The U.S. Postal Service is expanding the use of its emergency records systems to cover ransomware attacks and other cybersecurity incidents.
The Emergency Management System used by USPS officials and other “officially designated individuals and agencies” to collaborate and coordinate in the face of a natural or manmade emergency, facilitate medical and fitness trainings, locate individuals caught up in an emergency, test individuals for exposure to hazards and provide information about disaster recovery programs and services.
Now, according to a Federal Register notice published Tuesday, USPS officials are updating a document that outlines the system’s use and purpose to include assisting officials “to prepare for, identify and respond to cybersecurity incidents aimed at or affecting the United States Federal Government or the Postal Service,” including ransomware incidents and the exploitation of computer vulnerabilities. The notice also adds a number of other new purposes for the system, including tracking COVID-19 vaccination status, medical evaluations and contact tracing for USPS employees, contractors and customers.
The Emergency Management System contains a host of valuable or personal data for USPS employees, contractors and their families. Among other data points, it contains the Social Security number or employee identification number, date of birth, home, work, and emergency contact information, duty location, work schedule and assigned emergency management devices for employees and contractors involved in emergency response. It will also include vaccination records and other medical tests around COVID-19 and other ongoing, pathogenic public health crises.
According to the updated notice, it may also include information about individuals “whose names have been provided to the Postal Service by government agencies or disaster relief organizations as a result of a disaster, which now includes cybersecurity incidents.”
USPS now considers it a routine use of the system to disclose these records to appropriate federal agencies in the event of a confirmed or suspected data breach, or when they determine there is “a risk of harm to individuals, the Postal Service (including its information systems, programs, and operations), the Federal Government, or national security.” It also permits the sharing of data between agencies when it is deemed necessary to assist the agency in its response to a breach.
The agency claims that paper and electronic records for the system are located in “controlled-access areas” and under supervision to limit access to authorized personnel. Contractors and licensees for the system are also subject to unannounced security audits.
System of Records Notices (SORN) provide the public with transparency around how agencies plan to use a particular software system, the types of data it collects or stores, for how long and which categories of people will be affected. They’re also meant to outline potential negative outcomes from collecting or holding on to such data, both in terms of what the government may do with them and the impact if that data is leaked, exposed or compromised by malicious hackers.
The expansion will put reams of new personal and professional data around USPS employees and contractors (and potentially their families) into the federal information ecosystem. According to the USPS Inspector General, the agency suffered a “significant” data breach in 2014 that cost millions of dollars and resulted in the exposure of personal data for more than 800,000 current and former career and non-career employees. The incident led to the creation of a Corporate Information Security Office and a Cybersecurity Operations Center at USPS dedicated to detection and response to cybersecurity threats.
However, tests conducted by auditors of the agency’s identification and response capabilities in February and March 2020 found multiple failures by the CISO around detecting malicious activity on the USPS network, concluding that “active threats could go undetected, possibly leading to theft and modification of data or impact on the availability of critical systems.”
The report also found that the CISO hadn’t developed metrics to gauge the effectiveness of their incident response capabilities and that some cybersecurity incident response tickets detailing possible ongoing threats remained open for more than a year without any status updates.
Our mission for 2022 is to eliminate ransomware damage.
Utilities is a particularly enticing industry for ransomware gangs to target because the nature of the industry means it provides vital services to people and businesses, and if those services can’t be accessed, it has an impact – as demonstrated by the ransomware attack against Colonial Pipeline, which led to gas shortages in the north eastern United States. The incident saw Colonial paying a ransom of millions to cyber criminals in order to receive the decryption key.
Ransomware attacks against retailers can also have a significant impact, forcing shops to be restricted to taking cash payments, or even forcing them to close altogether while the issue is resolved, preventing people from buying everyday items they need.
Other sectors that were significant targets for ransomware include education, government and industrial services, serving as a warning that no matter which sector they operate in, all organisations could be a potential target for ransomware.
There is no organization in any sector that is safe from ransomware except those that utilize Helix22 data security SDK.
Growing ransomware attacks come as no surprise to us at BLAKFX as we have set out to eliminate ransomware as a threat…Period.
Review Helix22 API, examples and documentation on our GIT
Our Motto
In Math We Trust
Ransomware Auditing as a Service (RaaS): as ransomware attacks have skyrocketed, they have come to represent the biggest threat to the data of government agencies, military, intelligence agencies as well as private enterprises. BLAKFX developed the first in the world Ransomware Auditing as a Service (RaaS) platform which allows our cyber security engineers to scan your network and simulate real-world ransomware attacks to test the prevention, detection and mitigation strategies of your organization and establish how resilient your network is to real ransomware attacks. After the scan we provide a comprehensive report and our recommendations for remediation.
If you are the victim of an actual ransomware attack, we are able to recover the data that has been hi-jacked during the attack and due to Helix22’s patented DNA BindingTM cryptography, restore it to its original state.
D2D encryption:
We can make this restoration claim as the tech engineers at BLAKFX invented and holds multi-patents on a genuine device2device (D2D) encryption. We manage data security transmission through the truly brilliant and also patented universal Helix22 key service. The Helix22 encryption originates on your network or device, not just when the app is opened. This means, that when data arrives to our key server, it is already encrypted so all it needs to do is issue another key. Signal and Telegram cannot claim this level of security. This key will then only work with the intended device, which generates a matching key required to open the data. In this protocol, we are truly a “zero-knowledge” server so your communications and transmissions remain completely top secret. Even in the event that BLAKFX were subpoenaed, we can honor the request by just handing over the encrypted content…as that is literally all we have. Helix22 also only use keys just one-time and then destroys them. This way the data security is future forward prefect. Therefore, in our unique device-to-device encryption (D2D) world, there is no opportunity at all for any data leak.
This same protocol just described, can be the same with all your 3rd party vendors and suppliers. It does not matter in the least what platform they are running or what device they are using or even the type of data, it is all 100% protected. We do however, strongly advise that all firms involved be utilizing Helix22 due to the nature of the data content. Helix22 can ensure that whatever data they are generating is protected as well.
Let’s take it a step further. Even if your organization were a victim of an internal attack or a victim of malicious open source downloads, there is no reason for concern. Any data that has been forwarded, downloaded, copied or saved cannot be exfiltrated. Period. We have the technology industries foremost data packets which are protected with multi-layered, military grade encryption algorithms that have already proven the ability to withstand penetration testing from MI5 and quantum computing attacks.
One final practical genius of DNA BindingTM is in that it is immediately compatible with whichever system or software you are utilizing. Therefore, any organization can forward information to another and then discuss it and there is immediate privacy.
Finally, the Helix22 encryption is quantum computing ready so no need to redo all your data security methodologies in a couple of years when everything else becomes obsolete.
In the BLAKFX data security world, ransomware or any other data centric attack cannot have any affect on your systems or data.
The Helix22 data security SDK accomplishes the following:
- Protects all your firms data at rest, in use and in transit
- Renders ransomware threats obsolete
- Eliminates human error
- Eliminates all malicious or interior attacks
- Verifies original content i.e. minimizes the threat of impersonation attacks and deep fakes
- Reduces latency
- Installs with 5 lines of code
- Runs on any platform, network, device and in any programming language i.e. Internet of Things enablement
- Provides perfect future/forward secrecy
- Delivers “zero-knowledge” encryption
- Perfect security when utilizing all SaaS products
- Compatible with all cloud, 3rd party and vendor services
- Secures the Internet of Things by providing protection at the Edge with ultra low latency
- Ensures privacy and security for blockchain and all cryptocurrency transactions
- Is quantum ready – so there’s no need to upgrade when the time comes
- Requires no employee training
- Exceeds all gov’t and banking standards
- Meets compliance regulations
BLAKFX is Based on Success
Our founders, Robert Statica PhD and Kara Coppa, also founded Wickr, which is used by the US military and has never been hacked since its inception in 2012. The Helix22 data security SDK is several generations enhanced since then. Dr. Statica also delivered the encryption for the world’s most secure phone, Katim.
Founder – Robert Statica PhD Founder – Kara Coppa Founder – Alex Maslov MS, MBA
Co-Founders of Wickr KatimTM Ultra Secure Smartphone
