• Susan Gordon, former principal deputy director of national intelligence, says the massive cyberattack targeting federal agencies “will take years to overcome."
• Top agencies, including the departments of Homeland Security, Treasury, Commerce and the National Nuclear Security Administration, were targets of the monthslong security breach.
• Authorities say the attackers entered the Fed's systems through a third party vendor, an IT company called SolarWinds.

Susan Gordon, former principal deputy director of national intelligence, told CNBC that the massive cyberattack targeting federal agencies "will take years to overcome" as senior intelligence officials report there is little doubt the Russians were the perpetrators and that they're still at it.

"Information is the power and the target, and attackers are going to go after it," said Gordon. "This is a big deal. This is bad for national security, it is bad for the cybersecurity discipline, the professionals and the craft."

Top agencies, including the departments of Homeland Security, Treasury, Commerce and the National Nuclear Security Administration, were targets of the monthslong security breach. The scope of the Russian hack is widening, and authorities say the attackers entered the systems through a third party vendor, an IT company called SolarWinds. The Department of Homeland Security's cybersecurity division warned governments  and "critical infrastructure entities" across the country of the "grave risks" that the hack presents. 

Mark Douglas, founder and CEO of adtech firm Steelhouse and former vice president of technology at eHarmony, explained how the breach transpired at SolarWinds.  

"When any company or agency upgrades their software, ironically for security fixes and other changes, they introduce vulnerability because change has risks." Douglas told "The News with Shepard Smith." "In this case, that update had the malware that compromised the government and commercial systems, and that malware had been planted by the hackers into the updates."

James Carder, chief security officer of LogRhythm, added that third-party providers are "low-hanging fruit" for the country's adversaries to attack and gain control of their primary targets, government agencies. 

"With the increase of attacks against third-party providers, smaller technology firms with wide-scale usage and access to an entire customer base that includes government and commercial companies, that do not practice the best cybersecurity, are at just as much risk as they have ever been," Carder said. 

DHS warned that the security breach involved multiple tactics and warned, "CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated."

Gordon told host Shepard Smith that more resources should go into buttressing cybersecurity across organizations, because no matter how people choose to communicate, they're going to be vulnerable. She added that leadership is part of combatting and coping with these types of attacks. 

"We need the president to be able to deal with the attack on the nation," Gordon said.

President Donald Trump has not yet publicly addressed the attack. President-elect Joe Biden issued a statement Thursday that he will work to punish those responsible for the attack and make cybersecurity "imperative".  

"I want to be clear: My administration will make cybersecurity a top priority at every level of government — and we will make dealing with this breach a top priority from the moment we take office," Biden said. 

Douglas highlighted the importance of the government's role in cybersecurity. 

"We can clearly do more to prevent the hacking, which is almost always the initial vulnerability. Ensuring that every software company the government uses is secure from hacking should be a renewed focus."