Massive Breach Exposes Government Employee Data

The US Transportation Department (USDOT) was hit by a severe data breach that exposed the personal information of 237,000 current and former US federal government employees.

The breach was traced back to systems used for processing TRANServe transit benefits, which reimburse government employees for some commuting costs. The news of the breach caused alarm and concern among the affected individuals and the general public.

The USDOT launched an investigation and took steps to secure and restore the affected systems. They froze access to the transit benefit system to prevent further damage.

They discovered that 237,000 current and former federal government employees had their personal information exposed, including 114,000 current employees and 123,000 former employees.

It is currently unclear if any of the information obtained has been used for criminal purposes or who is responsible.

This attack is not the first time that federal employees and agencies have been targeted by hackers. The US Office of Personnel Management (OPM) suffered two breaches in 2014 and 2015, compromising sensitive data belonging to more than 22 million people, including 4.2 million current and federal employees along with fingerprint data of 5.6 million of those individuals.

Acreto Solution

Cybersecurity threats continue to pose a significant risk to governments, organizations, and individuals. These attacks can have serious consequences, including identity theft, financial fraud, and other forms of malicious activity.

Acreto’s Ecosystem solution prevents such attacks by providing secure access to authorized systems and applications only. Here’s how:

• Ecosystems: Acreto’s Ecosystem solution can be deployed per application, project, or third-party use case. An Ecosystem inherently limits access only to users, devices, systems, and applications that need to interoperate together. In this way, only authorized systems and applications can access the sensitive data, preventing unauthorized access by hackers.

• Micro-Segmentation: Acreto’s Micro-Segmentation solution isolates individual or groups of systems on a shared network, including hostile networks, or the entire network. This will limit access only to systems that need to interoperate together, preventing unauthorized access to sensitive data.

• Encrypted Secure Scan: Acreto’s Encrypted Secure Scan addresses a key weakness in many security tools today. It decrypts, scans, and re-encrypts communications inline and in real-time. Any malicious content embedded in the encrypted payload is blocked, otherwise, the clean and validated communication is delivered to its final destination. This will help prevent hackers from using encrypted communication to bypass security measures.

• Access Control: Acreto’s Access Control solution provides identity with MFA. User and device identities are authenticated by the organization’s Directory Services such as Active Directory or LDAP, as well as third-party Identity Service Providers such as Okta, Ping, Duo, and CloudJump among others. This will ensure that only authorized users and devices can access the sensitive data.

• Application Program: Acreto’s Application Program controls the application (MS-Exchange, Oracle, etc.) any Ecosystem member uses to communicate with any other Ecosystem member or Internet resource by IP, user or device identity. Both inbound and outbound Internet flows are supported. This prevents hackers from accessing sensitive data in these applications.

Contact Acreto today for more information or to evaluate Ecosystem security for your organization.

Ecosystem Security Isolation

Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.

Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.

Ecosystems can be configured as:

Eliminate the Internet Attack Surface

Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.

Eliminate the Internal Attack Surface

Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with

Isolated Data Flows

Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.

Encrypted Secure Scan

Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.

Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.

Controls

Threat Prevention

After verification of network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:

Simplicity

Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.

Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.

Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.

Sustainability

Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.

Change Management

Different Ecosystems operate completely independently from one-another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.

Policy Management

Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when its time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.

 

About Acreto

Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.