Blog
← Back to Blog
February 18, 2019 general

Presidents Day 2019: Learning from Government's Data Breach Disasters

Government data security

It's Presidents Day, a good time to reflect on government and leadership. This year, let's focus on an area where government consistently fails: protecting data from breaches.

In just the past few years, federal agencies have lost:

These aren't small businesses with limited IT budgets. These are federal agencies spending billions on cybersecurity and still getting breached regularly. So what can small dental practices, law firms, medical offices, and accounting firms learn from government's spectacular failures?

Failure 1: Ancient IT Infrastructure

The federal government runs on IT systems built in the 1970s, 80s, and 90s. These systems were never designed for modern threats. They're held together with patches and workarounds, running on hardware that should have been retired years ago.

The OPM breach happened partly because they were running systems from the 1980s with known security vulnerabilities that couldn't be patched without breaking critical functionality.

The Small Business Parallel:

How many practices are running Windows 7 or older? How many are using practice management software from the early 2000s because "upgrading is expensive" or "we know how this version works"?

Old systems accumulate security debt. Every year you delay upgrading, the debt grows. Eventually, either you pay to upgrade proactively, or you pay for emergency replacement after a breach. The latter costs more.

What to Do:

Replace or upgrade systems on a schedule, before they become security liabilities. Plan for IT lifecycle management, not just "use it until it breaks."

Failure 2: Too Many Contractors With Too Much Access

Many of the most damaging government breaches involved contractors or third-party vendors with excessive access to sensitive systems.

Edward Snowden was a contractor. Reality Winner was a contractor. The OPM breach was enabled partly by contractors with broad access. Government agencies outsource heavily, but often don't properly control or monitor that access.

The Small Business Parallel:

Your practice has vendors too. The company that maintains your practice management software. The service that handles your billing. Your IT support company. The temp agency that provides seasonal staff for tax season.

How many of these vendors have remote access to your systems? Do you know what they're accessing? When was the last time you reviewed vendor permissions?

What to Do:

Implement least-privilege access for vendors. They should only have access to what they need, nothing more. Review vendor access quarterly and revoke it promptly when contracts end.

Failure 3: Incident Response Is Slow and Chaotic

When government agencies discover breaches, their response is often slow, poorly coordinated, and inadequately communicated.

The OPM breach was discovered in April 2015, but the intrusion had been ongoing since 2014. The public wasn't notified until June 2015. That's over a year from intrusion to public disclosure.

Part of the problem is bureaucracy. Part is lack of clear incident response plans. Part is hoping the problem will go away if they ignore it.

The Small Business Parallel:

Most small businesses have zero incident response plan. When something goes wrong, people panic and make reactive decisions. Nobody knows who's in charge. Nobody knows who to call for help. Nobody knows what to tell patients or clients.

What to Do:

Write a simple incident response plan before you need it. One page is fine. It should answer: Who's in charge? Who do we call? How do we contain the problem? When do we notify affected people? Who talks to the media/public?

Failure 4: Security Theater Over Real Security

Government is great at security theater. Impressive-sounding policies, elaborate compliance frameworks, multiple layers of audits and certifications. But underneath all that paperwork, actual security is often weak.

Agencies pass their FISMA audits and then get breached because they focused on checking compliance boxes instead of actually securing systems.

The Small Business Parallel:

HIPAA compliance doesn't mean you're secure, it means you're compliant. Passing your cyber insurance security questionnaire doesn't mean you're protected. Having an IT security policy doesn't help if nobody follows it.

What to Do:

Focus on security fundamentals that actually protect you: backups, MFA, patching, training, limiting access. Don't just check compliance boxes.

Failure 5: Budget Priorities Are Wrong

Government spends billions on cybersecurity, but often on the wrong things. Money goes to buying expensive tools and services while basic hygiene (patching, configuration management, access controls) gets neglected.

It's easier to buy a new security product than to do the hard work of fixing underlying problems.

The Small Business Parallel:

Small businesses also spend money on shiny security products (antivirus, firewalls, monitoring services) while neglecting fundamentals.

A practice will spend thousands on fancy security software but won't budget for replacing a five-year-old server. A law firm will buy endpoint protection but won't pay for staff security training.

What to Do:

Prioritize basics: good backups, updated systems, MFA, trained staff. Once those are solid, then consider additional security tools.

What Government Actually Does Right

To be fair, government isn't all bad at security. Some things work:

Mandatory MFA

Most government systems now require multi-factor authentication. It's annoying, but it works. Small businesses should copy this for email, financial systems, and remote access.

Encryption Requirements

Government has clear standards for encrypting data at rest and in transit. Laptops get encrypted. Backups get encrypted. Transmissions use strong encryption. Small practices should do the same.

Regular Training

Government employees get cybersecurity training regularly. It's often tedious, but at least it happens. Small businesses should train staff quarterly on phishing, passwords, and basic security.

Security Clearances and Background Checks

Government vets people before giving them access to sensitive systems. Small practices should do basic background checks on employees who will handle sensitive data or have system access.

The Lesson: Size Doesn't Equal Security

The big takeaway from government's data breach disasters is that throwing money and people at security doesn't automatically make you secure.

What makes you secure is:

Small businesses can be more secure than massive government agencies by being intentional, focusing on fundamentals, and moving quickly when problems arise.

This Presidents Day, learn from government's mistakes. You have advantages they don't: you're small, you're agile, and you can make decisions quickly. Use those advantages to build better security than bureaucracies with billion-dollar budgets.