Dive Brief:

• The U.S. State Department suffered an email breach, first reported by Politico after obtaining a notice marked "sensitive but unclassified" from Sept. 7. The notice confirmed an "activity of concern" in the Department's unclassified email system, though its impact reached less than 1% of employee inboxes. No attacker has been identified.

• Following the breach, Sen. Ron Wyden, D-OR, released a letter saying "at least one major technology company" informed government officials that personal accounts and devices are targets of adversarial activity. 

• The senator said he is introducing legislation to allow the U.S. Senate Sergeant at Arms to offer cybersecurity assistance to Senate members and their staffs in the form of an opt-in solution. 

Dive Insight:

The federal government  struggles with its cybersecurity workforce, but not for a lack of trying. Officials have said finding talent they need in security is easy, retaining it is hard.

Even leadership in federal technical roles has been finicky the last 18 months. The State Department's CIO Frontis Wiggins retired late last year and Karen Mummaw has been the agency's acting CIO since.  

Before Wiggins retired, the State Department struggled to achieve adequate grades in the Federal Information Technology Acquisition Reform Act (FITARA), a scorecard put in place to aid the authority and progress of federal IT CIOs. On the latest scorecard, published in May, the Department had a low "D-."

The agency earned its highest score in CIO authority enhancement, but received failing scores for software licensing and cyber.

"Breaches should be expected where there is a failure to maintain a robust security posture," Jacob Serpa, product marketing manager at Bitglass, told CIO Dive.

The government has to compete with the salaries and more innovative opportunities than the private sector offers. As a result, the public sector's cybersecurity is where it was five or six years ago, according to Michele Thomas, CISO of the Department of Transportation, speaking at an event in Washington last month.

As noted by several federal CISOs, adversaries are attempting slow bleed attacks masked by seemingly small and insignificant actions. This tactic is common for attackers searching for a way into a system and looking to experiment with exploits.

Using methods that "appear fairly innocuous," hackers are equipping themselves to carry out a larger scale attack, said Serpa. Training employees, enacting multi-factor authentication methods and using behavior analytics tools help stop suspicious activity at first detection.