Further details have emerged regarding the cyber espionage attacks against many federal agencies in the US widely reported some months ago.
http://arstechnica.com/security/2013/12/how-hackers-made-minced-meat-of-department-of-energy-networks/A Department of Energy network breach earlier this year that allowed hackers to download sensitive personal information for 104,000 people was the result of a decade-old patchwork of systems, some that hadn't installed critical security updates in years, according to a federal watchdog.
July's successful hack on the department's Employee Data Repository database was at least the third one to occur since 2011, DOE Inspector General Gregory H. Friedman wrote in a recently published review of the breach. The hack resulted in the exfiltration of more than 104,000 individuals' personally identifiable information (PII), including their social security numbers, bank account data, dates and places of birth, user names, and answers to security questions. The department expects to incur costs of $3.7 million setting up credit monitoring and in lost productivity. That figure doesn't include the costs of fixing the vulnerable systems.
As usual the solution is mind numbingly simple but it seems beyond the reach of most big organisations in the US and many other countries, don't connect such systems to the public internet, there is no need for any of these systems to be public facing. Having static leased lines that go from A to B would require a lot more effort to intercept and running appropriate software any attempts to "cut" into the lines would be detected, it stands to reason that you would no longer have to complain about cyber attackers if your infrastructure is not accessible to them or anyone else.
What has to happen before folks get a clue
