Signs of a Massive Cyber Security Incident

It started with an otherwise innocuous announcement earlier this week, which at the time looked like due diligence in the context of the Navy Yard shootings. This was posted Tuesday on the Submarine Force Reserve Component Facebook page.

All SFRC personnel,

NMCI has implemented new account policies. You must login into your NMCI email account every 30 days to remain active. This is not isolated to NMCI email accounts. Please access all Navy accounts at least once every 30 days to ensure continued connectivity.

If you do not have a CAC card reader, please contact your Navy Operational Support Center for assistance.

Refer to NMCI Information Bulletin (NIB) 3H, DTG 141753Z SEP 13 for a list of exceptions to this policy.

An update came on Wednesday.

UPDATE TO EARLIER POST ABOUT NMCI ACCOUNTS:

NROWS is now required to disable all accounts unused for 30 days. There are no waivers or exceptions allowed. This means that on some occasions, you will need to access your NROWS account between DWEs to prevent it from being deactivated. If your NROWS account has been disabled, you are required to contact the Helpdesk to reestablish your account.

The Helpdesk can be reached at 1-800-537-4617.

Also on Wednesday morning, in what I thought at the time was a very odd comment by the CNO in testimony before the House Armed Services Committee, the CNO listed Cyber second among his top priorities right now. At the time the CNO listing Cyber as a priority seemed very odd and out of place. In hindsight I am thinking he had something important on his mind.

This was sent by Commander, Navy Reserve Force Command

*   NMCI User Alert   *


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       *** Network Services Interruption ***

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

EVENT: *** NIPRNET Authorized Service Interruption ***

DATES/TIMES: 0400z Saturday, 21 September until 0401z Monday, 23 September 2024

(0000 ET Saturday, 21 September until 0001 ET Monday, 23 September 2024)

(2300 CT Friday, 20 September until 2301 CT Sunday, 22 September 2024)

(2200 MT Friday, 20 September until 2201 MT Sunday, 22 September 2024)

(2100 PT Friday, 20 September until 2101 PT Sunday, 22 September 2024)

(2000 AKT Friday, 20 September until 2001 AKT Sunday, 22 September 2024)

(1800 HT Friday, 20 September until 1801 HT Sunday, 22 September 2024)

SITUATION: Users may experience a NIPRNET service interruption during the time period listed above in support of a network and cyber security upgrade.

REQUIRED ACTIONS: No user actions required.

AUDIENCE: All USN NMCI Users

ASSISTANCE: Contact the NMCI Service Desk at 1-xxx-xxx-xxxx (1-xxx-xxx-xxxx) or by e-mail at ServiceDesk_Navy@xxxx-xxx.yyy. Refer to the user communication number below.

I've worked in IT at the large Enterprise level for over 20 years, and here is a tip. When users in any large organization gets an email that discusses anything related to a "cyber security upgrade" what that really means 99.9% of the time is "Incident Response."

And when a military network has an authorized network interruption of service for two days with almost no warning at all to users, that is by definition a massive response - and can only suggest a massive incident.

The information available suggests NMCI has suffered a massive security breach. Pour some coffee for your 10th Fleet shipmates, they have apparently had a busy week, and will have an even busier weekend.

It makes a lot more sense now why the CNO would suggest Cyber as one of his top priorities in a Congressional hearing over so many other more naval specific issues. When the Navy must voluntarily disrupt services to a military network for two days, clearly the Cyber issues on the CNOs mind are very serious indeed.