Cyber advice for Hill staffers

Shutterstock image (by deepadesigns): Safety concept, closed padlock on a digital background.

On Capitol Hill, every lawmaker's office has its own network, which makes cyber hygiene especially complicated for staffers.

As a prelude to the Department of Homeland Security's National Cybersecurity Awareness Month campaign taking place throughout October, a panel of government technology officials offered tips to help staffers protect their offices from phishing and identity theft attempts.

"You are your own CISO," said John Krebs, an attorney in the Division of Privacy and Identity Protection at the Federal Trade Commission. "You have to engage in risk management for yourself.... We live in a world where this is now important."

There are some tools that legislative offices can use. One Capitol Hill official told FCW on background that the Continuous Diagnostics and Mitigation cybersecurity program offered by DHS can be used on Hill networks. However, the official said Einstein cannot because using the program is not a top priority right now, and it would be difficult to implement because of the separation between the legislative and executive branches.

So managing cybersecurity risks in the absence of advanced network protection tools requires a more than basic level of cyber hygiene.

Social engineering and phishing remain among the most common cybersecurity risks, and one of the best ways to combat such attempts to gain network access is to avoid them altogether, said Randy Vickers, director of information security at the House.

"It sounds very obvious, but it's not," Vickers said. "Phishing has become a very strong campaign, and it's getting better. People use web browsers to check personal email periodically throughout the day, which is totally acceptable, but if you have something in your service provider's junk box, don't go digging through it and click on it and possibly infect [the network]. It's probably [in the junk folder] for a reason."

Another straightforward but important protection the panel recommended is to avoid simple passwords and use multifactor authentication whenever possible.

In the event that a breach or an attempt at identity theft does take place, Krebs said the FTC has websites -- such as -- to help users diagnose what might have happened and recover as quickly as possible.

"Dealing with identity theft is easier with a plan," he said. "What we give a customizable recovery plan" that allows users to input what happened to them and offers clear and tailored instructions in terms of next steps, as well as basic information such as warning signs, legal rights and definitions.

Krebs said the FTC has bigger aims for the site, adding, "We're working right now with credit reporting agencies, hopefully the IRS, to make this a one-stop shop."

About the Author

Chase Gunter is a former FCW staff writer.


  • Comment
    customer experience (garagestock/

    Leveraging the TMF to improve customer experience

    Focusing on customer experience as part of the Technology Modernization Fund investment strategy will enable agencies to improve service and build trust in government.

  • FCW Perspectives
    zero trust network

    Why zero trust is having a moment

    Improved technologies and growing threats have agencies actively pursuing dynamic and context-driven security.

Stay Connected