OPM vs. APT: How Proper Implementation of Key Controls Could Have Prevented a Disaster

Advanced Persistent Threat (APT) has been a leading buzz phrase in the security industry for most of the past decade. In some cases breached organizations have attempted to deflect attention away from their inadequate security by saying, in essence, the attack was APT we could not have defended ourselves. In April of 2015 the U.S. Office of Personnel Management detected a breach of its systems that would ultimately be determined to have exposed the personal information of up to 25.7 million people. While APT styleattackers are very difficult to defend against not all of their attacks are as advanced as one might think. The OPM attack could have been defended against with existing tools and techniques documented in the Top 20 Critical Security Controls and in NIST 800-53. In particular two factor authentication and effective logging and activity analysis would have made the attack more difficult to perpetrate successfully.