GAO Lacks Confidence in Improvements after 2015 OPM Breach

The U.S. Office of Personnel Management (OPM) was the victim of one of the most serious data intrusions on record back in 2015. It wasn’t because of the number of victims (22 million +) or the cost to remedy (between millions and billions), but it was so serious because of the data that was stolen. The General Accountability Office (GAO) is now reporting that the additional cybersecurity measures the OPM has put into place since then, still aren’t good enough.

The information accessed in the OPM breach included names, address, and social security numbers, which is serious enough. It also included the same information on family members of those in the OPM database, security clearance information, job histories, and fingerprint data to name just some of it. This is what made this breach so significant, in addition to the number of stolen records.

The GAO has expressed significant concern around the lack of proper processes and procedures for overseeing systems operated by contractors. It has also made additional recommendations for the OPM, including:

• Updating its policy to reflect the deployment of Department of Homeland Security (DHS) threat indicators

• Updating the policy to include the DHS specific 24-hour scanning requirements

• Creating and putting into place training requirements for staff based on roles

• Providing detailed guidance on its quality assurance process, including evaluating security control assessments

• Updating its project plans and milestones to reflect expected completion dates for implementing the US-CERT recommendations

It’s not all doom and gloom, however. The OPM has certainly made some changes in the positive direction. It has installed additional malware detection systems, now requires multi-factor authentication for all users before they are allowed access to their computers, and has limited access to external email, to name a few. However, a lot more needs to be done to give the victims and the GAO confidence that something like this is unlikely to happen again.