An FBI contractor faces up to 18 months imprisonment after pleading guilty to illegally accessing the bureau's computers in one of several insider security breaches the U.S. government is facing.
If you think the only two security threats to your organization come from either your employees or your enemies, think again. The U.S. District Court for the District of Columbia next week could sentence Joseph Thomas Colon to up to 18 months in prison for poking around areas of the Federal Bureau of Investigation's network where he shouldn't have been. Colon is neither an FBI employee nor an outsider. He was a contractor working on the FBI's Trilogy project to upgrade the agency's aging IT infrastructure.
Although Colon was an employee of defense contractor BAE Systems and worked out of the FBI's Springfield, Ill., office, he in March pled guilty to four counts of "intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States," in this case, the Justice Department, according to court documents. Colon was caught accessing "secret"-level information, which is at a clearance level higher than he was permitted to access.
Colon four times in 2004 accessed the FBI's Security Account Manager, a database on the FBI's classified network that contains encrypted user and group account password information for more than 38,000 user accounts. Lest anyone think Colon simply stumbled upon this information, he then used the L0phtcrack password decryption tool to make the encrypted passwords readable.
The FBI reacted to Colon's impropriety by last year demanding that all FBI employees and contractors complete information security awareness training on an annual basis. But much like the recent recommendations passed down from NIST and OMB and the Congressional hearings held in the wake of the VA laptop theft, the FBI's compulsory training program is a reactive measure to a problem it should already have addressed. Until both the public and private sector start acting to prevent the next big security challenge before it erupts, we'll continue to see measures designed to solve yesterday's problems.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.