recommended reading

If You Fall for a Phishing Scam, Should You Lose Your Security Clearance?

Try not to get reeled in.

Try not to get reeled in. // project1photography/Shutterstock.com

If you fall for a phishing email, should you have your ability to handle sensitive government information revoked?

At least one federal chief information security officer is concerned about how frequently even senior-level federal employees fall for the bogus emails and is considering get-tough solutions.

Paul Beckman, the Department of Homeland security’s chief information security officer, said he sends his own emails designed to mimic phishing attempts to staff members to see who falls for the scam.  

“These are emails that look blatantly to be coming from outside of DHS -- to any security practitioner, they're blatant,” he said during a panel discussion on CISO priorities at the Billington Cybersecurity Summit in Washington on Sept. 17. “But to these general users” -- including senior managers and other VIPs -- “you'd be surprised at how often I catch these guys."

Employees who fail the test -- by clicking on potentially unsafe links and inputting usernames and passwords -- are forced to undergo mandatory online security training.

But Beckman said a small number of employees continue to fall for the fake scams -- even in the second of third round of phishing tests.

"There are no repercussions to bad behavior,” he said. “There's no punitive damage, so to speak. There's really nothing to incentivize these people to be aware, to be diligent."

Beckman said he wants to start discussions with DHS’ chief security officer -- who’s responsible for overall personnel security -- about incorporating employees’ susceptibility to phishing in broader evaluations of their fitness to handle sensitive information.

“Someone who fails every single phishing campaign in the world should not be holding a TS SCI with the federal government," he said, using the government acronym to describe a top-secret security clearance. “You have clearly demonstrated that you are not responsible enough to responsibly handle that information.”

Beckman said such discussions are still in their infancy. And not all CISOs are on board with the tough approach he advocates.

Rod Turk, the Commerce Department’s CISO, said he also runs phishing tests on his employees, but he said he views it as solely a training exercise.

More broadly, federal CISOs are concerned about the increasing sophistication of phishing campaigns against high-level federal personnel.

They worry the recent massive breach of background-investigation files at the Office of Personnel Management -- hackers stole data on 22 million federal employees and contractors -- could be used to craft even more convincing phishing attempts.

“One of the things they're going to do with [that information], you can bet your bottom dollar, is coming up with insidious anti-phishing campaigns that look very tailored and very personal to these people,” Beckman said. “Every bit of my personal information is in an attacker's hands right now. They could probably craft my email that even I would be susceptible to, because they know everything about me virtually.”

Turk agreed, calling the stolen data a “a goldmine for phishing expeditions."

(Image via project1photography/ Shutterstock.com)

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

    Download
  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

    Download
  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.

    Download

When you download a report, your information may be shared with the underwriters of that document.