Biden’s Cyber Strategy Must De-weaponize Civilian Data

President Joe Biden’s cybersecurity agenda is rapidly taking shape. Keenly aware of the destruction wrought by the SolarWinds breach last year, the White House has moved swiftly to ready an executive action—released May 12—aimed at overhauling agency practices that played a role in allowing one of the worst breaches in U.S. history to occur. The administration also put forward nominees for key positions and are awaiting Senate approval: Chris Inglis for National Cyber Director, and Jen Easterly to head the Cybersecurity and Infrastructure Security Agency. All signs indicate that cybersecurity will play a starring role during the president's first term.

Despite this, the White House’s response risks approaching the breach from only one direction: prevention. Executive action so far has focused on sanctioning Russia, but with 18,000 SolarWinds customers potentially breached, including nine federal agencies and 100 private-sector companies, a treasure trove of civilian data is now available for fraudsters of all stripes, which can easily be used for further attacks if agencies continue to rely on less effective means of authentication, namely, knowledge-based authentication, or KBA. If the federal government’s focus is purely on prevention and agencies continue to rely on KBA, fraudsters will wield the gleaned personally identifiable information to do further damage. Authentication should be performed using multiple factors without an overreliance on identity interrogation. The White House must de-weaponize the stolen PII by taking a holistic approach to thwarting the breach cycle.

Federal agencies continue to identify citizens by asking KBA questions: your mother’s maiden name, the name of a childhood pet, or an address or cell phone number. Anyone with even a cursory knowledge of data privacy in 2021 knows that answers to these questions are easily obtained by identity thieves, and SolarWinds just made it a whole lot easier.

The federal government already acknowledges the risks presented by KBA. The National Institute of Standards and Technology’s own guidelines expressly disavows KBA for digital applications because “the ease with which an attacker can discover the answers to many KBA questions, and the relatively small number of possible choices for many of them, cause KBA to have an unacceptably high risk of successful use by an attacker.” Confidence in KBA has already been waning in the private sector for years. “Contact center security needs a makeover,” Javelin Strategy & Research asserted in December 2019. “If one area has strong consumer authentication but another channel has limited resources, criminals will obtain information where they can first, then work through the channel that has the most funds available to steal.”

More reliable forms of authentication must be sought out and implemented to mitigate fraudulent use of exposed PII. Several alternatives are already taking hold in both the private and public sector. 

Harnessing the Power of the Consumer Device

In pursuit of an effective cross-channel multifactor authentication approach—where a citizen is required to provide two or more independent ways to identify themselves—agencies are faced with a number of authentication options to build out their solution mix, from KBA to token-based, to the more recent biometric authentication options. One stand-out approach is device-based identity verification that offers an integrated view of identity and identity reputation by examining the data inherent to the device itself. This approach can be used to evaluate the degree of trust across both digital interactions and voice calls. 

For digital applications, device-based identity resolution solutions can provide agencies with decisioning on not only whether a device has been linked to unsafe behaviors in the past—using device behavior analysis—but also whether the device is likely in the hands of the individual who owns it. These risk decisions are determined by combining online, offline and device-based elements—including IP, browsing, phone activity and the connections between digital footprints and people or households—and corroborating them against authoritative offline and online consumer data to form a clear link from a device to a physical identity. 

For call authentication applications, agencies can apply real-time deterministic inspection of inbound calls and calling devices for a pre-answer authentication alternative. Through a hybridized deterministic-probabilistic identity authentication approach, a system can identify a citizen through advanced forensics of the telephony system—using the physical calling device as an ownership-based authentication token—without requiring information of any kind from the caller to authenticate them. As compared to previous identity interrogation methods, this pre-answer approach can reduce fraud.     

Device-based identity verification solutions create links and maintain persistent identifiers and attributes for people, devices and locations. By harnessing the power behind each unique consumer device, verification and authentication approaches can not only support omnichannel fraud mitigation but also de-weaponize breached PII, no matter the scale.

There Is More to be Done

Prior to its release yesterday evening, details on the executive action remained scant and didn’t include identity resolution alternatives that can address the breached PII and hamper the post-breach fraud cycle. Sanctions against Russia may support national security imperatives, but they also risk papering over the cracks by not acknowledging the glaring loopholes that have been enlarged by the SolarWinds breach.

Chris Inglis, widely expected to be appointed National Cyber Director in the coming weeks, should take a holistic approach to cybersecurity for the federal government to fully recover from an attack of this scale. Actors inside the beltway recognized the problem back in 2019: A report from the Government Accountability Office found that most of the reviewed agencies said they were not able to implement NIST’s identity proofing recommendations until the standards agency issued additional guidance for moving away from knowledge-based verification methods and that “federal agencies will likely continue to struggle to strengthen their identify [sic] proofing processes.”

Agencies clearly recognize the problems caused by KBA and are calling out for help. The SolarWinds breach is an opportunity for Inglis, the president and other stakeholders across the government to seize the day and push federal agencies toward the new identity resolution practices already being adopted elsewhere. The SolarWinds breach can’t be undone, but the civilian data it released can be de-weaponized. Only when this is achieved can the administration truly close the chapter on SolarWinds. 

Tom McNeal is vice president of the Partner Channel and Public Sector for Neustar.