DNC pushes employees, campaigns to embrace email security habits ahead of midterms

Chief Technology Officer Raffi Krikorian and his team have been using a phishing simulation platform named Wombat to challenge their colleagues to spot fake malicious emails.

Staffers at the Democratic National Committee are getting better at spotting phishing emails, a skill that became a top priority after Russian-linked hackers breached the DNC during the 2016 U.S. presidential campaign, according to Chief Technology Officer Raffi Krikorian.

Krikorian and his team have been challenging their colleagues to spot fake malicious emails. Since September of last year — primarily through a phishing simulation platform named Wombat — the DNC’s tech team has been targeting co-workers as part of a broad effort to evaluate internal cybersecurity risks. Staffers are graded on their ability to spot, report and avoid emails that in a real-world scenario might carry malware.

The ongoing exercise is helping Krikorian and DNC Chief Information Security Officer Bob Lord learn how often any person in the organization is likely to click a suspicious email attachment.

“People have such PTSD about what happened in 2016 that there’s a real desire to improve [security] here,” Krikorian said in a phone interview with CyberScoop. “We’re at a point now where recently when our CFO sent a staff email it included the line ‘this is not a phishing email.’ That’s how aware people are of the threat, today.”

For now, the program extends to DNC headquarters staff, state parties and campaigns officially backed by the DNC. Over the next few months, the plan is to expand the phishing tests to other Democratic campaigns vying for a congressional seat in the 2018 midterms.

The overall goal is improve the baseline security practices of a wide group of users that includes in-house staffers, candidates and volunteers spread across the country.

“Nearly 80 percent of our users are now either not clicking or at least asking questions about it beforehand,” Krikorian explained. “Being realistic we’ll probably never get to 100 percent compliance but we’re working on it … it’s important that people flag something, anything that seems suspicious … A lot of that happens through Signal to Bob [Lord] or to our help desk, so that we’re informed.”

Signal is an encrypted communications app that’s now widely used inside the DNC as a substitute to traditional email.

The DNC wants to get Democrats to follow a five-point checklist of best security practices that Krikorian recently distributed.

The recommendations include directions to adopt two-factor authentication (2FA) where applicable for account logins and downloading a password manager. For example, the DNC has been pushing all its staff to configure 2FA for both their professional and personal email accounts.

In a recent “data bootcamp” event held last week, Lord and others called on all campaign organizers with administrator access to NGPVan, a privately owned voter database and web hosting service provide, to immediately set up 2FA.

“If we get hacked again it won’t happen like how it happened in 2016,” Krikorian said. “If we can just raise the baseline security of most people and the campaigns, if we can do the simple things right, than it will have a disproportionally positive effect.”

Krikorian declined to comment on any specific, possibly nation state-linked hacking attempts made against the DNC in recent months.

The DNC provided CyberScoop with its list of security recommendations. It had not been previously made public:

[documentcloud url=”http://www.documentcloud.org/documents/4571552-DNC-Infosec-Basics-Checklist-2018-06-19.html”]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure