US Postal Service Suspends Telecommuting Following Massive Breach 50
An anonymous reader writes: The folks at the USPS have responded to the recent breach that exposed data on 800K employees and another some 2.8 million customers. They have suspended telecommuting for all employees until further notice while they replace their VPN with a more secure version. "Additionally, the postal service will upgrade some of its equipment and systems in the coming weeks and months as part of a broad security overhaul in response to the breach."
Which VPN solution were they using? (Score:1)
Does anyone know?
Re:Which VPN solution were they using? (Score:4, Funny)
Whatever it was, it probably was backed by a UPS.
Re: (Score:2)
We had one back in the 1860s and that didn't update the VPNs and stuff.
Re: (Score:1)
No nation in history has ever needed a real war as badly has the US.
I am curious, how would another war fix the USPS?
If war is a panacea for government woes, why didn't the wars in Afghanistan/Iraq fix problems like this?
I have a feeling the veterans who served in them and populations that lived through them find them quiet real. The question is, why don't you?
Re: (Score:2)
TCP over Postal System.
Low packet loss, but terrible latency.
Re: Which VPN solution were they using? (Score:2)
Re: (Score:2)
PCAnywhere
Re: (Score:1)
Re: Which VPN solution were they using? (Score:1)
The odds the VPN were compromised are pretty low in comparison to the odds a users system was compromised by malware, virus, trojan, etc.
800k weren't delivering the mail? (Score:1)
Re: (Score:2)
Answer calls in the style of a call center.. Postal rates are complicated right now, so to get an exact price for a big shipment the average user needs to speak with somebody.
Re: (Score:1)
the mailman have to do there time cards and TSP reports somehow.
Re:800k weren't delivering the mail? (Score:5, Insightful)
Re: (Score:1)
...and mama used to say, "Life is like a box of chocolates."
Re: (Score:2)
The question is wrong (Score:2)
The summary says that data on 800k workers was exposed, not that 800k workers were telecommuting. The linked article does not put a number on how many workers were telecommuting.
Also, although I don't know whether it is done in practice it is not impossible for an urban mail carrier to never go to the post office. The green boxes are used as intermediate collection points for carriers that are on foot.
A more secure VPN version .. (Score:1)
Breach first ... (Score:2)
... patch later.
Why do VPN users have access to this much data? (Score:2)
Before looking at the technological failure point I would like to know why that much data is exposed to a vpn connection in such a way that it can be exploited.
Surely you have to treat the machines on the other end of the vpn as hostile. You don't have them inside your controlled network 100% of the time (not to mention even if you did you should treat them as hostile). How is it that even if someone managed to gain access to a vpn connection that they could hit the database servers for that much data?
I'm
Re: (Score:2)
Before looking at the technological failure point I would like to know why that much data is exposed to a vpn connection in such a way that it can be exploited.
Because idiot IT "consultants" generally view the firewall as the only important line of defence. I can't count the number of business I've gone into to clean up a mess, and found the perimeter firewall to be....well...mediocre, and the internal security to be absolutely non-existent. Basically, the assumption is that anything that's on the network is supposed to be there, so you don't set anything up to question it.
I've seen databases set up to allow root/sa access to anything, with no password. If I qu
Re: (Score:2)
I can "kinda" understand that in a small shop. But with sooooo many employees your risk of bad hardware being brought into the office is huge. And what's more, it's the postal service. You know, the place that had the term "go postal" named after it. Surely you would assume your employees were high risk if they named "going crazy and shooting people" after your company.
Re: (Score:2)
Re: (Score:2)
Before looking at the technological failure point I would like to know why that much data is exposed to a vpn connection in such a way that it can be exploited.
Because idiot IT "consultants" generally view the firewall as the only important line of defence. I can't count the number of business I've gone into to clean up a mess, and found the perimeter firewall to be....well...mediocre, and the internal security to be absolutely non-existent. Basically, the assumption is that anything that's on the network is supposed to be there, so you don't set anything up to question it.
I work in a Fortune 500 company, and anybody on a VPN can ping any database server in the company. If they have valid credentials, they can log in. For some servers the application accounts are extended into the database so if you know where the database is you could log in and query the whole thing (ie bypassing the front-end and any business logic it might enforce - hopefully the DB account would be read-only but I wouldn't count on it).
Internal security tends to be very light. Maybe they're running ID
Re: (Score:2)
Re: (Score:2)
* Separate Administrative credentials used by IT staff
* Dedicated administrative workstations that IT staff do not use to do daily tasks (email, web, etc.)
* OR dedicated IT jump box requiring further 2FA to log in to.
Re: (Score:2)
Of course it can be leaked. 1 screenshot at a time. But there is no reason that they should be able to dump data on 800k employees and 2 million + customers.
That should have taken someone a lifetime, one screenshot at a time.
The HR department does not need access to the customer records. The HR department does not need access to bulk information. The application developer pool should not have access to the live production database from a remote location. The developer should be given access to a saniti
Re: (Score:2)
The application developer pool should not have access to the live production database from a remote location. The developer should be given access to a sanitised database clone.
In many the two are one and the same, and they access the database from halfway around the world. Physical access isn't always compatible with $15/hr, and you can imagine which sounds more important to the typical PHB...
Upgrade Time (Score:2)
Sounds like it's time to get rid of those Win2k servers.
Re: (Score:2)
Server 2K3 also uses PPTP, which is known to be broken, and no fix is planned from MS, despite the fact that 2K3 is still supported til next year sometime.
Telecommuting?? (Score:2)
How the bleep does the mailman get to telecommute???
Marissa Mayer is the devil incarnate - but even I'll agree, delivering the mail kinda sorta has to be done in person.
Re: (Score:2)
How the bleep does the mailman get to telecommute???
Marissa Mayer is the devil incarnate - but even I'll agree, delivering the mail kinda sorta has to be done in person.
Yes, because everyone working for the Postal Service is a mailman/woman.
They are a unique organisation in that they require no HR, planning, IT, marketing, finance, management, sales, payroll, admin or training support staff whatsoever.
Re: (Score:2)