New hacker techniques threaten agencies

With hackers constantly concocting new types of malicious software, government agencies are struggling to stay abreast of the latest threats, according to testimony released Thursday by federal auditors.

One new trick that intruders are trying involves a covert form of "malware" called a rootkit. A rootkit remains dormant, invisible to the user and even the computer's operating system, while gaining access to information in the computer and any network connected to the computer.

"[T]he purpose of the rootkit is to jimmy the door or make a key to the house that no one else knows that you have, so you can gain entry," said Jim Butterworth, the director of incident response at Guidance Software, a computer investigation firm. "It's a significant threat to all government agencies."

While rootkits can be outwitted by users and sophisticated technical protections, including a tool offered by Guidance, agencies are not fully executing their defense strategies, according to the Government Accountability Office (GAO-07-751T).

User training is critical to combating threats, Butterworth said. "A lot of times it is human error that results in an intrusion. It is accidental. ... It is unintentional."

He added that checking Web-based mail or surfing the Internet could open a computer to a rootkit. Thumb drives, too, can become conduits for malware. Butterworth urged agencies to mitigate the danger posed by removable devices by disabling USB ports on all employee computers, except ports used for required work-related purposes.

The 2010 decennial census, where household data will be collected by using handheld computers, presents a particular cyber-security challenge.

The census "is a nightmare," Butterworth said. "If you are going to hire armies of people to go hit the street, [do not give] them modems and virtual private network access to pump information back into the infrastructure. ... No Bluetooth, no Wi-Fi [wireless technologies]. Those are vulnerable."

He said the Census Bureau should focus on developing secure transmission mechanisms along the entire data route -- during collection, transfer, processing and archiving.

In discussing government-wide information security overall, Butterworth said he "would praise the agencies for being aware that the threat exists and taking steps to develop policies; I would criticize the agencies for understaffing, under-funding and not following through on policy enforcement. Policy without enforcement is useless."

In fiscal 2006, 21 of 24 major agencies cited weak information security controls, GAO noted. The underlying cause was a failure to fully implement agency-wide information security programs.

"Significant information security weaknesses continue to place federal agencies at risk," the report states. Until agencies carry out their information security programs, "federal data and systems will not be sufficiently safeguarded to prevent unauthorized use, disclosure and modification."