Congress on Juniper patches: What took so long?

Multiple Congressmen pressed the CIO of the Treasury Department on why it took the agency eight weeks to patch all of its systems that were using Juniper Networks’ software that was found be vulnerable to cyber attacks.

Lawmakers pressed the CIO of the Treasury Department hard Wednesday on why it took the agency eight weeks to patch all of its systems that were using Juniper Networks’ software — found to be vulnerable to cyber attacks.

Members of the House Committee on Oversight and Government Reform’s IT subcommittee pushed Treasury CIO Sonny Bhagowalia to explain his strategy for mitigating the threat related to Juniper’s products in the wake of the company’s December discovery of a back door in its NetScreen product.

The California-based company discovered the back door would allow sophisticated hackers to control the firewall of un-patched Juniper products and decrypt network traffic. The company’s products are used by a number of government agencies, including the departments of Defense, Justice and Treasury.

Bhagowalia told the subcommittee that Treasury moved into a plan of action hours after learning of the vulnerability, patching highly critical systems within a day, and 84 percent of systems using Juniper within a week. However, due to the remaining systems having a low-risk profile, Treasury did not fully completely patching systems using Juniper products for two months.

This timeline came under criticism from Rep. Will Hurd, R-Texas, the subcommittee’s chairman.

“This is absolutely unacceptable,” Hurd said in his opening remarks. “The inability of federal agencies to maintain a comprehensive view and inventory of their information systems and respond to Congress in a timely manner cannot be the status quo.”

[Read more: Congress demands info on Juniper back door]

Vulnerabilities in the State Department Consular Consolidated Database were also examined, following a recent ABC News report stating that experts found security gaps that could have allowed hackers to doctor visa applications or pilfer sensitive data like photographs, fingerprints and social security numbers.

Rep. Gerry Connolly, D-Virginia, told State Department CIO Steven Taylor that more needs to be done to close those holes given the hundreds of thousands of data points that system holds.

“If I were up to no good, I would look for low-hanging vulnerable fruit,” Connolly said. “The subcommittee has found lots of that.”

The two scenarios were held up as examples of how the federal government needs to shore up its mitigation protocols. Andy Ozment, director of the Department of Homeland Security’s National Protection and Programs Directorate, said while agencies are responsible for their own cybersecurity risk, DHS programs like Einstein and Continuous Diagnostics and Monitoring are helping the government close the gaps.

Yet even as CDM’s first phase comes close to being implemented across the federal civilian government, Ozment said systems that lack patches or security support still give him cause for worry/

“I think this is a major problem,” Ozment said in response to a question from Rep. Blake Fahrenthold, R-Texas. “I will tell you we scan agencies externally and we look for critical vulnerabilities. An unsupported device is a critical vulnerability. Some of our most challenging discoveries in that process is finding unsupported devices at smaller agencies.”

As far as Juniper’s role in the vulnerability’s discovery, Ozment said the company should be viewed as a victim, doing “a very responsible job” in working with DHS to get the word out.

“I salute them for working to make their customers safe,” he said.

Rep. Ted Lieu, D-Calif., took the opposite stance given that Juniper was invited to hearing the declined, leading him to believe “it insinuates they have something to hide.”

“[Juniper] aren’t the victims, the U.S. government and the American people are,” Lieu said. “We need to view this in a whole different lens. When products are made to try to protect the government and they fail, the companies are not the victims.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure