The House Oversight Committee’s hearings on the massive OPM data breach have been absolutely astounding. The rank incompetence on display at this agency was mind-boggling.
The government knew security was wide open for years, and did nothing. It’s a wonder they weren’t hacked before now. As committee chair Rep. Jason Chaffetz (R-UT) put it, “OPM’s data security posture was akin to leaving all your doors and windows unlocked and hoping nobody would walk in and take the information.”
Much of this horror show has consisted of OPM Director Katherine Archuleta – the new face of utter indifference to staggering Big Government failure – insisting that she can’t answer questions because everything is classified. Ars Technica put together a lengthy article full of observations gleaned from the questions that were answered, including this stunner about the lack of much-needed data encryption on the OPM system:
Department of Homeland Security Assistant Secretary for Cybersecurity Dr. Andy Ozment testified that encryption would “not have helped in this case” because the attackers had gained valid user credentials to the systems that they attacked—likely through social engineering. And because of the lack of multifactor authentication on these systems, the attackers would have been able to use those credentials at will to access systems from within and potentially even from outside the network.
...
