Cyberattacks and the DHS Directive

It's Time for your Agency to Improve Your Authentication Protocols

By now CIOs across the federal government have seen Emergency Directive 19-1 issued by the Department of Homeland Security, which was issued in response to cyberattacks on DNS infrastructure for several executive branch agency domains. In these attacks, outsiders compromised user accounts that were authorized to change or manipulate DNS records. The attackers were able to alter those records and direct user traffic to their own infrastructure for manipulation. As the DNS changes originated from a known good account with proper credentials, the attacks did not trigger any alerts. They also were not visible to the end user. 

Once upon a time, all it took to keep your agency protected against these types of attacks was to build a really good perimeter that stood between everything in your enterprise and anything that didn’t belong. Threats had to break through the firewall to gain access to your information. Now, as these recent attacks expose, they can come through the front door undetected. And this certainly isn’t the first example. A 2017 Verizon Breach Investigative Report found that 80% of hacking-related breaches leveraged weak, default, or stolen passwords. The State of Cybersecurity Report 2018 notes that 29% of breaches used personally identifiable information combined with user credentials. The headlines are full of data losses that originate from inside of well-built perimeters.

What does this mean for CIOs? We are back to security basics. Attackers will often search for the weakest link in the agency’s security posture. With the ever growing sprawl of user accounts, critical resources, and touch points into the network, focusing on the perimeter is completely inadequate. Even the best perimeter can’t protect you from inside threats, which occur not only because of rogue employees, but because of theft of employee personal information and passwords that grant attackers access to the inside of your perimeter. Passwords are vulnerable to hackers because they are often created using personal information – which in today’s world is no longer “secret” knowledge. Biographical and geographical data is just as accessible to hackers as it is to the owners of the data themselves.

NIST agrees. In 2017, NIST published Digital Identity Guidelines, which requires government agencies and contractors who process, store, and transmit data to implement strong authentication controls. The Levels of Assurance measures are gone, and have been replaced with more rigorous security measures for the authentication process segmented into three Authenticator Assurance levels as determined by the sensitivity of the information.

These recent attacks should serve as a wake-up call for technology professionals to re-examine the policies and methodologies of cyber threat hunting. Federal agencies need to tighten security via identity proofing and strict authenticators on the inside so that the perimeter isn’t the only thing keeping would be attackers from accessing your precious information.

Security at the Application Level, Not the User Level

Both multi-factor and zero-trust authentication offer a security model that shifts the point of access conversation from traditional, perimeter-based security where anyone with the credentials can access everything inside from any device to individual application security. Application-based security utilizes user identity, the trustworthiness of the device, and established security policies to grant access to that one application. It is a more scalable approach to security that protects every attack surface by validating every point of access.

The latest trends in authentication don’t rely on privacy-protected personal information. They use biometric information that is unique to that individual user – and is hard to compromise. Authentication can occur through applications specifically designed for that purpose, offering another level of secured user verification.

Meeting the Directive and Achieving Mission Success

Looking back to the directive, federal agencies have been charged with some clear remediation steps for this latest attack:

·       Audit DNS records for change

·       Change passwords of all accounts with access to manipulate DNS records

·       Layer multi-factor authentication (MFA) authentication onto all accounts

·       Monitor certificate logs

Given the possible breadth of the data compromise and the severity of the directive, facilitating a reasonable method to quickly add MFA or the stronger zero-factor authentication to all accounts is imperative. To achieve mission success, agencies should take a close look at DUO Security, which was recently acquired by Cisco. Duo offers an impressively easy way to layer on MFA with a minimal disruption to the user while incorporating the latest methods of authentication. Through its authentication application, DUO sits between your points of access and your network. Authentication operates via Universal 2nd Factor (U2F), a more secure means of authentication facilitating push notifications in comparison with less secure SMS (text) based methods. DUO works with PIV/CAC and meets common federal technology requirements, including NIST 800-63-3 and 53/63/171 authentication. DUO can also provide an additional layer of control by limiting account access to known methods of attacks – blocking access based on location of request or anonymous networks. These capabilities will protect agencies from the types of attacks that caused this recent directive.

Zero-Trust Authentication in the Cloud 

Adopting MFA will meet the immediate DHS directive. The ultimate goal should be zero-trust authentication. As agencies develop and implement plans to move their applications to the cloud to meet federal mandates, this is the perfect time to get the tightest security offered by zero-trust authentication because applications are already being reviewed to ensure they are cloud ready. This review should include a full security analysis, with an eye on the best way to keep that application safe against threats both inside and outside of your perimeter. Adopting a zero-trust authentication solution is a good way to ensure that only the people who are authorized to access your information are doing so.  

Force 3 is the Network Security company and a Cisco Gold Partner. We have a wealth of knowledge and experience with building, integrating, and launching security measures across agencies. We can help protect your agency and meet the requirements of the DHS directive – and achieve your mission. 

Co-authored by Force 3’s Eric Stuhl, Director, Security and Enterprise Networking, and JR Silverthorne, Technical Consultant. Contact Force 3 for more information.

JR Silverthorne is a Solutions Evangelist and Technical Consultant. He has managed large High Performance Computing (HPC) projects for research universities in the area of Life Sciences and Artificial Intelligence. Since 2011, he has worked in the Cybersecurity , Big Data, and Data Center space. His work includes building out large Private Cloud platforms, Appliances for Cybersecurity companies, and advising on tech refreshes and modernization initiatives for the Federal Government and Enterprise space in the Washington DC area.