The DNC is training staff to deflect hackers

The Democratic National Committee has been conducting spearphishing email training to help its staff learn to avoid malicious emails that could compromise security, a Democratic source tells Axios.

Why it matters: The DNC knows how badly it was hurt by the hacking attack that compromised it (as well as the Clinton campaign) in 2016, leading to a data dump of internal emails, and is trying to avoid a repeat.

The intrigue: The DNC is on high alert for malicious phishing campaigns, which trick targeted users into clicking look-alike links or file attachments and entering passwords. This week, the DNC reported to law enforcement a site that appeared to be the precursor to an attack — a fake DNC login page — but turned out to have been independently set up by Michigan Democrats without approval from the DNC.

The details: The training is sent every couple of weeks, sometimes to the entire DNC staff and other times just to certain teams, but the Democratic source would not detail exactly how it works.

In addition to the training, other preparations the DNC has taken include issuing warnings to employees about certain vendors, training staffers on cyber hygiene practices, and changing the hardware the committee uses.

Culture

The DNC has retrained staffers to assume systems are breached, according to Reuters' Joseph Menn.

• The DNC is ramping up its communications with staffers about best practices with a security checklist to confirm they’re following them, per the Democratic source. That includes checking for two-factor authentication on personal accounts, long, unique passwords, encryption on computers, and whether they’ve launched the latest security patches.
• Signs hang in the DNC bathroom reminding staffers email is not secure, per Politico.

Changes to training and vendors

The DNC has worked with Microsoft to train employees on best practices for cybersecurity, and that training will soon expand more widely to Democratic campaigns, according to CyberScoop's Chris Bing.

• The DNC has urged staffers and candidates not to use devices from Chinese Huawei and ZTE, which U.S. intelligence leaders have warned are a national security threat.
• The staff has been encouraged to use encrypted messaging apps, like Signal, per CyberScoop.
• They've switched email and data storage to Google's cloud, per Reuters.
• The DNC has replaced most Windows computers with Apple hardware and Google Chromebooks, per Reuters.
• The DNC started working with identity management firm Okta last summer, so that only devices that have been scanned to confirm their users’ identity can gain access to the DNC systems, a Democratic source told Axios.

The bottom line: The DNC is still working to get ahead of a threat that remains a problem two years after it rocked the 2016 campaign.