Cybersecurity

Cyber advice for Hill staffers

Shutterstock image (by deepadesigns): Safety concept, closed padlock on a digital background.

On Capitol Hill, every lawmaker's office has its own network, which makes cyber hygiene especially complicated for staffers.

As a prelude to the Department of Homeland Security's National Cybersecurity Awareness Month campaign taking place throughout October, a panel of government technology officials offered tips to help staffers protect their offices from phishing and identity theft attempts.

"You are your own CISO," said John Krebs, an attorney in the Division of Privacy and Identity Protection at the Federal Trade Commission. "You have to engage in risk management for yourself.... We live in a world where this is now important."

There are some tools that legislative offices can use. One Capitol Hill official told FCW on background that the Continuous Diagnostics and Mitigation cybersecurity program offered by DHS can be used on Hill networks. However, the official said Einstein cannot because using the program is not a top priority right now, and it would be difficult to implement because of the separation between the legislative and executive branches.

So managing cybersecurity risks in the absence of advanced network protection tools requires a more than basic level of cyber hygiene.

Social engineering and phishing remain among the most common cybersecurity risks, and one of the best ways to combat such attempts to gain network access is to avoid them altogether, said Randy Vickers, director of information security at the House.

"It sounds very obvious, but it's not," Vickers said. "Phishing has become a very strong campaign, and it's getting better. People use web browsers to check personal email periodically throughout the day, which is totally acceptable, but if you have something in your service provider's junk box, don't go digging through it and click on it and possibly infect [the network]. It's probably [in the junk folder] for a reason."

Another straightforward but important protection the panel recommended is to avoid simple passwords and use multifactor authentication whenever possible.

In the event that a breach or an attempt at identity theft does take place, Krebs said the FTC has websites -- such as IdentityTheft.gov -- to help users diagnose what might have happened and recover as quickly as possible.

"Dealing with identity theft is easier with a plan," he said. "What we do...is give a customizable recovery plan" that allows users to input what happened to them and offers clear and tailored instructions in terms of next steps, as well as basic information such as warning signs, legal rights and definitions.

Krebs said the FTC has bigger aims for the site, adding, "We're working right now with credit reporting agencies, hopefully the IRS, to make this a one-stop shop."

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

  • Comment
    Blue Signage and logo of the U.S. Department of Veterans Affairs

    Doing digital differently at VA

    The Department of Veterans Affairs CIO explains why digital transformation is not optional.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.