Direct Financial Cost of Intrusions
Thanks to the blog reader who directed me to the Washington Times story Contractor returns money to Pentagon:
Apptis Inc., a military information technology provider, repaid $1.3 million of a $5.4 million Pentagon contract after investigators said the company provided inadequate computer security and a subcontractors system was hacked from an Internet address in China...
Apptis agreed to the repayment after the Defense Criminal Investigative Service concluded the company and a subcontractor failed to provide "proper network security and information assurance services," according to the report, released in June.
The subcontractors system under Apptis management was intruded upon "with total access to the root network" from an Internet address in China, the report said.
Wow. Can anyone think of another case where a company was "fined" by a customer for an intrusion? Usually we only hear of PCI issues.
Apptis Inc., a military information technology provider, repaid $1.3 million of a $5.4 million Pentagon contract after investigators said the company provided inadequate computer security and a subcontractors system was hacked from an Internet address in China...
Apptis agreed to the repayment after the Defense Criminal Investigative Service concluded the company and a subcontractor failed to provide "proper network security and information assurance services," according to the report, released in June.
The subcontractors system under Apptis management was intruded upon "with total access to the root network" from an Internet address in China, the report said.
Wow. Can anyone think of another case where a company was "fined" by a customer for an intrusion? Usually we only hear of PCI issues.
Comments
This event further illustrates the uselessness and futility of performing “Certification and Accreditation” (C&A ) in accordance with Defense Information Assurance Certification and Accreditation Process (DIACAP). DIACAP like its predecessor DITSCAP is a form of larceny. Departments and agencies are being robbed blind by flimflam C&A scams. C&A does absolutely NOTHING to protect or safeguard systems or networks. In fact the false impression given by so called C&A experts that can barely spell IP is what lead to the current crisis in which we are immersed.
If federal departments and agencies were simply forced to employ Industry best practices such as Configuration/Asset Management during the acquisition process, the money wasted on C&A could be better spent detecting and defeating advance persistent threat using Network Security Monitoring (NSM). We need stop wasting money on C&A and provide funds and resources to recruit, hire, and retain technically proficient and competent security professionals.