Mike Boyle, TCC Director of Business Development
According to a recent article on the State Tech Magazine website, last year government agencies accounted for 12.5% of all data breaches, making it the third most frequently targeted business sector. https://statetechmagazine.com/article/2021/05/employee-vulnerability-social-engineering-remains-key-threat-government
I wondered why cybercriminals think government is such an attractive target. The article explains that part of it is the type of data government agencies collect, especially personally identifiable information. In addition, many agencies whether local, state, or national, do not have the best cybersecurity programs, leaving data vulnerable to attack.
The article states that social engineering, especially spear-phishing, is the most popular type of attack. Social engineering attacks target individuals and try to get them to provide personal information to establish fake credentials, or to just give out the targeted information. This is usually in the form of sending generic messages to a large volume of people, hoping that some will disclose information or click on a malicious link.
Spear-phishing is especially dangerous because it targets individuals in a highly personal way and is therefore more likely to succeed. As stated in the article “The vast abundance of personal information available on just about anyone online makes spear-phishers’ job much easier. With over 230 data brokers selling details on 99 percent of all adult Americans, and easy access available to social media accounts, it is not difficult for a malicious actor to find out a government employee’s email address, phone number and even hobbies and interests.”
With access to personal information about a government employee, the cybercriminal can easily spoof what appears to be a legitimate request to send sensitive information via email, as data moves between agencies or departments. Or they can gain access to critical information because if the request looks valid, it is usually processed.
The article notes that some of the factors that make government systems vulnerable to this type of attack include the use of outdated legacy systems, high data volume, overly bureaucratic public processes, and inadequate government employee cybersecurity training.
These areas of vulnerability must be addressed to thwart the ever increasing risk of a cybersecurity attack.
To find out more about TCC and our work with various government agencies please visit our website https://www.e-tcc.com/
Technology, Process and Expertise 