COME ON OVER WHEN YOU’RE READY.
>> GOOD AFTERNOON.
WHAT HAPPENED?
HOW DID IT HAPPEN AND WHAT ARE
WE DOING ABOUT?
HACKERS LAUNCHED A BROAD EFFORT
TO COMPROMISE THE NETWORK
MANAGEMENT SOFTWARE USED BY
GOVERNMENT AND THE PRIVATE
SECTOR.
INTELLIGENCE COMMUNITY IS
LOOKING AT WHO IS
RESPONSIBILITY.
UNTIL THAT STUDY IS COMPLETE,
I’LL USE THE LANGUAGE WE
PREVIOUSLY USED WHICH WAS TO
SAY, AN ADVANCE PERSISTENT
THREAT ACTOR LIKELY RUSSIAN
ORIGIN WAS RESPONSIBLE.
AS OF TODAY, NINE FEDERAL
AGENCIES AND ABOUT 100 PRIVATE
SECTOR COMPANIES WERE
COMPROMISED.
AS YOU KNOW, ROUGHLY 18,000
ENTITIES DOWNLOADS THE MALICIOUS
UPDATE SO THE SCALE OF POTENTIAL
KNOWN COMPROMISES.
MANY ARE TECHNOLOGY COMPANIES
INCLUDING NETWORKS OF COMPANIES
WHOSE PRODUCTS COULD BE USED TO
LAUNCH ADDITIONAL INTRUSIONS.
WHY DOES THIS MATTER?
WHY IS THIS SIGNIFICANT?
THE TECHNIQUES THAT WERE USED
LEAD US TO BELIEVE THAT ANY
FILES OR E-MAILS ON A
COMPROMISED NETWORK WERE LIKELY
TO BE COMPROMISED.
THE SCOPE AND SCALE OF OUR
INVESTIGATION IS UNDER WAY AND
WE LOOK FORWARD TO PROVIDING YOU
FUTURE UPDATES IN THE FUTURE.
HOW DID THIS HAPPEN?
THERE’S TWO PARTS TO THAT.
THEM AND US.
THE ACTOR WAS A SOPHISTICATED,
ADVANCED PER SIS TENT THREAT.
ADVANCED BECAUSE THE LEVEL OF
KNOWLEDGE THEY SHOWED ABOUT THE
TOKE
TECHNOLOGY AND THE WAY THEY
COMPROMISED IT WAS
SOPHISTICATED.
THEY FOCUSED ON THE IDENTITY
PART OF THE NETWORK WHICH IS THE
HARDEST TO CLEAN UP.
THREAT, THE SCOPE AND SCALE TO
NETWORKS, TO INFORMATION MAKES
THIS MORE THAN AN ISOLATED CASE
OF ESPIONAGE.
THEN, US.
THERE’S A LACK OF DOMESTIC
VISIBILITY.
WE CHOOSE TO HAVE PRIVACY AND
SECURITY.
THE HACKERS LAUNCHED THE HACK
FROM INSIDE THE UNITED STATES
WHICH FURTHER MADE IT DIFFICULT
FOR THE U.S. GOVERNMENT TO
OBSERVE THEIR ACTIVITY.
EVEN WITHIN FEDERAL NETWORKS, A
CULTURE AND AUTHORITIES INHABIT
VIZ BT WHICH IS SOMETHING WE
NEED TO ADDRESS.
I WANT TO TAKE A MOMENT TO THANK
THE PUBLIC AND PROOIFRT SECTOR
NETWORK DEFENDERS WHO HAVE BEEN
WORKING VERY HARD TO FIND AND
EXCEL THESE ADVERSARIES FROM
GOVERNMENT AND PROOIFRT SECTOR
NETWORKS.
FINALLY AND MOST SIGNIFICANTLY,
WHAT ARE WE GOING TO DO ABOUT
IT.
THREE THINGS.
FIRST, FINDING AND EXPELLING THE
ADVERSARY.
SECOND, BUILDING BACK BETTER TO
MODERNIZE FEDERAL DEFENSES AND
REDUCE THE RISK OF THIS
HAPPENING AGAIN.
FINALLY, POTENTIAL RESPONSE
OPTIONS TO THE PERPETRATORS.
FIRST, FINDING AND EXPELLING THE
ADVERSARY.
WE’RE COORDINATING THE RESPONSE
FROM THE NATIONAL SECURITY
COUNCIL.
I WAS ON THE HILL LAST WEEK, AT
HILL DISCUSSIONS THIS WEEK AND
WILL BE ON THE HILL NEXT WEEK AS
WELL.
WE’RE WORKING CLOSELY WITH DAILY
CONVERSATIONS.
IN ARE LEGAL BARRIERS TO THE
PRIVATE SECTOR SHARING
INFORMATION WITH THE GOVERNMENT.
THAT IS MANAGER WE NEED TO
OVERCOME.
FINALLY, THIS IS CHALLENGING.
THIS IS A SOPHISTICATED ACTOR
WHO DID THEIR BEST TO HIDE THEIR
TRACKS.
WE BELIEVE IT TOOK THEM MONTHS
TO PLAN AND EXECUTE THIS
COMPROMISE.
IT WILL TAKE US SOME TIME TO
UNCOVER THIS LAYER BY LAYER.
SECOND, BUILDING BACK BETTER TO
MODERNIZE FEDERAL DEFENSES.
WE’RE COMMITTED TO REDUCING THE
RISK THIS HAPPENS AGAIN.
IF YOU CAN’T SEE A NETWORK, YOU
CAN’T DEFEND A NETWORK.
FEDERAL NETWORKS CYBER SECURITY
NEED INVESTMENT AND MORE
INTEGRATED APPROACH TO PROTECT
AND BLOCK SUCH THREATS.
WE’RE ALSO WORKING ON CLOSE TO
ABOUT A DOZEN THINGS.
EVERY PART OF AN UPCOMING
EXECUTIVE ACTION TO ADDRESS THE
GAPS WE IDENTIFIED IN OUR REVIEW
OF THIS INCIDENT.
FINALLY, IN TERMS OF RESPONSE TO
THE PERPETRATOR.
DISCUSSIONS ARE UNDER WAY.
I KNOW SOME YOU HAVE WILL WANT
TO KNOW WHAT KIND OF OPTIONS ARE
BEING CONTEMPLATED.
I WILL SHARE HOW I FRAME THIS IN
MY OWN MIND.
THIS ISN’T THE ONLY CASE OF
MALICIOUS CYBER ACTIVITY OF LIKELY RUSSIAN ORIGIN.
LIKELY RUSSIAN ORIGIN.