Skip to Content
Unclassified

Speed Mission Debrief: Introduction

Government Resources

Follow your organization’s policy on non-email platforms, such as Teams, and webmail (a web-based service that checks e-mail remotely). If webmail is allowed, use caution as it may bypass built-in security features and other safeguards, such as encryption, and thus may compromise security. Communications in any format, including chats and SMS messaging, may be official records, which you should consider before deleting from any Government device.

Identity Authentication

In The News...Easily Cracked Passwords Put Systems at Risk

Following the Colonial Pipeline attack that exploited a weak password to cause gas shortages along the East Coast, the U.S. Department of the Interior conducted an internal test of the passwords throughout the Department. They were able to crack 21 percent of active user passwords, including accounts with elevated privileges. The most commonly re-used password was Password-1234, and five of the ten most re-used passwords included a variation of “password” combined with “1234”.

Malicious Code

In The News...Ransomware Attack Closes School

A ransomware attack shut down a school district’s network, causing the district to cancel classes for a day. The school’s cybersecurity team isolated the attack and shut down the network before information could be affected or compromised, but the shutdown affected basic functions necessary to run the school. The cause was identified as an encrypted download.

Social Engineering

Smishing is a type of social engineering that uses a Short Message Service (SMS) message to deceive you. SMS messages are commonly known as text messages. The goal is to obtain your personal information or gain access to your device. To protect against smishing:

  • Do not reply or click the link in the message
  • Delete the message

Vishing is a type of social engineering that uses voice calls to deceive you into giving up personal information or installing software that provides access to your devices or network. To protect against vishing:

  • Let calls from unknown numbers go to voicemail. Legitimate callers will leave a message.

In The News... Callback Phishing Attempts Increase by 625%

Think that phishing e-mails only want you to open a link? A tactic on the rise is to e-mail a phony invoice, often for a pricey monthly subscription, along with a phone number to call if you have questions. Once called, the attacker guides you to install a tool on your computer that gives them remote access to do as they like with your data. Your e-mail filters are less likely to block the e-mail since it does not contain links or malicious code, and the use of legitimate tools makes the intrusion more difficult to detect.

Mobile Devices

When participating in the Bring Your Own Approved Device (BYOAD) program:

  • Read and sign the User Agreement that includes the program’s requirements and policies
  • Use of your personal device depends on your organization’s policies
  • The approved device will be provisioned to employ necessary security measures to secure it and its data when accessed

Social Networking

The social networking app TikTok is banned on all Government devices.

Insider Threat

In The News... Navy Spy Sentenced to 232 Months in Prison

As a nuclear engineer with the Department of the Navy, Jonathan Toebbe worked with and had legitimate access to Restricted Data. Toebbe attempted to establish a covert relationship with a foreign government to sell Restricted Data and began corresponding via encrypted e-mail with an undercover FBI agent. Toebbe made dead drops of data cards containing Restricted Data, providing the decryption key to the undercover agent upon payment.

Skip to Next Tab
Select Next to continue.
Skip Navigation
Unclassified