Human Error Results in Leaked SF-86 Forms

The United States Department of Defense (DoD) discovered in February that one of its servers had been sharing U.S. military emails openly on the internet for over two weeks without anyone noticing. This vulnerability affected U.S. Special Operations Command and other DoD customers. Shockingly, plain-text email conversations were exposed and accessible to anyone who knew the IP address of the unsecured server.

While the impacted server did not hold classified information, it did hold internal military email messages and other sensitive information. 

Leaked SF-86 Forms

Some of the exposed emails included SF-86 forms. SF-86 forms are lengthy questionnaires that contain a trove of Personal Identifiable Information (PII) including the submitter’s previous addresses, information about their relatives, ID’s such as social security numbers, and much more. 

These forms are a gold mine for cybercriminals looking to exploit phishing, smishing or a number of other attack vectors. This is not the first time PII has been compromised at the federal level. In fact, the Office of Personnel Management (OPM) just recently finished paying out compensation to impacted clearance holders from when they were breached in 2015. 

Preventing Federal Data Breaches

Agencies across the federal government are required to adhere to the strictest standards and security best practices in order to protect against a constant onslaught of cyber attacks. However, the human element of any organization can often lead to security gaps even in the best-prepared organizations. 

To reduce the risk of breaches like the recent one that impacted the DoD email server, organizations of all sizes need to implement solutions that defend against the most common causes of data breaches, weak or stolen credentials or secrets. However, in order to mitigate risk, simplify compliance and combat cyber attacks, organizations must ensure the solution is easily adopted by all users. After all, a tool that is too complex for employees to regularly use will do no good.

A Human-Centric Cybersecurity Solution

Legacy approaches don’t deliver the deep visibility and granular controls administrators need to defend their systems against password-based exploits. 

Agencies need an approach to cybersecurity that takes into account the vulnerabilities of the end user. They need a human-centric approach, one grounded in zero trust and zero-knowledge strategies. 

• Zero Trust: Assumes that all users and devices could potentially be compromised and that everyone must be verified before they can access the network. 
• Zero Knowledge: Stored information is only accessible by the end user; each user has complete control over the encryption and decryption of all personal information. 

One way to achieve this is through the implementation of a next-generation Privileged Access Management (PAM) solution.  Next-gen PAM tools provide a secure location in which credentials are stored, shared and managed. These tools also provide:

• Privileged Account and Session Management (PASM)
• Secrets Management
• Single Sign-On (SSO) Integration
• Privileged Account Credential Management
• Credential Vaulting and Access Control
• Session Management, Monitoring and Recording

Most importantly, though, next-gen solutions provide an easy-to-use and easy-to-administer platform. Strong identity management is key to implementing a least-privileged approach to systems management. And the human-centric focus likewise enforces a zero-knowledge strategy, with encryption in place to ensure that credentials are accessible only to the intended end user. 

A modernized PAM solution can be the first line of defense against identity breaches, but only if that solution provides a simple, end-user-friendly application that can be quickly deployed at scale.

FedRAMP Authorized PAM

Keeper Security Government Cloud (KSGC) protects state, local and federal organizations with a zero-knowledge and zero-trust solution that is FedRAMP Authorized, easy to use, and simple to deploy at an enterprise scale.