Slashdot Mirror
Federal Computers Fail Hacker Test
Nintendork writes: "An article by the Associated Press, published on CNN tells of the latest network security report cards earned by Federal agencies. The Department of Defense along with several others failed. I hope terrorists that pose physical threats don't have any script kiddies in their arsenal."
A boss of mine a few years back was an ex-administrator on a private mil network. I picked his brain about some of the stuff and he explained that they use NT on the public networks (IE: for email to friends and family and other trivial things) and a hommade UNIX version for their private/secure networks. Of course this was just for his area of the military.
As for the DOJ, I met a guy who was arested for cracking into it when he was 19. He explained that it is a lot easier than people think and he cracked it about 11 times before he was caught. He now works for a large security consulting group.
Of course the flip side is that the security may be much better than this report leads you to believe. I'd imagine many gov't sysadmins have secured systems beyond what the paper pushers have speced out for them.
Top Most Bizarre/Disturbing Error Messages
I can't believe that they could have scored at F on any security test. Am I naive?
Well the following paragraph of the article gives some blatant examples of poor practices that were found:
The GAO routinely hacks into federal computers to test security and rarely fails. At the Commerce Department, for example, the GAO in August found some computers didn't require any passwords; some used "password" as the password; and entire lists of passwords were stored in plain view on the computers themselves. When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.
This isn't all that hard to believe. These networks are huge, and there will always be some people who value convenience over security. The question is whether the admins are understaffed, inexperienced, or simply lax in enforcing policies.
Promote proofreading. Don't mod up sloppy posts.
Does 'F' imply no password protection?
Does 'D' imply posted password?
Does 'C' imply password?
Does 'B' imply encryption?
Does 'A' imply near perfection?
I presume an 'A+' is un-obtainable. If it has a way in, then, can't it be cracked?
When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.
This makes it apparent that the IT department is extremly mismanged. Standards and procedures for dealing with hacker attacks, critical loss, and computer abuse are the core requirements of ant IT support. I'm guessing that alot of gov't computers have access to the internet that do not require access for its job function. Every terminal thats connected is a security risk that must be addressed. Probably setup by very underpaid gov't worker that was "trained" in a day.
"Get them before they get....
anyone old enough to remember various management styles, would probably refer to this as the "Open Door Policy".
In my brief stint at a Panasonic refurbishing depot, the management there also had the same policy.
"My door is always open, as long as you never walk in, it will remain so."
"First rule of management; EVERYTHING is your fault" --Hopper, A Bug's Life.
(note: misfiring neurons due to my son startling me awake at 5am. sigh.)
If it is not on fire, it is a software problem.
OK, you know .. if there was some sort of grammar recognizing Perl or CGI script that could link to a dictionary. Something that gives the basic structure of an English sentence and if something violates that structure it doesn't get posted. *shrugs* But I'm not sure if that would work.
A few things come to mind, they need to be more worried about dumb ass script kiddies, even an idiot can run a program and do something, crackers would be their next likely problem. If they want some help, I'm sure there are many hackers that would jump at the chance to work for them. It is a tough time in the technology field right? Besides, who is more likely to know about all the exploits, crackers for sure, but a very good chance that it is the hackers who were the people that originaly found the exploit.
We don't have our noses's burried in books and reading the "latest and greatest" security information for no reason.
Om, nomnomnom...
I am currently a sysad for a small military unit that has 3 WinNT servers (one PDC and 2 BDCs) using MS Exchange 5.5. I have done all I can to lock/patch these monsters down, but it seems like every damn day I am patching this, reinstalling SP-whatever on that. As long as they rely on MS software, it is always going to fail. I have been screaming about getting a firewall for months and months now, but they just look at me and tell me "We don't have the money yet." DON'T HAVE THE MONEY YET!?!?!?! THIS IS THE FRICKIN' DoD WE ARE TALKING ABOUT! I have seen them waste more money on building electro-conference rooms and overhead projectors for useless cheese slides! My nets get scanned by outsiders at least 3 or 4 times a day, and that is only because I HAVEN'T had them registered in the .mil DNS system. If I did, the number would go up.
The Emperor has no clothes, gentlemen, and I have no sympathy for ANY Government network that gets hacked, when it could have been prevented.
Freedom of Information. For once, the feds have chosen the most efficient way to implement something.
-- Another senseless waste of fine bytes.