U.S. Gov't Sponsors InfoSec Defense Training

Anomolous Cow Herd writes: "CNN is reporting that the U.S. government is awarding scholarships to a select few computer science students to study information security, with the caveat that they must agree to work for a government agency for at least two years afterwards. This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority. Considering that a vast majority of government agencies run on Windows NT and derivatives, it's no wonder that they consider the eventual graduating class of 180 'doesn't have a chance.'"

Comments

Working for the government?

[Stripsurge]

Seems hardly worth the deal :P

FP#2?

Re:Working for the government?

[L.Torvalds]

Not your shitty little Saudi gov't, fucker, but a REAL Government, THE US OF A'S gov't!!!

Hahaha, just kidding. There hasn't been a real government since April '45.

Re:Working for the government?

[goldspider]

I really hate to feed a troll, but I suspect alot of people here might actualy believe the subject line of the parent.

I work for the government, and in these times when the economy is still on shaky ground, the job security alone enough was enough to get me to take the position.

The fact is that IT positions in the government actually pay quite well. Considering the area I live in, my starting salary was quite competetive with what the private sector was willing to pay. Not to mention the famous government benefits packages.

The U.S. government does indeed have alot of NT servers. The Powers That Be (TM) understand the vulnerability, and apparently are willing to pay handsomely to fix it. In a time of a job market that's uncertain at best, I can think of worse situations than a free education and a 2-yr. job guarantee.

Re:Working for the government?

[morgajel]

I completely agree. call it selling out, but I think working for the SS, FBI, or CIA would be a kickass job. Sure you'd have to "straighten up," but there's job security, and you'd be ~in the know~.
Think about all the gov't secrets you'd have access to!
First time I got to meet the president, I'd go into work wearing this shirt.

Re:Working for the government?

[Anonymous Coward]

Yeah, but the problem with a government job is that the rate of advancement is kinda slow and you'll never get to be head of the company through competence or technical ability.

Re:Working for the government?

[goldspider]

"Yeah, but the problem with a government job is that the rate of advancement is kinda slow"

Another myth, at least when it applies to government IT jobs.

If I were so motivated to take advantage of it(and I will eventually), there's a government internship program that will pay for most of my MS (as opposed to M$ of course) after 3 years, and would double my salary to a more-than-comfortable level.

The opportunities in the government are there, though sometimes you have to dig for them.

Re:Working for the government?

[Anonymous Coward]

The fact is that IT positions in the government actually pay quite well.

Perhaps on the low end for unskilled workers, but that's it. I make $90K/year writing Web applications. I got this job last August, well after the dotcom shakeout - I was making significantly more before then. While I was looking for work last year, I checked the government pay scales.

I didn't bother to send them my resume.

I don't know about you

[trollbot]

but I don't know if this is a good idea. Should we really have the LINUX using 14 yr old hackers working with Government secrets like this? Can you really trust illegal hackers like this?

Re:I don't know about you

[WildBeast]

I'm sure that they're not dumb enough to take anyone.

Re:I don't know about you

[crimsun]

Btw, not all applicants such as myself are 14 year-old Linux hackers. Some of us just bang on it in our spare time.

The fact is

[WildBeast]

that usually, many of the most brilliant people aren't that interested in school.

Re:The fact is

[Sarcasm_Orgasm]

Are you one of these special "secret genius's"? Seems to me a person of high intelligence would want to go to school and get a degree of some type so they could have the necessary resources to carry out thier future plans. Perhaps intelligence is objective and not concurrent with anything actually getting done. However I dropped out of Jr. High, and currently own half of Canada. So what do I know.

Re:The fact is

[TheAJofOZ]

that usually, many of the most brilliant people aren't that interested in school.

On what basis do you make that statement? The most brilliant people almost always look for intellectual challenges and you are much more likely to find those challenges in an academic setting (because that's the point of them). Certainly some very intelligent people burn out and drop out of school but they generally do not live up to their potential intellectually, despite the fact that they may well have a much more satisfying life.

In reality, most of the really brilliant people in this world are professors in universities (note that the reverse is not nessecarily true however).

Re:The fact is

[The Evil Troll King]

I'd support this hypothesis. Where I go to college, the smartest people are bored out of their minds with their schoolwork because it's just so easy for them.

Even I find the work to be too simple. Once, I skipped six consecutive weeks of a philosophy class and ended up with a B+.

I think that this is less of a problem with IT, but the problem exists, even in reputable colleges.

Steve

Re:The fact is

[mgv]

that usually, many of the most brilliant people aren't that interested in school

Certainly, some intelligent people don't get formally trained. Alot more do.

There is much less correlation between brilliance in the academic success and commercial success - alot of bright people have relatively ordinary jobs. It depends on what they want out of life.

So I don't think that this would deter all the prospective applicants for such a scheme, even though I would value my freedom more than that. Then again, I didn't really have any financial problems through Uni.

If it gives people an opportunity that they might not otherwise get, 2 years of work isn't a bad deal.

My 2c worth

Michael

Re:The fact is

[Peyna]

Your post reminds me of what I read in Bill Gates' biography (Hard Drive). Himself and others at Harvard would skip class all semester, and then spend the weekend before finals reading the book and studying to see who could get the best grade without ever going to class. I think he still did pretty good too.

Re:The fact is

[j2gEEk]

Uh.. depends on your definition of "really brilliant". It reminds me of that popular example used for learning string manipulation: "If you're so smart, why aren't you rich like Bill Gates?"

Cheers,
Jake

Re:The fact is

[linzeal]

Whatever the hell sates this greed of money, this implacable goal for power is far different than that which you get if you are for instance scientifically curious or motivated intellectually in the slightest. Bad scientists do it for the their own ego and the awe that laymen and lesser scientists percieve them with. Good scientists do it for something far more noble, the progress of one human against the great unknown with the knowledge that all is surmountable, this is the benchmark for all human progress not dollar bills.

Re:The fact is

[Anonymous Coward]

I would think the really brillant people are the graduate students that do the majority of the research...

Re:The fact is

[benjamindees]

Notice he said most brilliant. He's not referring to the 1% between the top 98-99%, who end up becoming professors. He's talking about the 1% who are smarter than these nitwits and can't pass any of their droll classes because of it.

Could be worse.

[Anonymous Coward]

I'd rather see people get scholarships for IT security than for the ability to run fast with an oblong ball.

Re:Could be worse.

[Anonymous Coward]

Is this a girl?!

Beer. Football. Good. ;)

Re:Could be worse.

[Anonymous Coward]

I'd ask "are you an asshole" but i see you've already answered that.....

Re:Could be worse.

[Anonymous Coward]

football > IT security.

Re:Could be worse.

[Anonymous Coward]

In other words, yes. Yes she is.

Re:Could be worse.

[Anonymous Coward]

football > IT security

Now I have two files named "IT" and "security", both containing the word "football". What was the point of that?

Oh, lighten up, it's April 1.

Re:Could be worse.

[October_30th]

Man, I would love to "merge" with this powerful beauty!

Re:Could be worse.

[Anonymous Coward]

We are talking soccer here right ? Those mixed up europeons calling it football and the like, silly bastards.

Re:Could be worse.

[October_30th]

mixed up europeons calling it football

Now who's mixed up?

I think it is the people who call a game in which the ball is mostly carried and thrown around football.

Re:Could be worse.

[bmongar]

Of course the colleges don't sell tickets, banners, and sweatshirts based on their it scholarships.

Re:Could be worse.

[SirRichardPumpaloaf]

Insightful? Good football players bring in millions of dollars to universities. For their efforts they receive scholarships worth a fraction of that, and you begrudge them even that? I know you spoiled rich kids can't stand that a black kid from a poor family could get a break once in awhile, but this is pathetic.

Good for Linux?

[SecretMethod70]

Granted, the US government runs mainly under Windows systems, but if these students are getting good educations in computer security and are supposedly going to be an influential voice in what the government buys as far as new equipment and such, do you think this will help Linux to be used more in government? I think if this were to happen, it would, consequently, generate great PR among other copmanies that are concerned with keeping their information secure.

Re:Good for Linux?

[morgajel]

you make a good point- my school by far is drowning in windows machines, with the occasional sprinkle of imacs. there are, however, 2 linux labs, which are the only 2 labs the CS/IS classes use after freshman year.

imagine if you will, this conversation,

boss: "hey, the dataserver needs to be rebooted again- hey new guy, go do it."
newguy: "um, why does it have to be rebooted?"
boss: "because it blue-screened and I can't get PCAnywhere to work."
newguy: "well, my college has an operating system that never needs to be rebooted- there's very little downtime."
boss: "well, fill out the 100,000 pages of paperwork and we'll look into changing things- where you go to school again?"
newguy: "berkeley."

then, as the boss retires and the newguy becomes the boss, his personal prefrences come into play.
Don't believe me? go look at your local server room- you can tell what the favorite server was of former IT managers like rings on a tree.... one person buys hp, the next dell, the next compaq, etc.....

Re:Good for Linux?

[Anonymous Coward]

"US government runs mainly under Windows systems"
Do you have any real numbers to base that on?

Nasa certainly doesn't do their mathematical
models on NT machines.(the sliver of nasa machines I've seen are SGIs) I don't think that
the NSA is cracking encryption with a cluster
of Win2K machines. Maybe if you actually count
number of ip addresses of one OS or the other
you wind up with more Windows machines. But I
bet that if you count up the number of
IMPORTANT machines you get more Unix than
Windows, or at least more NonWindows versus
Windows.

Re:Good for Linux?

[nathanm]

Granted, the US government runs mainly under Windows systems

No they don't. Maybe for desktops, some workstations, a few file servers, and the occasional public web server, but the US govt uses lots of different systems. There are still many systems running on old proprietary mainframes, plenty of Novell (even as old as version 3) networks, and a whole lot of Unix systems.

Also, all classified systems run only on Trusted operating systems and software, which meet criteria for a specific level in the Orange Book from the NSA. According to this, the latest version of Windows that was certified is NT 4.0 with SP 6a and the C2 update, in Nov 1999.

Re:Good for Linux?

[Frank T. Lofaro Jr.]

Isn't Windows' C2 certification only valid if it is NOT connected to a network?

Re:Good for Linux?

[nathanm]

Isn't Windows' C2 certification only valid if it is NOT connected to a network?

The 1st OS they certified, NT 3.5, was only valid without a floppy drive and any kind of networking hardware. The funny thing is that NT 4 is much more unstable than NT 3.5 was.

NT

[mAIsE]

could NT
would NT
should NT

even in severely depressed times in the tech industry security guys can get sh*t loads more money in the private sector.

Re:NT

[forkboy]

even in severely depressed times in the tech industry security guys can get sh*t loads more money in the private sector.

That's true, if there are jobs available. In Denver, in the last, oh, 4 months or so, there have been MAYBE 6 or 7 security jobs posted on monster.com.

After I got laid off and before I went back to school, (about 8 months ago) the last full time job I applied for had over 300 reasonably qualified resumes. In some markets, it's nearly impossible to find a job in IT (let alone security) unless you're willing to preclude your talents to Windows. As annoying as the .com boom was, damn there were some sweet jobs and plenty of them.

Work in the corporate sector just blows now, it's back to the olden days of kissing your boss's ass to make sure you keep your job because now, even if you're quite talented, you're very expendable.

FYI: Free COMPSEC training materials on CD

[Anonymous Coward]

You can request free computer security training information (mostly on CD) from DISA.

http://iase.disa.mil/eta/index.html

Re:FYI: Free COMPSEC training materials on CD

[Frank T. Lofaro Jr.]

Too bad you probably need to know "milspeak" to understand it. ;)

Re:FYI: Free COMPSEC training materials on CD

[Eil]

... if you're affiliated with the military. There's a field to specify organization, if you put "Bob's Auto Maintenance" instead of "PACOM", they're going to throw out the application. If you lie on the form, they're going to prosecute you for impersonating a government worker or official or something like that.

Luckily, I do work for the goverment. ^^

This is old news

[chiaroscuro03]

Old news.

http://www.wired.com/news/politics/0,1283,46567, 00 .html

Re:This is old news

[Anonymous Coward]

Kinda new to this whole slashdot thing, arn'tcha?

This is "News for Nerds", not "Current News for Nerds". Old news is the only kind you get here, and that's the way we likes it!

Re:This is old news

[Eil]

WTF is Wired smoking these days? Why the heck is 60% of the story comprised of some kid's battle with liver cancer and another's dreams of becoming a golf champion?

I mean, really.

Bash boy, bash

[Anonymous Coward]

Yeah, because if they were running some UNIX flavor, their systems would be more secure ah? Just subscibe to some security mailing lists and try to filter out Windows*/UNIX vulnerabilities/exploits.

Quite amazingly you will realise that most of them are UNIX (vast majority Linux, then some HPUX/Solaris/IRIX).

Not a flamebait, but really disguss me all these creeps that try to bash Microsoft at the first chance.

Kisses.

Re:Bash boy, bash

[Arker]

There are plenty of security issues on any platform, sure. But they have a vastly different character. Typically unix alerts are about obscure bugs that haven't been exploited, but could be, and the patches to fix them are usually very quick. With MS, the problems are pretty major, often have already been exploited, and the fixes, if they ever arrive, at the very least are not timely.

Re:Bash boy, bash

[Biolo]

The difference is that all of the Linux/BSD exploits are out in the open, and a large percentage come from people looking at the source code and going "oops!".

Whilst I know the "many-eyes" theory isn't as good as many people think, I'm sure that the average line of code in an open source app gets more eye time that the average line of code in a proprietary, closed source one, so we find a higher percentage of our security problems. Now, just what percentage of security issues do you think that Microsoft et al actually openly admit to? I don't think there have been more than a couple of occasions where microsoft has said, without someone sticking the proverbial gun in their back, hey - security issue, we fess up, come and get the fix. Do you believe they don't find many more? Sure they do, they either just ignore them or quietly fix them and slip it in a servicepack.

Quite clearly you can't compare the numbers just by taking them at face value. Filter out all those with "theoretical exploits" for a start. Next, take out all the duplicates - a patch released by RedHat may be for an identical issue to one released by SuSE and Mandrake - how many times did you count it? One? Three? Or do you just look at one distro? Which one? The one with the most patches - maybe they're really good at looking for problems and putting out fixes, on the other hand maybe they really screwed up the original release. The one with the least patches? Probably not paying attention.

Now a more interesting exercise would be to have a couple of groups of security experts sit down for a few months with the complete source of a recent Linux system and that of WinXP and tot up the number of security issues they can come up with. How about an independent study, draw up a set of rules, have MS put up 50% of the money and one (or more ) linux companies put up the other 50.

Re:Bash boy, bash

[dirk]

The difference is that all of the Linux/BSD exploits are out in the open, and a large percentage come from people looking at the source code and going "oops!".

Whilst I know the "many-eyes" theory isn't as good as many people think, I'm sure that the average line of code in an open source app gets more eye time that the average line of code in a proprietary, closed source one, so we find a higher percentage of our security problems. Now, just what percentage of security issues do you think that Microsoft et al actually openly admit to? I don't think there have been more than a couple of occasions where microsoft has said, without someone sticking the proverbial gun in their back, hey - security issue, we fess up, come and get the fix. Do you believe they don't find many more? Sure they do, they either just ignore them or quietly fix them and slip it in a servicepack.

Actually, a large portion of security holes in MS software are fixed before there is an exploit. The problem is the few that aren't get lots of press, and people don't install the patches, and MS still gets the blame. The CodeRed worm is a perfect example. There was a patch available months before CodeRed was even heard of, put people didn't install it, and now everyone points to CodeRed as the perfect example of MS vulnerability.

I'm not saying MS is perfect by any stretch, but check out how many security fixes they offer and compare it to the amount of tools for exploiting them. You'll find most holes are fixed before there is an exploit for them available.

Re:Bash boy, bash

[Grue]

Just a few factors to take into account:

1. There are more UNIX variants then Windows
2. UNIX systems have been around longer, so there may be more because of this.
3. Traditionally, in much of the UNIX community, security problems are well publicized.

And there's always the claim that OpenBSD hasn't had a remote root exploit in two years is it? Can Windows claim this?

And when you throw out the extra services, and just compare services that Windows systems and UNIX systems have in common, are there still as many vulnerabilities?

Josh

Re:Bash boy, bash

[GigsVT]

Actually, a large portion of security holes in MS software are fixed before there is an exploit. The problem is the few that aren't get lots of press, and people don't install the patches, and MS still gets the blame.

I think you are kind of missing the point. A lot of people forget that the script kiddie warez and IRC bots is just one form of security risk.

We assert that open source has less total security flaws, because more are discovered by the general public.

A major security hole, unknown to the general public, could be considered a weapon, of vast power. It would allow you to break in to your enemy's and competitors computers, stealing sensitive information, etc.

It is impossible to know how many secret security holes there are in Windows, that people may be keeping under their hat. Look at eEye. They are a company that regularly finds major security holes, because they beat on windows constantly looking for them. I'm sure their core talent isn't more than one or two people.

Suppose a blackhat version of eEye, with a couple or few adept people, banging on windows in every possible way. It's likely that such an orginization would have found many previously unknown security holes, and/or combinations of little holes that can lead to system compromise.

With open source, it's more likely that people in the normal course of debugging their problems will find problems, such as the zlib issue. That was just someone trying to get his project working, and that led him to discover the error in zlib that could be a security hole.

It's not the holes we know about that matter, it's the ones we don't.

Re:Bash boy, bash

[Anonymous Coward]

Bravo - I was going to ask if the story poster could read? There has been enough stories lately to dispell any "Unix is better than NT" claims. but alas, those without brains continue to wear blinders and claim Microsoft is the only problem. Which I guess makes the point very well - people need to be educated that it isn't OS A or OS B - it's how things are implemented and put together. It's not the system, it's the idiots running the system. Go ahead, throw up a useless firewall thinking it will protect you. It wont protect dick. Hopefully some of the inteligent youthful minds out there can be taught this - in class before real life.

Re:Bash boy, bash

[JordanH]

• There was a patch available months before CodeRed was even heard of, put people didn't install it, and now everyone points to CodeRed as the perfect example of MS vulnerability.

Yes! A perfect example. A perfect example of how difficult it is to keep up with the dizzying array of patches from Microsoft. Why, Microsoft can't even do it. Gartner advised customers to ditch IIS exactly because you can't patch fast enough.

Further, the Microsoft patches, available for a long time, cause other problems, and I quote:

Speaking of patches, I've read a couple of recent posts on the Bugtraq mailing list that indicate a problem might exist with the Microsoft patch listed in bulletin MS01-033. A few people have reported that after they installed the patch, their systems remain immune to Code Red infection. However, when an infected system attempts to connect to their system to infect it, several IIS services (e.g., FTP, the default Web site, the administrative Web site, and the proxy service) stop processing.

Re:Bash boy, bash

[Noehre]

a "few people" report that a problem "might exist"? That is your grand evidence?

Funny how people bash Microsoft for both a) not releasing patches and b) releasing too many patches.

Re:Bash boy, bash

[JordanH]

• Funny how people bash Microsoft for both a) not releasing patches and b) releasing too many patches.

Yes, well, there's obviously a problem with both a) and b). Under a) the problems don't get fixed. Under b) not even MS can keep up with the dizzying array of patches.

Re:Bash boy, bash

[Anomolous Cow Herd]

Do you really think that I put that last sentence in there? Here's a hint: I didn't.

Blame the editors.

predicting the future

[SuperCal]

two years and one month after the first class graduates a new consulting firm will be organized because these programers will realize that they can make 100 times as much by getting hired as outside consultants doing the same job. I don't think that in two years the government is going to get their moneys worth. Are they tring to make life time employees of the state? It won't work. On the plus side their will be a few happy students with scholarships

Re:predicting the future

[bezell]

There is a problem with this? Beats chipping paint, drinking bad coffee, and long deployments in the Navy. The Man has been doing this for a long time; they'll get their money's worth out of these people, trust me. New recruits will probably be sitting on blocks of ice sharing a smoke break with a moose outside of some non-descript warehouse near Prudhoe Bay, Alaska.

Re:predicting the future

[budgenator]

That always happens to the government, retention is more difficult than recruiting, so it's just a cost of doing business.
Of course just about the time they're due to get out, there will be a sexy must-have course that will make their lives perfect on the outside just for a four year commitment. Then it's I'm one third of the way to a cushy government pension at age 40 ... of course along the way you realize that the college kids today get the same training minus the obsolete stuff you still have to maintain so now you worry about competeing with them etc.

April fool?

[slipgun]

Couldn't tell whether this was supposed to be an April Fool's joke or not...

Re:April fool?

[crimsun]

No, this is most certainly NOT an April Fools'.

Re:April fool?

[primal39]

This isn't an april fool's joke. I am currently one of the students applying for said scholarships, as my lowly school is one of the chosen few to receive money (IUP - Indiana University of Pennsylvania) Apparently there are going to be approximately 10 people from my school receiving the scholarship, which is to consist of full tuition, a personal computer, room and board (possibly in one centralized location for all of the scholarship winners) and the aforementioned two year job (quite probably with the NSA, as to the best of my knowledge they are the main agency associated with this program). Applications are due at my school on friday, so this is already being implemented.

Application

[Alsee]

Hi!

My name is Osama Ben Logan and I would like to apply for a scholarship and two years employment managing computer security in a sensitive government facility.

-

Re:Application

[gnovos]

Your application will be approved about 6 weeks after the big media scandal when your terrorist hacking breaks into and completely destroys some of our military systems.

Re:Application

[Frank T. Lofaro Jr.]

That would never work. That would be like expecting Mohamad Atta's visa application to be approved after the September 11 attacks.

Windows source code for dowload!

[Anonymous Coward]

Get it here, only 5tb download!

Motivation

[_Sprocket_]

Oddly enough the submission reads:

This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority.

While the VERY FIRST PARAGRAPH of the article reads:

Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts to guard against cyberterrorism.

Ya know what? Other than putting some additional paranoia in the public (and management) mind, infosec has little to do with terrorism. Sure, the politicians like the run around screaming "digital pearl harbor". But the general state of most organizations' infosec stance has been in shambles well before 9/11. And those vulnerabilities mean that these organizations are much more likely to be attacked by a random attack-of-opportunity than a coordinated terrorist activity.

And that includes the US Government. It might go especially for the US Government where "security" is usually dealt with a Cold War mentality. One that has little to do with the current state of information security. Instead, government agencies tend to rely heavily on prosecution (which kicks in well after the damage has been done). Change to this mindset is hampered by limited budgets which make hiring experts (or retaining anyone with the appropriate skillset) difficult. A couple years ago, the FBI even complained to congress that they could not attract experts in the field due to their uncompetative pay.

So to wrap it all up. Government computer systems tend to make suprisingly easy targets. This program is part of the awakening and catch-up the government is undergoing on this issue. It has very little to do with terrorism and 9/11. And even the very article referred to states that.

Re:Motivation

[carm$y$]

Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts [...]

Oh come on, do you really beleive that? Or that freenet, anonymizer and all the other anonimizing services abruptly invoked "pre-9/11" decisions to cut their services? And RSA/NAI dropping PGP?

Jeez, I'm not wearing my tinfoil hat right now, but you must have your head burried 4 feet in the sand...

Re:Motivation

[Telemakhos]

Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts to guard against cyberterrorism.

Yeesh -- the melodrama is overwhelming. Sounds like 13-year-old script kiddies wrote the article. Why do I suddenly have visions of "an elite corps" of acne-ridden guardians "against cyberterrorism" wearing black jumpsuits with a Nike logo stiched just above the US flag on the sleeve?

Re:Motivation

[kin_korn_karn]

well, Nike DOES control the USA, so why even have the flag on there?

Re:Motivation

[StenD]

Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts [...]
Oh come on, do you really beleive that?

Since I heard about these scholarships two years ago, yup. And here and here are articles from two years ago about the program. I'm sure you can find enough references, from enough different sources, on your own to satisfy all but the most devoted conspiracy theorist that these weren't all planted recently.

NSA

[Loki_1929]

Just thought I'd point out that the NSA has been running similar programs for a while. I actually looked into them when I was in college, but then I realized I was looking at Big Brother and asking for a part in the book 1984... on the wrong side.

On a lighter note, after hearing that Intel is trying to claim the word 'inside' as its own, I decided to do a little investigating as to exactly what is inside. Take a look.

Re:NSA

[Anonymous Coward]

lol you slashdoted yourself

Re:NSA

[Anonymous Coward]

You probably should have taken it. Better to be a hammer than a nail.

HANAFD.

Re:NSA

[Telastyn]

The Secret Service also does similar programs. One of my floormates in college was under agreement with them (to combat counterfitting and wire fraud eventually)

Slash vs shack

[Anonymous Coward]

God slashdot is slow, shacknews had a story on this yesterday morning...

Timely Fixes

[Anonymous Coward]

With security, a hole is a hole is a hole.
You can't take back security breaches after the fact.
The best (and unfixed) MS exploits are now played close.
If a bright graduate says 'be different, pick something less popular' who will heed this advice?
Like enron, you can add window dressing to foll the masses, and have well paid experts saying safe as houses, but even cartman knows the real substance of brown stuff.

Another kind of training

[Walmart Security]

My weathered hand rested effortlessly on the blue EZSECURE patrol cart's steering device as the blinding incandescence of a Chevrolet SUV's headlights temporarily rendered me unable to see. Inconsiderate out-of-towners who never respected the law, probably. After it had vacated the premises and the slight glimmer of light eminating from the moon was all that remained, I realized that it was 11:30, the official beginning of my shift at the local Walmart. It would last until the early morning hours when the sun would rise and Brady would arrive to relieve me of my sworn duty: protect the Walmart and its patrons with my life. I would then return to my residence here in the relatively small town of Jasper, Texas to prepare for another patrol.

Fortunately, as of an hour later, my patrol might not longer evoke the ennui that it had for the past fifteen years. After fifty years of service, The EZSECURE Corporation was entrusting me with the prodigious task of training an aspiring security guard on site as my seventieth birthday present! I could hardly wait to meet my proteg. This was unquestionably the most exciting thing I had experienced since the Country Music Fair was held here in 1978. Ah, the memories... I digress.

I applied the brake gently and disabled the golf cart's electric motor. "Use that there break real gently now," my supervisor had told me years ago, when the golf carts were new. "If you don't, it'll get old quicker and cost EZSECURE more funds." At the time, I assured him that his advice was nothing more than an old wife's tale, but he threatened me in his most intimidating (and greatly accentuated) voice with demotion. I complied only because I had no intention of becoming a security camera operator again. The Walmart's warm air welcomed my frail, wrinkled body as I walked briskly through the automatic door, my black and gray hair blowing uncontrollably due to the amount of air travelling through the door. It smelled of plastic and hand cream, but even the smell of dead fish would be more pleasant than the utterly glacial conditions outside. "Morning Kevin," I said to the Home and Gardens cashier, who rarely, if ever, replied vocally to my greetings. I suspected that he must have been a hippie, because the twentysomething blond would reply with some sort of peace symbol using his middle finger, but this morning he was uncharacteristically fatigued. Perhaps he'd fallen victim to drugs, like so many other children today with deadbeat parents. Apparently he'd arrived only moments prior, for he hadn't even powered up his electronic cash register.

After exiting the pseudo-warehouse where Kevin was assigned, I continued walking until I reached the twenty-four hour McDonalds nestled safely inside of the Walmart. As always, I purchased an eight ounce cup of freshly brewed coffee. Not only would the caffeine assist me in remaining alert during the morning hours, but I believed the coffee's inherent warmth would assist me in carrying out my nightly tasks and, if necessary, defend Walmart from aggressors.

"Peter? Peter Geralds?" an unconfident voice queried from behind me. I drew a can of mace and turned expediously, nearly emptying the hot drink on my uniform in the process. The boy jumped back, realizing that I wasn't fond of surprises. EZSECURE had trained me to react with the mace in a millisecond.

"Yes sir, that's me," I replied politely as I placed the can of mace back into my pocket. This boy wasn't a threat. After all, would a malevolent criminal be wearing an EZSECURE uniform? Certainly not. "I'm sorry about that. What can I do for you?"

"I'm Robert. Manager Bob ordered me to report to you for training." The cadet wasn't exactly what I'd anticipated. He was lanky, probably around 6'2" in stature, with blonde hair that appeared quite dark under the dimmed flourescent lights overhead.

I stepped closer to him and held out my hand. "Nice to meet you," I told him with utmost confidence.

Shaking my hand, he hesitated to reply until we'd finished. "Likewise, Peter." I picked up my coffee again and we began walking back to the Home and Gardens area of Walmart. While we were in transit, he explained that he'd been born in Japan and that his parents had immigrated to the United States shortly thereafter. "If you're Japanese, why did your parents name you Robert?" I asked him inquisitively. It certainly intrigued me that he'd not been assigned a Japanese name, for many of them were quite interesting to a layman such as myself. Whereas I'd be more inclined to name my child "Bobby-Sue," people who weren't native Jasper residents often chose poetic, interesting names for their offspring.

"They were very worried that I wouldn't fit in with other children," he informed me. Logical, I thought. Robert spoke both English and Japanese fluently; perhaps he would be an invaluable negotiator if we were ever held hostage by Japanese terrorists.

The golf cart was barely twenty feet away. "Let's start your training," I suggested as I took another drink of my coffee. "Welcome to the security business."

CIA, etc

[Alien54]

I seems to me that the CIA had this sort of deal going for a while. I know that this sort of thing has been routine for the military for a long while.

Here in the link, for example, to the CIA College Intern Page.

so basically, sounds like non news item.

Maybe these are the guys who bugged a student press office at Quaker Campus a while back? Although i mention this with a something of a tongue in cheek spirit, to be serious, that incident does seem to be more of a local job using radio shack parts.

Cyber Security, Cyber Mashurity...

[Blasto.Net]

/start tangent

Yes, I do believe some terrorists use this so called "interweb" to communicate. I do not believe we are going to be having cyber terrorists hacking into the pentagon. If they hack into it via the web, well, shame on them for even putting any sort of outside access.

If a cyber terrorist hacks into our missile control system and has it launch missiles at ourselves, we deserve it, because if there is anyway for a terrorist to log onto the missile launch programs from their terrorist hide out we should be bombed for our stupidity.

/end tangent

Re:Cyber Security, Cyber Mashurity...

[Frank T. Lofaro Jr.]

Here is something I thought of. One should never have classified and unclassified (or 2 different classification levels) data or processes on the same system. The risk of covert channels and leaks is way too high.

Every system should have one and only one classification level.

Re:Cyber Security, Cyber Mashurity...

[Eil]

This is the way it's traditionally done in the military. You either have access to something based on your security level (plus need-to-know, see below), or you don't. And if you don't, well, you're not getting it. When you join the military, they do a background check on you to assess what your level of clearance will be. If you get a security clearance, it will be one of Secret, Confidential, and something else. ("something else" being the highest) If they decide you may be worthy of Confidential and above, the background check gets more in-depth; one friend of mine mentioned that the military interviewed his family, friends, and even high school teachers. Scary shite. Once you are assigned a clearance, it can never be increased (unless there is a very good reason). But your clearance can (and routinely is) taken away completely for something like a DUI.

Need-to-know: Despite what Hollywood will tell you, just having the right clearance is not enough to gain access to something that is classified. You also need a reason to have access to it, which normally comes in the form of the approval of a superior.

Wow, I just rambled a lot.

A hole is a hole? Really?

[October_30th]

a hole is a hole is a hole

Like this hole and this hole?

OpenBSD

[bleckywelcky]

It's:

Four years without a remote hole in the default install!

Which is rather awesome for anyone just trying to mess around with BSD or get into the UNIX-variant world. You can just shove in a boot disk, set up your system, install with the default config, and you have an up and secure system. Just add some ip forwarding and whatnot and you already have a personal gateway/firewall for your household.

Re:OpenBSD

[October_30th]

and you already have a personal gateway/firewall for your household.

Which is basically all that OpenBSD is good for.

It doesn't do SMP and if you install X11 for the desktop use you have lost the security edge already.

SG-1 surprise

[October_30th]

SG-1 sat around the camp fire one night. It had been a very boring mission for most of the team; they were there so Daniel could study some ruins that they had found. The ruins reminded him of Atlantis. How his old professor would have loved these. His professor had been nicknamed Atlantis Atticus. Daniel found himself distracted by many thoughts of his college years.

Now by the fire Jack started playing a game. "The rules are simple: either tell the truth or take the dare."

"Why would one not wish to speak the truth?" Teal'c asked somberly.

"You'll see." Jack turned to Sam. "So Sam, Truth or Dare? How old were you when you lost your virginity?"

"I'd take the dare but I'm sure it would be worse." Sam said with out doubt.

"Not too bad to start. Maybe show us your tits or your ass." Jack was leering at her.

"Truth, I was sixteen. Why do I have a feeling you are going to take every dare, Jack?" She continued. "My turn to ask a question?"

"And the point to this game?" Teal'c asked with confusion.

"To embarrass your friends." Daniel spoke quietly.

"Daniel, How about you? How old were you when you lost it?" Sam asked.

"That's easy, it was a few years ago with Shar're." Jack replied for him as he started to laugh.

"I was seventeen, Jack." Daniel sounded very serious.

"I'm sorry, Daniel." Jack was now serious too. "That was stupid."

"It's okay, Jack. I'm going to bed." Daniel stood up and headed for his tent.

"Danny, I'm sorry!" Jack got up and chased after him. "I didn't mean to hurt you."

"You didn't. I'm fine, just tired." Daniel smiled at Jack. "Goodnight everyone."

Daniel crawled into his tent. He could hear his friends talking. Jack was definitely worried about Daniel. He'd never meant to hurt him. Daniel thought about going back out but his mind was racing. Sam's question sounded so innocent. But it brought back a flood of memories. The ruins didn't help either because it was in college that he had met his first love.

Seventeen was an awkward age for Daniel. He was smarter than most kids his age and was taking many advanced courses at the University Of London. He really didn't seem to fit in with anyone. Until he met an older graduate
student. This guy already had a degree in physics and chemistry. He has also been to Vietnam. Daniel looked up to MacGyver.

MacGyver was wild, unlike anyone Daniel had ever met. He was a tall, good looking man. It seemed like there was always a group of girls following him around. He was one of the few people that had a flat off campus. Daniel was surprised when MacGyver asked him over one afternoon.

MacGyver had always seemed to like Daniel. They'd shared many classes. Mac had always took time to talk to him. Daniel wasn't really sure what to
expect. He knew the guy didn't drink or do drugs. He knew that Mac was very intellectual. Maybe he wanted to discuss their assignments.

When the two arrived at MacGyver's flat, Daniel was surprised that there was no one else there. He expected the group of girls that followed Mac around campus to have followed him home. A slim thought had run through Daniel's
mind. Maybe one of those girls would notice him.

"Daniel, can I get you something to drink?"Daniel nodded as Mac continued.
"Do you miss the states?"

"Oh yeah. I can't believe the cultural differences. It really is interesting
how two societies with the same origin could have developed so vastly differently." Daniel pushed his glasses up. 'Shut up you sound like nerd.' He
said to himself.

"I never thought about it that way. It really is amazing that there are so
many different cultures are out there. And I plan on seeing them all." Mac
smiled at him as he passed him a glass of juice. They both took a seat on the
sofa.

"Have you seen many?" Daniel asked not sure of what else to say.

"I backpacked all over Europe. It was great. We had a lot of fun." MacGyver
moved closer to Daniel. "Maybe we could get away this weekend. We could
backpack up the coast. What do you think?"

"Really? You want me to go with you?" Daniel was surprised and honored.

"There's a lot of things I want to do with you!" MacGyver said with a leer.

MacGyver gently leaned in and allowed his lips to brush Daniel's.

"I didn't miss-read you, did I?" MacGyver whispered. Daniel could feel Mac's
warm breathe on his face causing his skin to tingle.

"Um...no." Daniel was wide-eyed. 'What was there to miss-read. I haven't been
with anyone,' he thought to himself. MacGyver kissed him again. This time
taking Daniel's lip into his teeth. Daniel's head was spinning. He had never
been kissed by any one like this before. Maybe this is why he never felt like
he fit in. The next kiss sent Mac's tongue probing. Daniel wasn't sure how to
react. He just knew he wanted more.

Mac reached for Daniel's glasses. Daniel was startled back. He must have
looked worried.

"Do you want to take your glasses off?" Mac was reassuring. "You seem
nervous. Is this your first time?" Mac flashed him a sweet smile.

"Well...Um...I...."

MacGyver kissed the stuttering young man. "It's okay. I like virgins." Mac
kissed him again more passionately than before. Mac let his hand explore
under Daniel's T-shirt. Mac's long talented fingers quickly found Daniel's
soft nipple, changing it's appearance. Before Daniel could do the same his
shirt was peeled away.

As soon as there was bare skin, Mac began to nibble at Daniel's chest. His
tongue was quite talented as it tickled each nipple. Daniel's whole body
quivered under Mac's touch. He never noticed that Mac was unbuttoning
his own shirt as he worked his way back up to Daniel's lips. When Mac's hot
flesh touched Daniel's, it was electric and smooth. He laid Daniel back on
the sofa. And came to rest on top of him. Mac never broke their kiss.

The two men laid there kissing. Mac's passion and groin burned and he rocked
his hips gently. Daniel could feel Mac's engorged member against his own and
let his hands explore Mac's hot skin. Mac rolled to his side and directed
Daniel's hand to the front of his jeans. Experienced fingers quickly opened
Daniel's pants. Mac messaged him as Daniel had done only in the darkness of
his own room.

Daniel tried to concentrate on pleasing MacGyver. He fumbled with the button
on Mac's jeans a few times until Mac helped him. Daniel wrapped his fingers
around Mac's raging cock and as he stroked, he couldn't help but notice the
size difference. Mac was only a little wider but definitely longer. Daniel
was trying to mimic his new lover. The more Daniel stroked, the more he was
rewarded.

Daniel's kisses were more passionate. He sent his tongue probing as MacGyver
had done. Mac anxiously sucked the gem in his mouth, then sent his own tongue
into Daniel's hot mouth. Daniel knew exactly what Mac wanted. This drove Mac
wild. He needed something else sucked.

He quickly moved into a position to shed his pants. As Daniel started to
strip too, he noticed Mac wasn't wearing any underwear. "Don't you wear
underwear?"

"Nope! I like to feel free. It's very relaxing. Especially in bed." Mac took
Daniel's hand and lead him to the bedroom. "Have you ever slept in the nude?"

"Um...nude...Well...I have a roommate."

"You can sleep here tonight. I'll even let you sleep naked." Mac smiled
hopefully. MacGyver pulled the naked man into a kiss. They stood there
kissing, allowing there bodies to mingle. Mac backed Daniel onto the bed. He
was careful not to land hard on top of Daniel. After a few more kisses,
MacGyver began to make his way down Daniel's chest. Once again he stopped and
teased Daniel's nipples. Daniel began to tease Mac's, too, but MacGyver had
other plans for that hand and pushed it down to his waiting cock.

Mac could see Daniel's need. Taking Daniel's cock into his mouth he could
taste his precum. Mac shifted his position to straddle Daniel's face and
slipped his cock into Daniel's hot wet mouth. Daniel was unsure exactly what
to do, but once again he followed Mac's lead. Mac was sucking wildly at
Daniel's throbbing member. He had found a good rhythm, rocking his hips and
driving his full length into Daniel's aggressive lips. A quick study, Daniel
soon matched the pace. Mac wet a finger and let it slide between the two
cheeks and Daniel did the same. Daniel's ass was very tight so Mac only
messaged the outer ring.

Mac was going crazy. Daniel wasn't penetrating. Mac knew he wouldn't unless
it was demonstrated to him. He really didn't want to hurt Daniel, but his
lust won out. Mac once again wet his finger. He slipped it in just long
enough for Daniel to do the same.

"Don't stop." A very breathless MacGyver rang out with relief in his voice.
"Please, keep doing it."

Daniel did as Mac asked. Mac started to caress Daniel's sensitive balls with
his other hand. This time Daniel could not reciprocate. Mac's grasp on his
testicles was more than he could stand. Daniel released MacGyver's hotcock
from his lips in a vain attempt at catching his breathe. It wasn't long
before Daniel came. This set off a chain reaction in Mac. The feel of
Daniel's hot juices flowing down his throat was more than his body could
stand. Mac shot his load all over Daniel's chest.

Mac rolled over on to his back. He was breathing very heavily but was still
trying to speak. "Do you want to get a bite to eat?"

"I think I need a shower first." He whispered through labored breathing. Mac
turned around to face Daniel.

They kissed softly, both to tired for anything more. "Can we do this again?"

"This and a whole lot more." Mac said with a nasty smile. "But not without
showers and some grub. You want to take a shower with me? It's a lot of fun!"

Daniel rolled on top of Mac kissing him wildly. "Does that answer your
question?"

"Oh yeah! I can tell this is the start of something great!"

Daniel awoke from his thoughts to hear laughter. As he emerged from his tent
he could see Jack standing in front of Teal'c. Junior was out and Jack was
about to pat it.

"Watch out, it bites!" Daniel said with a chuckle. Jack withdrew his hand.

"Welcome back." Jack said with a smile. "Would you believe they dared me to
touch Junior?"

Jack reached out his hand and gave Junior a quick pat on the head.

"My turn to ask a question." Daniel stated. "Jack, truth or dare. Ever kiss
another man?"

"I'll take the dare if it means kissing you." Jack was grinning in
anticapation. Jack stepped up to Daniel. Taking him in his arms, Jack leaned
Daniel over, gave Daniel a long passionate kiss, then stood him back up. "I
guess that's a yes. Now my turn, Daniel. And I think it involes you, me and a
tent."

Daniel just smiled with the thought of getting Jack into his tent.

WIPOOOOO

[Anonymous Coward]

In other news, Jraxis confesses! He was Wipo all along!!!!1

ROTC

[redelm]

This is conceptually identical to the Army/Navy ROTC program, replacing military discipline/law with serious non-disclosure "official secrets" obligations.

Re:ROTC

[nathanm]

Not quite, it seems this program is just a scholarship to pay for a Master's degree with two years of obligated employment. ROTC is a program to commission officers in the military (mostly undergrads).

ROTC includes classes, leadership laboratories, and summer field training during school. The service commitment time is usually 4 years (or 5 years if they pay for that many). Also, not all ROTC cadets get scholarships, some in the program just pay their own way through school but still get commissioned.

Re:ROTC

[Traicovn]

We have the security emphasis program in my school at Mississippi State Computer Science I don't know if they have information up about it or not, but your allowed to apply for it as a JUNIOR and it pays for two years of undergraduate if you want. Perhaps it's just different in other places though..

Re:ROTC

[Eil]

In the Air Foce, the service commitment for most programs is twice the amount of time the USAF paid for your education.

There are literally dozens ways to become an officer, partly because the services are really hurting for members right now. And to anyone considering a commission: don't think of a commission as some nifty job you get to try out for a couple of years. You join the service for x amount of years and your life will be the service for those x years.

Re:ROTC

[nathanm]

In the Air Foce, the service commitment for most programs is twice the amount of time the USAF paid for your education.

No, the commitment is equal to the number of years they paid for, but the minimum is 4. Some majors can get 5 years paid for.

There are literally dozens ways to become an officer, partly because the services are really hurting for members right now.

No, besides doctors, lawyers, & chaplains (direct commissions with 2 or 4 weeks of training), there are exactly 3 ways to get commissioned into the Air Force: the Academy, ROTC, & OTS.

Re:ROTC

[Eil]

No, the commitment is equal to the number of years they paid for, but the minimum is 4. Some majors can get 5 years paid for.

I can't bring up any specific ROTC programs, but I know that there is at least one that requires you to give back at least 2x the amount of time you're in school. Maybe there is another minimum x amount of years that get tacked on, but they don't advertise that.

No, besides doctors, lawyers, & chaplains (direct commissions with 2 or 4 weeks of training), there are exactly 3 ways to get commissioned into the Air Force: the Academy, ROTC, & OTS.

But there are different ways to get into those 3 different commissioning programs. I know because I'm active duty enlisted and they are constantly advertising them--they want more high-quality enlisted members to try for commissions, it's less training the AF has to do. And in the opinion of many enlisted and officers alike, it frequently results in better officers. If I had my way, all officers would have to have a minimum amount of time (say, a year or two) as enlisted before their commission starts. But that's just me.

Re:ROTC

[nathanm]

I can't bring up any specific ROTC programs, but I know that there is at least one that requires you to give back at least 2x the amount of time you're in school.

There are no ROTC programs that have a 2x yr commitment by themself. However, if you become a pilot you have a 10 yr commitment after training, & navigators have an 8 yr commitment after training.

But there are different ways to get into those 3 different commissioning programs. I know because I'm active duty enlisted and they are constantly advertising them

Right, just remember that they all funnel through the 3 programs. I was an active duty SSgt, now I'm in ROTC, through the ASCP.

If I had my way, all officers would have to have a minimum amount of time (say, a year or two) as enlisted before their commission starts. But that's just me.

I definitely agree! While many non-prior-enlisted officers were good, I believe on average the prior-enlisted ones make better officers. After going through ROTC field training and seeing what a joke it is, and how bad of a program ROTC is, they should at least send every officer candidate through basic training.

CS in the 21st Century

[JamesOfTheDesert]

I hope they're not recruiting at one of thoses schools where students study computer science by learning Java.

"Machine code? Huh? Direct memory access? Programs can't do any of that!"

Re:CS in the 21st Century

[benjamindees]

oh, well, never liked them much anyways...

sad but true

OT: College slacking strategies

[swb]

When I was in college, I found that the overall grade for a course was usually about 50% exams and 50% coursework. The coursework usually invovled applying some basic elements of the class that were usually identifiable from the syllabus or the first day's class outline lecture.

The exams were usually well over 80% based on the course lectures, which tended to be an overview of the reading. The better professors threw in some easy nuggets that were never discussed in class, only in the readings. The weaker ones lectured basically the books plus some fill-in material, but the fill in was just glue to give the course some coherency.

I found that I could ace most classes if I wrote an A paper and scored an A on the exam. The work it took to do this involved light reading of research material and great class notes. The actual assigned reading I generally just skimmed to make sure there was no great deviation from the lectures. I seldom if ever actually "read" it, except for literature assignments. Just going to class, writing notes and doing the paper was all it took.

I discussed this with a friend who is a history professor and he said that undergrad land its pretty difficult to have significant test material on assigned readings without 2/3s of the class getting Ds or Fs -- even if he announces on day 1 that 50% of the exams will be taken exclusively from readings not lectured in class. He thinks its legit to do this, but hes gotten flak from department people who say its beyond the scope of the average undergrad to assimilate meaning from academic readings.

I would assume at serious classes at high-end academic places like Harvard would have lectures that didn't cover the readings AND readings not included in the lectures, making it impossible (without notes from somebody who WAS there) to get more than C if you skipped lectures.

At other schools (mine was a big 10 university), skipping lectures was suicide but skipping the reading was not.

REAL security [Re: Bash boy, bash]

[octogen]

We should not ask whether UNIX is or is not more or less secure than Windows NT, we should ask whether a specific derivate of UNIX can be made more secure than Windows NT can be made.

You are all mainly talking about application level security.

How many exploits are there on Windows NT - for IIS, for LANServer, for other NT services, for hacking the registry?
How many exploits are there for Linux - for Sendmail, for BIND, for telnet and even for SSH?
You mentioned OpenBSD, so let's take some look at OpenBSD. Its DEFAULT install is secure.
What about adding third-party software? What happens, when you've got Sendmail installed, and someone manages to hack uid 0 by exploiting some vulnerability in the Sendmail daemon?

All of these exploits are application level vulnerabilities.
The real problem with operating systems is, that they highly depend on application level security. Even OpenBSD is NOT really a secure Operating System - it's just a really secure software distribution.
OSes themselves may not be vulnerable - but their highly privileged application make them vulnerable.

However, for some derivates of Unix and specific setups of Unices, this is no longer true, while for Windows NT/2000/XP it is still true - and that is, why some Unices actually are more secure than NT, because their OS Kernels offer really strong security below the application level (user space).

Did you ever take a look at Trusted Solaris, at AIX/CMW, or at Argus' Pitbull for Solaris or AIX?

Sure, if some application is vulnerable to being exploited, it will still be vulnerable when running on one of these OSes - but it doesn't matter that much, because these Operating Systems are locked up from inside the OS kernel.
On 'normal' Unices, you simply attack some process, which has root privileges, and all system security is gone because of root's omnipotent superuser privileges.
On the OSes mentioned above, you do not run any process with root-like privileges, because you simply don't need to - instead, you've got a large set of privileges to allow some very specific privileged operations (like using a restricted port or changing the root directory), so what do you want to attack in order to get access to the Operating system itself?

On an Argus-enhanced Solaris box, for example, Sendmail would be running in its own compartment and with the PV_ASN_PORT privilege in it's effective privilege set.
If someone would successfully attack Sendmail, he/she would...
a) ...be locked down into sendmail's compartment
b) ...probably lose all of sendmails privileges when exec()'ing another binary, because the other binary does not have these privileges in its proxy privilege set
c) ...not be able to access configuration files, because they are probably protected by an integrity label
d) ...not be able to read secret information, because MAC's sensivity label would not allow it
e) ...not be able to gain any further privileges, even if he/she could exploit highly privileges binaries, because these privileges are not in the session's limiting privilege set

Provided that these Trusted Operating Systems are correctly configured, the only way to hack into one of them is to attack the OS kernel itself.

So, how many exploits can you find for the Pitbull-enhanced AIX kernel?

More information:
Trusted Solaris
Argus Systems

kind regards from Austria,
octogen

Purdue is one of the recipients

[cpfeifer]

The CERIAS program at Purdue University is one of the recipients of this NSF grant. Other recipients include: CMU, and the Naval Post Graduate School. But this isn't necessarily a slam dunk, you still have to be admitted to the program at the school you apply to.

A free education is nothing to sneeze at. Talk to a current grad student who is either teaching a class or picking up his prof's dry cleaning to pay the bills and they will tell you how they wish they could find a funding source like this.

The institutions that received this grant do cutting-edge research in security that will influence the field for years to come. Heck, I'd do it just to go and study w/Spaf.

Too wordy

[SumDeusExMachina]

You write like me ;-)

This kind of thing would probably work better from a third person omniscient perspective. That way you don't have to confuse the reader about what's going on by thinking in the vernacular, and you can more effectively satirize Walmart security. For example, have them do something stupid, but don't explain what the thinking was behind what they did.

Other than that, this looks like it could be a pretty interesting serial. Keep writing!

DOD has a long road ahead

[cicci0]

Considering the fact that the DOD is a monster beauracracy with more security holes that swiss cheese, the task of pinning down info sec is monumental. The manpower required to really get the job would be 10 fold the proposed graduating class. As a former member of Air Force communications squadron, I cringe when thinking about the lack of sophistication involved in managing their networks. NT is embraced as the desktop OS of choice but so is it amongst a majority of large corporations. The difference is the backend, also NT based couple with Novell, or so it was 5 years ago. Network outages were common place, I remember one time email and internet access being down the entire day! I wasn't behind the scenes to give actual specifics, but I was close enough to say it was a two bit operation. Take into account that this sort of operation is found in every squadron (20 or so) on each base and we at the communication squadron were supposed to be the experts. Now take this scenario and apply it to the rest of the bases throughout the world and don't forget to factor in the Army, Navy, Marines, and you end up with a nightmare of a situation.

Good Idea

[4of12]

You can't realistically expect the government to be able to attract top of the line talent in IT security with their traditional job structure.

You know: come in from 9 to 5, have a GS rating with plodding single digit percentage raises each year, put up with a few petty bureaucrats, slug it out for several decades and finally retire well off.

The people they're after are young and don't care about retirement plans, but do care they get paid what they're worth on the open market and don't want supervisors having a cow if they come in 8:05 am.

I think any plan, like this one, that helps to get those talented people into government service is just what the government desperately needs.

It reminds me of people going to medical school on military scholarships and serving a while after their schooling is finished.

setting some things straight

[ironleaf]

The program only accepts U.S. born applicants; more information on the Iowa State fellowships is available as is information on the program as a whole. Most of the core training at Iowa State is in Computer Engineering classes: CprE530(protocols), CprE531(security), CprE532(warfare/hacking), CprE533(crypto) and CprE534(ethics). If you take a look at the ISU fellowship specs, I think you'll agree that this is a decent way of paying for school and serving your country at the same time. I agree with the previous post that this is basically ROTC for geeks. ;-)

Here in Mississippi

[Traicovn]

We had the security emphasis full paid scholarship last spring BEFORE 9/11 happened. It's been available for about a year now, however after 9/11 happened the emphasis to get people interested in it increased. It's a brand new program nationwide and at Mississippi State, so I know that it's not entirely the 9/11 'experience' that started the program, since we began school in August and they announced the program in the spring... However 9/11 has definitely fueled the program, funneled more money into it, and increased interest. They give you a ton of money to be in the program, thousands of dollars, however you are required to do so much internship time with the gov't and then you have to go into a gov't security position WHEREVER THEY WANT TO PUT YOU when you graduate. I considered it at first, but I'm not sure it would have been the best route for me personally to take.
At least the gov't is trying to get some better sysadmins into there workforce. Not to insult any gov't sysadmins out there, but it's obvious that they want more people checking each others work so that there are fewer holes, hopefully/theoretically.

Happening here

[Lish]

I'm a grad student in CprE/Security at Iowa State, one of the schools administering this program; I was too far along in my studies to apply. Some notes:

1. This started before 9/11. This is not in response to terrorist threats, but rather a real nderstanding that critical infrastructure is at risk.

2. There are both 2-year fellowships for grad students and scholarships for undergraduates. They cover full tuition, room, board, books and fees, plus a stipend.

3. It works a lot like a ROTC scholarship: we give you two years of support, you owe us two years of work after you graduate. Which in security isn't a bad tradeoff; guaranteed job plus very resume-boosting experience. Yeah, you can make more money elsewhere, but it's a good job.

If you want more information about actually applying, you can look at the program webpage here, or the ISU Information Assurance Program site here.

The wrong solutions

[ClosedSource]

"This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority."

Yeah, there seems to be no end to the proposals the government has come up with since 9/11. The only problem is, none of them would have stopped the 9/11 terrorists. It's a bit like shutting the barn door after your car has been stolen from the garage.

Bo^h^h CyberCorps knows Football!

[Bjorn_B]

Don't discount the athletic ability of the CyberCorps!

At the University of Tulsa, we made it to the finals for Intramural Flag Football. However, I don't believe TU's real football team could handle writing an Intrusion Detection System for a Signalling System Seven telecom network. Check us out!

benefits of working for the CIA

[Alien54]

From their benefits page

The George Bush Center for Intelligence has a campus-like atmosphere with lovely grounds and well designed work areas. Artwork and displays from around the world add extra interest to the busy day. The Agency has a casual dress policy when appropriate. Employees have a choice of a variety of foods in the modern Food Court or can arrange to have an elegant lunch in the Agency Dining Room. To keep in shape, employees have access to fully-equipped fitness facilities, a jogging track, and walking paths. A company store, recreational and activity clubs, access to entertainment tickets, and on-site dry cleaners, film processing and barber shop add to our employees' quality of life.

The George Bush Center for Intelligence?

Yes I know this is likely a research facility.

Is this something like the search for Intelligent life in the Universe?

Re:benefits of working for the CIA

[Anonymous Coward]

George Bush Center for Intelligence is, in fact, CIA HQ as in Langley

Not inspiried by 9/11

[Dock]

This is so horribly inaccurate. Bill Clinton was trying to gather support for Government funded training schools for IT security that mandated Government service afterwards while he was still in office. I never could find substantiate information on it and I assumed it simply got lost at some point.

I don't really see a big correlation to that tragic event and this program, at all. What, is learning how to properly firewall a system going to suddenly make INS and customs capable of keeping known terrorists out of our country? I don't think so. Not *everything* that happens in this country is related to that, you know.

Re:Not inspiried by 9/11

[ruheling]

Although you may not realize it, you've hit on the exact point of the program (at least from my perspective as a participant). Learning how to secure a firewall will not help the INS - or anyone else - from doing anything silly. Hopefully, the students trained and funded by this program will be able to help create intelligent information policy - including, but not limited to, the actual work of securing computers.

Re:Not inspiried by 9/11

[benjamindees]

By their own admission, from literature I've seen, this program is exactly learning how to "properly firewall a system", because even CS students don't come out of college with that knowledge. Not even how to firewall a gov't system, since all of the critical systems are, as many have already pointed out, physically secure. (I know, that wasn't a sentence. I'm too lazy to fix it.) It is simply a program to use government funds to train people for corporate jobs, hence the paltry 2 year requirement. This is *yet* another instance of the facist tendency of US politicians to sell the fruits of publicly-funded research directly to the corporate establishment. Although, in this case, it at least benefits a few hard-working CS students also.

Look at how old the 'students' are.

[Ryu2]

Look at the pic in the CNN article -- they look like my grandma and grandpa! Not exactly our typical college students, huh? =P

How much of cyberterrorism is FUD?

[Ryu2]

Aren't all the REALLY critical systems (defense, air traffic, etc) already air-gapped from public networks like the Internet?

it's over

[Eil]

It is, however worth noting that according to the scholarship program website, the proposal deadline for this scholarship was December 19, 2001. Way to fuck with me on 01Apr, Slashfags.