New hacker techniques threaten agencies

With hackers constantly concocting new types of malicious software, government agencies are struggling to stay abreast of the latest threats, according to testimony released Thursday by federal auditors.

One new trick that intruders are trying involves a covert form of "malware" called a rootkit. A rootkit remains dormant, invisible to the user and even the computer's operating system, while gaining access to information in the computer and any network connected to the computer.

"[T]he purpose of the rootkit is to jimmy the door or make a key to the house that no one else knows that you have, so you can gain entry," said Jim Butterworth, the director of incident response at Guidance Software, a computer investigation firm. "It's a significant threat to all government agencies."

While rootkits can be outwitted by users and sophisticated technical protections, including a tool offered by Guidance, agencies are not fully executing their defense strategies, according to the Government Accountability Office (GAO-07-751T).

User training is critical to combating threats, Butterworth said. "A lot of times it is human error that results in an intrusion. It is accidental. ... It is unintentional."

He added that checking Web-based mail or surfing the Internet could open a computer to a rootkit. Thumb drives, too, can become conduits for malware. Butterworth urged agencies to mitigate the danger posed by removable devices by disabling USB ports on all employee computers, except ports used for required work-related purposes.

The 2010 decennial census, where household data will be collected by using handheld computers, presents a particular cyber-security challenge.

The census "is a nightmare," Butterworth said. "If you are going to hire armies of people to go hit the street, [do not give] them modems and virtual private network access to pump information back into the infrastructure. ... No Bluetooth, no Wi-Fi [wireless technologies]. Those are vulnerable."

He said the Census Bureau should focus on developing secure transmission mechanisms along the entire data route -- during collection, transfer, processing and archiving.

In discussing government-wide information security overall, Butterworth said he "would praise the agencies for being aware that the threat exists and taking steps to develop policies; I would criticize the agencies for understaffing, under-funding and not following through on policy enforcement. Policy without enforcement is useless."

In fiscal 2006, 21 of 24 major agencies cited weak information security controls, GAO noted. The underlying cause was a failure to fully implement agency-wide information security programs.

"Significant information security weaknesses continue to place federal agencies at risk," the report states. Until agencies carry out their information security programs, "federal data and systems will not be sufficiently safeguarded to prevent unauthorized use, disclosure and modification."

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
Close [ x ] More from GovExec

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Sponsored by G Suite

    Cross-Agency Teamwork, Anytime and Anywhere

    Dan McCrae, director of IT service delivery division, National Oceanic and Atmospheric Administration (NOAA)

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Federal IT Applications: Assessing Government's Core Drivers

    In order to better understand the current state of external and internal-facing agency workplace applications, Government Business Council (GBC) and Riverbed undertook an in-depth research study of federal employees. Overall, survey findings indicate that federal IT applications still face a gamut of challenges with regard to quality, reliability, and performance management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security


When you download a report, your information may be shared with the underwriters of that document.