Forest Global Training Partners

Cyber Risks · Krebs on Security

When Security Takes a Backseat to Productivity

Summary: A CIA report produced in October 2017, seven months after Wikileaks began publishing Vault 7, found the agency's security processes were so "woefully lax" it likely would never have known about the theft of thousands of classified documents from its offensive cyber operations division had Wikileaks not published them. The report, kept from public view until heavily redacted portions appeared in a letter from Sen. Ron Wyden to the Director of National Intelligence, cited mission systems developed outside enterprise IT governance and a culture that let mission system owners decide how or whether they would police themselves.

Bottom line: The CIA's own post-mortem says the breach surfaced only because the stolen documents were published - not because the agency detected the exfiltration, which is the difference between a bad day and a full data breach for any organization.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related