Defense Contractors Guard Against Snowden-Like Events

Survey Highlights Serious Security and Compliance Problems

Call it the Snowden Effect, if you will. The revelations revealed by the former defense contractor have begun to reshape the way the defense industry approaches network security. According to new research from ThreatTrack, 75 percent of those who work with IT and/or IT security within the defense industry stated that they have made changes to security. As pointed out by eSecurity Planet, these changes include the following:

•     55 percent say their employees now receive more cybersecurity awareness training.
•     52 percent have reviewed or re-evaluated employee data access privileges.
•     47 percent are on higher alert for anomalous network activity by employees.
•     41 percent have implemented stricter hiring practices.
•     39 percent say their own IT administrative rights have been restricted.

Overall, defense contractors tend to be better at security practices than private industry. There are different levels of secure networks. Employees are (often severely) restricted by what they can and cannot do on the network or with personal mobile devices. But as ThreatTrack Security President and CEO Julian Waits, Sr., pointed out in a statement, the defense industry still faces a lot of difficult cybersecurity challenges:

Well over half are concerned that they are vulnerable to targeted attacks and cyber-espionage, and given the type of data they are handling and storing, we think that number needs to get a lot smaller – and fast.

I know that a majority of people consider the information that Snowden revealed to be the primary story and worry about NSA spying. However, the way that Snowden gathered the information was an insider breach of cybersecurity. He was the type of rogue employee every company concerned about cybersecurity should be worrying about. The survey notes this, stating:

44% of respondents said they have access to networks and databases that store confidential information. Of those, 27.3% have no security clearance at all, which raises a red flag. This means that like Snowden, they may have broad IT administrative privileges but without the proper security clearance. Regardless of what security clearances you have, access to privileged information ultimately may be the greatest risk for defense contractors looking to avoid another Snowden-like event.

It’s a good reminder that while it is important to prepare for an attack from the outside, it is just as important, if not more important, to prevent an attack from inside. Who you hire and what access they have to the network should play just as important a role in a cybersecurity plan as any other policy meant to protect against vulnerabilities.