New hacker techniques threaten agencies

With hackers constantly concocting new types of malicious software, government agencies are struggling to stay abreast of the latest threats, according to testimony released Thursday by federal auditors.

One new trick that intruders are trying involves a covert form of "malware" called a rootkit. A rootkit remains dormant, invisible to the user and even the computer's operating system, while gaining access to information in the computer and any network connected to the computer.

"[T]he purpose of the rootkit is to jimmy the door or make a key to the house that no one else knows that you have, so you can gain entry," said Jim Butterworth, the director of incident response at Guidance Software, a computer investigation firm. "It's a significant threat to all government agencies."

While rootkits can be outwitted by users and sophisticated technical protections, including a tool offered by Guidance, agencies are not fully executing their defense strategies, according to the Government Accountability Office (GAO-07-751T).

User training is critical to combating threats, Butterworth said. "A lot of times it is human error that results in an intrusion. It is accidental. ... It is unintentional."

He added that checking Web-based mail or surfing the Internet could open a computer to a rootkit. Thumb drives, too, can become conduits for malware. Butterworth urged agencies to mitigate the danger posed by removable devices by disabling USB ports on all employee computers, except ports used for required work-related purposes.

The 2010 decennial census, where household data will be collected by using handheld computers, presents a particular cyber-security challenge.

The census "is a nightmare," Butterworth said. "If you are going to hire armies of people to go hit the street, [do not give] them modems and virtual private network access to pump information back into the infrastructure. ... No Bluetooth, no Wi-Fi [wireless technologies]. Those are vulnerable."

He said the Census Bureau should focus on developing secure transmission mechanisms along the entire data route -- during collection, transfer, processing and archiving.

In discussing government-wide information security overall, Butterworth said he "would praise the agencies for being aware that the threat exists and taking steps to develop policies; I would criticize the agencies for understaffing, under-funding and not following through on policy enforcement. Policy without enforcement is useless."

In fiscal 2006, 21 of 24 major agencies cited weak information security controls, GAO noted. The underlying cause was a failure to fully implement agency-wide information security programs.

"Significant information security weaknesses continue to place federal agencies at risk," the report states. Until agencies carry out their information security programs, "federal data and systems will not be sufficiently safeguarded to prevent unauthorized use, disclosure and modification."

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
Close [ x ] More from GovExec

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • The Big Data Campaign Trail

    With everyone so focused on security following recent breaches at federal, state and local government and education institutions, there has been little emphasis on the need for better operations. This report breaks down some of the biggest operational challenges in IT management and provides insight into how agencies and leaders can successfully solve some of the biggest lingering government IT issues.

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care


When you download a report, your information may be shared with the underwriters of that document.