Question

CASE STUDY U.S. Office of Personnel Management Data Breach: No Routine Hack The U.S. Office of Personnel Management (OPM) is conducted, may have been extracted. Government offi responsible for recruiting and retaining a world-class cials say that the exposure of security clearance irn workforce to serve the American people and is also mation could pose a problem for years responsible for background investigations on pro- spective employees and security clearances. In June the OPM system, and its records were protected du The Central Intelligence Agency (CIA) does not use 2015, the OPM announced that it had been the target the breach. However, intelligence and congressional of a data breach targeting the records of as many as officials worried that the hackers or Chinese intelli- 4 million people. In the following months, the num gence operatives could still use the detailed OPM infor- ber of stolen records was upped to 21.5 million. This mation they did obtain to identify U.S. spies by process as no routine hack. It is the greatest theft of sensi- of elimination. If they combined the stolen data with other information gathered over time, they could use big data analytics to identify operatives. tive personnel data in history Information targeted in the breach included person- ally identifiable information such as social security numbers as well as names, dates and places of birth, and addresses. Also stolen was detailed security clearance related background information. This included records of people who had undergone back- ground checks but who were not necessarily current or former government employees. The potential exposure of U.S. intelligence officers could prevent many of them from ever being posted abroad again. Adm. Michael S. Rogers, director of the National Security Agency, suggested that the person- nel data could also be used to develop" ing" attacks on government officials. In such attacks, victims are duped into clicking on what appear to be emails from people they know, allowing mal their computer networks. spear phish- The data breach is believed to have begun in March iced by the ware into 2014 and perhaps earlier, but it was not not OPM until April 2015, and it is unclear how it was actu T had finished implementing new security procedur The stolen data also included 5.6 million sets of ally discovered. The intrusion occurred before OPM ingerprints. According to biometrics expert Ram secret agents esh es Kesanupalli, this could compromise t restricted remote access for network administra because they could be identified by their fingerprints 10:40 PM