An FBI contractor faces up to 18 months imprisonment after pleading guilty to illegally accessing the bureau's computers in one of several insider security breaches the U.S. government is facing.
If you think the only two security threats to your organization come from either your employees or your enemies, think again. The U.S. District Court for the District of Columbia next week could sentence Joseph Thomas Colon to up to 18 months in prison for poking around areas of the Federal Bureau of Investigation's network where he shouldn't have been. Colon is neither an FBI employee nor an outsider. He was a contractor working on the FBI's Trilogy project to upgrade the agency's aging IT infrastructure.
Although Colon was an employee of defense contractor BAE Systems and worked out of the FBI's Springfield, Ill., office, he in March pled guilty to four counts of "intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States," in this case, the Justice Department, according to court documents. Colon was caught accessing "secret"-level information, which is at a clearance level higher than he was permitted to access.
Colon four times in 2004 accessed the FBI's Security Account Manager, a database on the FBI's classified network that contains encrypted user and group account password information for more than 38,000 user accounts. Lest anyone think Colon simply stumbled upon this information, he then used the L0phtcrack password decryption tool to make the encrypted passwords readable.
The FBI reacted to Colon's impropriety by last year demanding that all FBI employees and contractors complete information security awareness training on an annual basis. But much like the recent recommendations passed down from NIST and OMB and the Congressional hearings held in the wake of the VA laptop theft, the FBI's compulsory training program is a reactive measure to a problem it should already have addressed. Until both the public and private sector start acting to prevent the next big security challenge before it erupts, we'll continue to see measures designed to solve yesterday's problems.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.