House hearing will focus on cyber-incident response at State, Treasury
The Departments of State and Treasury will be in the hot seat next week during a planned House Committee on Oversight and Government Reform subcommittee hearing on federal cybersecurity practices.
In a memo obtained by FedScoop, full committee Chairman Rep. Jason Chaffetz, R-Utah, says the hearing will focus on detection and mitigation efforts related to two high-profile security incidents: the gaps found in the security of the State Department’s Consular Consolidated Database and the vulnerabilities revealed December in Juniper Networks’ firewall software. Treasury is one of many federal agencies that was using Juniper’s software, known as NetScreenOS, at the time.
Among the witnesses expected at the hearing are Treasury Chief Information Officer Sonny Bhagowalia, State CIO Steven Taylor, and Homeland Security Department’s Assistant Secretary for Cybersecurity and Communications Andy Ozment.
Last month, ABC News published a report stating that experts found security gaps in the State Department database that could have allowed hackers to doctor visa applications or pilfer sensitive data like photographs, fingerprints and social security numbers. That database — which holds biometric data from almost everyone who has applied for a U.S. passport or visa in the past two decades — has had technical issues in the recent past, going offline for a significant amount of time in 2014 and 2015.
[Read more: Congress demands info on Juniper backdoor]
In the wake of the Juniper vulnerability, the House Oversight committee sent letters to various government agencies asking if their IT security teams issued patches to systems using NetScreenOS. Last December, the company discovered “unauthorized code” that would allow sophisticated hackers to control the firewall of un-patched Juniper products and decrypt network traffic.
The company’s products are used by a number of government agencies, including the departments of Defense, Justice and Treasury.
Also scheduled to appear at the hearing are Richard Barger, chief intelligence officer for ThreatConnect, and Charles Carmakal, vice president of Mandiant. Barger previously served as a U.S. army intelligence analyst while Carmakal’s expertise is in large and complex security incident response.
The hearing is scheduled for Wednesday, April 20 at 9:30 a.m.
Contact the reporter on this story via email at greg.otto@fedscoop.com, or follow him on Twitter at @gregotto. His OTR and PGP info can be found here. Subscribe to the Daily Scoop for stories like this in your inbox every morning by signing up here: fdscp.com/sign-me-on.
