Dismissed a valid alert about a cybersecurity breach once? Shame on the intruder. Dismissed a valid alert about a cybersecurity breach twice? Something may be systemically wrong.
Last month Nextgov/FCW reported that, per anonymous sources, an unknown attacker with as-yet unknown affiliations had compromised the Homeland Security Information Network, a database intended as a place for federal, state, and local law enforcement to share security information with one and other, and with partners in the private sector.
The breach came, according to Nextgov/FCW, “as the U.S. [was] overseeing security for World Cup games across the country, placing added scrutiny on the systems federal, state and local officials use to coordinate major events.”
According to a fresh anonymously sourced report from that same publication, its seems analysts at the Federal Emergency Management Agency (FEMA, which is part of DHS) noticed that the attackers had left signs of altering files and concealing their presence from mid to late May, per Federal Computer Week. Then from late May to early June, similar activity was reportedly noticed, but both times, the breach was dismissed as a false positive.
It wasn’t until June 4 when personnel saw that the attackers had, “installed hidden backdoors and [stolen] credential data” that an alarm was reportedly raised.
DHS gave a statement to Nextgov/FCW, but that publication notes that it’s “the same statement it provided earlier this month that confirmed the hack”:
“The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment […] We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time.”
