So, Why Are Senior U.S. Officials Using Gmail?
In fact, Google said the hackers, who the company alleges were based in China, were aiming for "senior" U.S. government officials. And that raises the question of what government leaders are doing using Gmail in the first place.
U.S. government officials, after all, have access to official government e-mail systems that have layer after layer of security. So how does Gmail, Google's cloud-based email service, come into play?
There's a two-layered answer.
First, Brad Shimmin, an analyst with Current Analysis, pointed out that Google, which is fighting Microsoft for enterprise customers, has been pushing hard to get government agencies -- all the way from small and local to big, federal organizations -- to move to Google Apps. And that effort seems to be working.
Late last year, for instance, the U.S. General Services Administration, which supports and manages federal agencies, announced that it was moving all of its approximately 17,000 workers to the cloud, and to Gmail in particular . The U.S. State Department, NASA and the Army also have moved some of their email services to Gmail.
Add to that list of users the cities of Seattle and Los Angeles and the D.C. government.
"Look at the Google Apps customer list and you'd be surprised at how many top government agencies utilize Gmail and other Google Apps.... It's pretty staggering," said Shimmin. "They don't tell us how many per industry, but you'll see there are quite a few government agencies using Google Apps and Gmail is a key function of Google Apps -- so you'll see it used a lot."
Most people have a work e-mail, but they also have a secondary, generally free, e-mail service for their personal use. Actually, Shimmin noted that 90 percent of Internet users have more than one e-mail address.
That means some government officials might discuss critical, security sensitive topics on their highly secure government e-mail accounts and then get their kid's soccer schedule or make dinner plans on their personal Gmail account. And they also might forward work e-mails to their personal account simply so they can read them at home.
Either way, there are a whole lot of government officials using Gmail. And that means there's some back-and-forth between personal and work accounts, as well.
And that makes the Gmail attack a bit more serious, says Dan Olds, an analyst with The Gabriel Consulting Group.
"Any Gmail hack is a bad thing for Google, but having it hit government officials is worse, since these are the people who can focus a lot of regulatory attention on them," added Olds. "Although this sounds, so far at least, like the hacking was due to users getting sucked into phishing attempts, this won't necessarily get Google off the hook."
And since the attack came in the form of a phishing scheme that tried to con users into handing over their passwords, Shimmin said Google shouldn't take a big beating over this.
"The onus lies with the individual on this one," said Shimmin. "If you don't conduct safety practices on your own and you act like an idiot and click on a link you shouldn't click on, that's not Google's fault. Google shouldn't take a beating for this, because people should have been smart enough not to fall for a phishing attack."
However, he also noted that just because Google shouldn't take the blame, that doesn't mean it won't. The allegation that it involves China and espionage makes it a high-profile attack, with Google is right in the middle of it.
"It's a black eye for Google as it is with any vendor that's caught with something this high profile," said Shimmin. "It could have been some kid in the new Jersey who launched a phishing attack. What's giving Google the biggest hit with this is that it's a strange story and it's connected with espionage and China."
As for Olds, he says it's not yet clear how this will play out for Google.
"It's hard to say if this specific incident will have a long-term effect on Google or cloud applications in general," he added. "To me, it's a drip effect where these hacks keep coming, one after the other, and could add up to a general perception that [the cloud] is just not a safe and secure way to transmit and store anything important."
Sharon Gaudin covers the Internet and Web 2.0, emerging technologies, and desktop and laptop chips for Computerworld. Follow Sharon on Twitter at @sgaudin or subscribe to Sharon's RSS feed . Her e-mail address is sgaudin@computerworld.com .
Read more about security in Computerworld's Security Topic Center.
沒有留言:
張貼留言