9,400 US Fed Security Clearance Employees' Info Leaked

Following the news about 9,400 US Fed Security Clearance Employees’ Info Leaked, IT security experts commented below.

Lisa Baergen, APR, MMC, Marketing Director at NuData Security:

“All data breaches are serious for those individuals and organizations concerned, but this breach is particularly concerning given the status of the affected parties. Data that is stolen during a breach will most likely end up for sale on the dark web, and this data is no different. The personal information of US citizens with top secret clearance for sale on the dark web is potentially disastrous and could attract attention from major criminal organizations or even hostile nation states. The individuals concerned should remain vigilant to the targeted spear phishing attacks and other types of cybercrime which could follow on from this. Organizations using authenticated online accounts need to be ever more vigilant to protect persons impacted by these breaches from account takeover and identity theft. Many organizations are looking to a more secure means of protecting accounts using a multi-layered approach to security. This includes the benefits of incorporating passive biometric solutions into their authentication process to truly verify it is the right user behind the account and not an intruder using the personal information stolen from breaches of this size and magnitude.”

Willy Leichter, VP of Marketing at Virsec Systems, Inc.:

“From a data privacy and compliance standpoint, this incident shows a disturbingly common pattern – apologize but blame it all on the subcontractors. Regardless of who actually made mistakes, the data controller – the organization entrusted to properly use and protect the data is always responsible.

“TigerSwan’s lengthy statement essentially says “we apologize, but it wasn’t our fault.” While the subcontractor may certainly share some blame, TigerSwan is still legally responsible for protecting data entrusted to them. Saying that their servers were never breached is irrelevant.”

Brad Keller, Sr. Director Third Party Strategy at Prevalent, Inc. (Warren, NJ):

“The potential damage from the TalentPen data leak makes damage from the unauthorized access of accounts pale in comparison. This disclosure could be extremely damaging to the individuals involved and highlights the very real need to fully assess your third parties. TigerSwan is as much at fault here as TalentPen. They chose to outsource this service and are accountable for TalentPen’s failures. The question I have is for TigerSwan – what where they doing to make sure TalentPen had adequate security controls and operational procedures in place?

Coming close on the heels of the BroadSoft leak ( https://www.engadget.com/2017/09/02/time-warner-cable-data-leak ), yet another third party leak due to failed security controls and operational procedures, should cause companies to wonder if their third parties have adequate operational procedures in place.”

John Suit, CTO at Trivalent:

“In this case, the data of thousands of job applicants, many who claimed “Top Secret” US government security clearance, was exposed by an Amazon server. The documents were found on an unsecure Amazon S3 bucket without password protection. Roughly 9,400 documents were exposed in this breach, highlighting the damaging effects of leaving critical data unprotected. This information was discovered in a folder labeled “resumes” that was in a visible location accessible by malicious parties. This breach highlights the importance of taking the guess work out of data security by employing protection at the file level, which ensures individual files are protected at all times.”