Eric Geller

Eric Geller @ericgeller

@B52Malmet If there is one takeaway I can leave you with, based on my experience talking to people who do this work, it's that the struggle to find evidence of compromises across a sprawling web of IT systems is NOT the result of an inside job. — PolitiTweet.org

Eric Geller @ericgeller

@Zathras3 Absolutely. But I don't feel qualified to say whose fault, since the particulars of defending against this kind of attack are above my pay grade. — PolitiTweet.org

Eric Geller @ericgeller

Security firm Symantec says more than 100 of its customers received the infected SolarWinds software updates, but it doesn't see evidence that the hackers did anything further in those networks. https://t.co/Q0fdC1b4QL https://t.co/dE5MA0WyTd — PolitiTweet.org

Eric Geller @ericgeller

SolarWinds is also "ubiquitous" among local governments, a cyber expert told @DavidUberti. Some governments now fear that a compromise through this cyber espionage campaign could lead to criminal ransomware attacks. https://t.co/KWvM1LFTNL https://t.co/OVXBV6k1vY — PolitiTweet.org

Eric Geller @ericgeller

"People are finding it everywhere." Good @bobmcmillan story on SolarWinds' private-sector footprint: https://t.co/2GdVYt54nz https://t.co/amhlxtSN75 — PolitiTweet.org

Eric Geller @ericgeller

@Zathras3 Maybe "fair" is the wrong word, but think about it this way: If CDM is catching a lot of stuff but not the top-tier outlier attacks, does that constitute a failure, or should expectations for the program be adjusted? — PolitiTweet.org

Eric Geller @ericgeller

"Lucky for us, so far, the systems’ doors were simply opened," the staffer added. "The buildings were not destroyed." — PolitiTweet.org

Eric Geller @ericgeller

Some on the Hill think the SolarWinds crisis has highlighted federal cyber leadership issues. "No one's in charge," staffer told me. "Incidents are fleeting, and best we can do is posthumous analysis." Committee structure isn't effective for oversight either, they said. — PolitiTweet.org

Eric Geller @ericgeller

CDM point is worth considering. What IS the value of such an expensive program if it can't catch the attacks that represent the biggest threat? Then again, is it fair to judge CDM by its failure to catch what everyone agrees is an outlier attack, a super-sophisticated scheme? — PolitiTweet.org

Eric Geller @ericgeller

Readout of last night's CISA briefing for congressional staff, from a staffer: * Some agencies didn't turn in emergency directive reports on time * ED led one agency to discover breach (@snlyngaas first reported) * Concern about value/efficacy of $6b CDM monitoring program — PolitiTweet.org

Eric Geller @ericgeller

imagine wanting this — PolitiTweet.org

Eric Geller @ericgeller

@kristenkbates OMG — PolitiTweet.org

Eric Geller @ericgeller

Can confirm: NIH and State were breached, per a U.S. official. They join Treasury, NTIA, DHS, and USDA on the list of agencies known to be compromised so far. https://t.co/nezpzKWiNz — PolitiTweet.org

Eric Geller @ericgeller

@harryjhurley never be afraid to share your hot takes — PolitiTweet.org

Eric Geller @ericgeller

Will leave you with this, from the NYT story: "Analysts said it was hard to know which was worse: that the federal government was blindsided again by Russian intelligence agencies, or that when it was evident what was happening, White House officials said nothing." — PolitiTweet.org

Eric Geller @ericgeller

"If this actor didn’t hit FireEye, there is a chance that this campaign could have gone on for much, much longer," a FireEye executive told Bloomberg, adding that they "looked through 50,000 lines of source code" to discover the SolarWinds backdoor. https://t.co/raFdXzaa1L — PolitiTweet.org

Eric Geller @ericgeller

There's still a lot we don't know about this crisis. I'm still working to confirm a few agencies that I've heard have been hacked. Also, NYT reported today that the govt first learned about all this from FireEye, after it investigated its own breach: https://t.co/VRr6gj9lLB — PolitiTweet.org

Eric Geller @ericgeller

CISA has roughly 2,200 employees, but only a small portion of them are digital firefighters who swoop into agencies to help respond to crises like this. “NSA we aren’t,” a CISA employee told me, referring to the gulf b/w the workforces of the defensive and offensive agencies. https://t.co/4seDdC8O8R — PolitiTweet.org

Eric Geller @ericgeller

Expanding crisis has put new pressure on CISA just as it recovers from Trump's firing of its longtime director. There are Qs about whether CISA has enough personnel to help the govt recover from this. “They are overwhelmed,” U.S. official said. CISA says it's ready. https://t.co/CgUPG1gBEK — PolitiTweet.org

Eric Geller @ericgeller

The NSC will also hold two daily communications meetings to make sure everyone's on same page. There's no evidence that classified systems have been compromised, but on the other hand, an official told me, "We don't know what has been taken" from unclassified systems. — PolitiTweet.org

Eric Geller @ericgeller

The NSC CRG, following an Obama-era directive, established a Unified Coordination Group to streamline agencies' crisis collaboration. "We're declaring this a significant cyber event," U.S. official said, using term reserved for crises such as NotPetya. — PolitiTweet.org

Eric Geller @ericgeller

NSC mtg of Cyber Response Group yielded some progress — govt has a list of hacked agencies, tho more could emerge — but officials still don't know what hackers stole. "We are in very, very early days," official said, "and there's a sense that...the news is going to get worse." — PolitiTweet.org

Eric Geller @ericgeller

New: Inside the deepening crisis consuming the federal govt as agencies scramble to figure out if they've been hacked. "This is probably going to be one of the most consequential cyberattacks in U.S. history,” a U.S. official told me. https://t.co/CqPCmbnOpM https://t.co/P8MztzFdHV — PolitiTweet.org

Eric Geller @ericgeller

In retrospect, writing this story prepared me well for our current world. https://t.co/NKc8KR1mFj https://t.co/67DTiWaWet — PolitiTweet.org

Eric Geller @ericgeller

@SangerNYT And you can draw a straight line between the lack of comprehension and the persistence of the problem. — PolitiTweet.org

Eric Geller @ericgeller

@GoshZilla yes! — PolitiTweet.org

Eric Geller @ericgeller

@billkuchman Boba Fett reaching a decision about whether to do the thing: https://t.co/xvd8czvzdU — PolitiTweet.org

Eric Geller @ericgeller

"Let me say it again," Biden said. "His own cybersecurity chief overseeing this election said it was the most secure in American history." Most mentions of "cybersecurity" in a Biden speech thus far? — PolitiTweet.org

Eric Geller @ericgeller

Biden referenced @C_C_Krebs in his speech tonight: "Even President Trump's own cybersecurity chief, overseeing our elections, said it was the most secure election in American history, and summarily was let go." — PolitiTweet.org

Eric Geller @ericgeller

Also, the award for Best Line of Dialogue in #TheMandalorian so far goes to Boba Fett for "Let's just say they might recognize my face." — PolitiTweet.org