MAC addresses. So, this step alone is not enough.
- Install and update antispyware technology and antivirus software. Spyware is software surreptitiously installed on your computer that lets others see your activities on the computer. Antivirus and antispyware software is designed to detect malicious code and disarm or remove it before it embeds on your computer. Most types can be set up to update automatically.
- Keep operating systems up to date. Computer operating systems are periodically updated to fix security holes and to keep up with technological requirements. Install updates as soon as they are available to ensure your computer has the latest protection against viruses and spyware.
- Be cautious about downloads. Carelessly downloading e-mail attachments is a user error that can circumvent even the most up-to-date and powerful anti-virus software. Never open an e-mail attachment from someone you do not know. Be wary of forwarded attachments from people you do know. They may have unwittingly advanced malicious code. If you have suspicious email from someone you know, put your cursor on the sender’s name (without clicking!) and see whether the address that is revealed matches the sender’s name.
- Turn off your computer or router. Turning the network router or a single computer off effectively severs an attacker’s connection. Being “always on” makes computers faster to use but also more susceptible to attack.
At Harris Federal, we specialize in Federal Disability Retirement. If you are a federal employee with an injury or illness, please contact our office today to schedule a free consultation to see if you qualify for disability benefits.
