Slashdot Mirror
U.S. Agencies Earn "D" For Computer Security
Fighting.Cephalopod writes "For the fourth year in a row, most federal agencies have received low grades for failing to protect their computer networks from hackers and other cyberterrorists, according to a computer security report card issued today by the House Government Reform Subcommittee on Technology."
Other readers point out coverage of the report at ZDnet, Reuters (via Forbes), The Washington Post, and ComputerWorld." As
mr. don't points out, the agencies receiving an actual failing grade are "the U.S. Department of Justice, as well as the departments of Energy, Health and Human Services, Interior, Agriculture, Housing and Urban Development, and State."
the Department of Homeland Security do?
I don't read your sig, why do you read mine?
so let me get this straight, if all those failed security provisions are hacked, you'd get:
1) hacked into the place that controls whether or not you go to prison(funny they're also the ones that investigate election fraud if I recall, I could be wrong, I'm Canadian)
2) hacked into the place that controls nuclear power plants
3) hacked into debt(identity theft) through the place that controls employment, etc...
4) hacked into the place that determines if there is war or not
(agriculture, interior, and "housing and urban development weren't good targets)
*notices how Canada doesn't announce that kind of thing, I think they're embarassed at how badly they do*
Comment removed based on user account deletion
This is MHO:
Look how much is spent on 'physical' security and you will see why. A Government agency that is physically attacked (eg bomb, chemical, bio) usually results in human casualties/lives...and is very hard to cover up.
Now look at attacks on computer security (eg cyber attacks, worms, compromised systems). A Government agency that is 'electronically' attacked 'APPEARS' to not result in human casualties/lives.
Notice I stressed the word 'appears' in my last comment. I say this because it may be the real situation OR it maybe we don't know as previous cases have been covered up...as it is easier for an organisation to cover up these types of attacks.
After my experiences dealing with DOD contractors, and their use of firewalls. Specifically, firewalls were used to strip out javascript on the fly; they were not used to block unauthorized access (that, of course, was left up to the administrator of each individual server).
Needless to say, this does not lend itself to a centralized, comprehensive security plan.
Added Chairman Davis, "I'm deeply concerned that too many agencies have not yet responded to FISMA's requirements; for example, the fact that 79 percent of agencies don't even have accurate system inventories casts doubt over the entire reporting process."
I work in IT for a govt. agency here in Canada, and to not have an accurate inventory of our hardware is absolutely unthinkable. 79% of agencies having no idea where their systems are (and arent) is a recipe for disaster.
This whole thing reminds me of a couple of years back, when a CSIS (Canada's spy agency) agent went to an Ottawa Senators hockey game, leaving her laptop in her car, only to have it stolen when the car was broken into.
The main problem with ALL government agencies is that almost all of their actually employed work is 90% opened only to internal candidates. And they try to fill it in that way. Why? Because background checks cost a lot of money, and getting clearance for people up into the higher echelons would cost even more. That's the main part of your problem right there, really. If they hired more people externally, and paid them what they're worth, no problem at all.
I used to work for a government contractor a couple of years ago. Security - even when we got security guidelines, my fellow coders picked and chose which of them they actually felt like coding.
Now, should they have been canned? Absolutely. Were they? No. Is that the government's fault? Only partially, in the sense that the government didn't have any way of verifying whether the work we were doing met the standards they specified. Management at the government and at the contractor simply agreed that things looked good, and that was that.
Hence my comment.
Subscribe for free to my show!
Did you actually expect anything different? Most anytime a report comes out about a government agencey, it is bad. The whole point of having a report is to show that it is bad. I sure the points that are raised are valid but I hardly think that the report was supposed to be balanced.
Not everything is analogous to cars. Car analogies rarely work.
The only thing that WOULD be good in my opinion is setting up liability legislation. If any contractor or software company KNOWINGLY designs and deploys a system whether hardware or software without making security a key design consideration in the interest of making the lowest bid, then they should be liable.
There comes a point of accountability when contractors should stand up and say, "I won't do this project if you won't fund the proper security design issues."
You wouldn't knowingly make cuts that would effect whether a system actually operates or not. Security shouldn't be any different.
I have turned down jobs before when I knew that what they asked was completely at odds with the client's best interest. I told them that and they understood.
Equally should agencies and companies be held liable if they knowingly deploy a system that is fundamentally insecure in the interest of just "getting it done." A bank would be held liable if they left their front doors wide open and their vault unlocked overnight. Leaving security unconsidered in computer and software systems should be treated equally if not more harshly.
Well that may be true internally but a spot check of that server list listed all 4 that I looked up as running Solaris with Netscape.
Kyoya
To strive, to seek, but not to yield
The government's responsibility in IT is project management - at least in the agency I work for. You wouldn't expect your CIO or any other manager to be 100% up to speed on latest IA trends - that's what we have contractors for. Government IT professionals make decisions based on input from the people who actually do the work.
I've worked both sides of the fence. I spent four years in this agency as a contractor heading up desktop support - at the time we had 3200 users in >100 locations. I started as a federal employee two years ago and now supervise the same contractors I was working with.
I'm not bashing you, but if the government doesn't pay you enough, maybe getting another job is an idea? I don't know anyone who was forced to take a job with the feds - it's reasonable to expect IT professionals to do the best job they can and identify where their employer is deviating from best practices.
That's why they call them professionals.
we see things not as as they are, but as we are.
-- anais nin
DHS 34 F
Who's surprised that the department charged with protecting our nation's infrastructure got the lowest score?
Tell me again that government is the answer to all life's problems.
God invented whiskey so the Irish would not rule the world.
Sure, non-locked hardware won't be illegal right away, but it'll get a lot more expensive when it isn't mass-produced because it can't run Longhorn.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
All of these security problems at Federal Agencies, with Blaster, Welchia, spam, "piracy" etc. are going into a big hopper, where they will be used as reasons to justify TCPA, aka the Death of My Computer.
In a nutshell,
Yeah, right."Provided by the management for your protection."
So several years ago our Lab got handed an ultimatum that we had to come up with a security plan; our computing folks wrote up a proposal, it got sent back with issues needing clarification, there was another round, etc. This went on for about a year. Finally we get one of the drafts back, and we're told, in so many words, "this one's good, you have 6 months to have it in place".
So now we have 6 months to redo every system on site, with no added budget to do so and no relaxation of other goals. To have any appearance of complying we basically had to set up a system for granting exemptions where each system exempted had to present a timeline for when it would be completed, etc. So at the end of the 6 months we were able to say that everything was either under the security plan, or had an exemption on file saying when it would be under the plan, or how it would be put behind a firewall, etc.
But the real problem was that the proposal should have been met with discussion of a reasoned, planned schedule, and sufficient resources to implement it, rather than pretending a major security rework could be rolled out for free in 6 months. This goes all the way up to Congress, who passed this law about having agencies report on computer security, but so far as I know didn't designate any funds to pay anyone to do anything about it.
Being a federal employee and a sysadmin I expect the contractor to inform his government.
I just used the DoD Wireless STIG to draft an 802.11 policy for the agency I work for. It actually wasn't a bad piece of work :)
DISA is still trying to make 802.11 impossible in DoD - but we're working out the kinks now.
we see things not as as they are, but as we are.
-- anais nin
My father is a lawyer for the Department of Justice, and part of the reason for the insecurity is the federal bureaucracy. I'm a Linux advocate and my dad is a pretty techie guy. He was running a webserver on the WAN for his colleagues and wanted me to help him set up Apache. That was shut down directly by his superiors: Microsoft IIS is the only webserver "supported and recognized" by the IT department, and anything else is not allowed. In addition, the only browser you are allowed to use is IE and the only mail reader you are allowed to use is Outlook. I really wanted to help my dad secure his workplace by switching him away from a mailviewer that executes all attachments and a webserver known for its insecurities. But the Microsoft culture is so entrenched there that it wouldn't fly.
Cyde Weys Musings - Scrutinizing the inscrutable
Okay, I know, I know - - I'm the soft-hearted liberal who still thinks government does some good and stops some evil. Anyway, with such lousy marks coming out, why don't some of the Slashdot geniuses who are not yet employed go into consulting, get some security contracts, and make some dough while improving things for all of western society?
Just a thought . . .
On the other hand, we could just go on talking about how lousy the government is in every aspect and wait for the whole thing to implode like a cow patty.
It's only funny until someone gets hurt. Then, it's hilarious.
We can't have this much failure in the US Govenment!!!
These security grades are obviously created by the MAN to keep their security grades up while making everybody else look BAAAAAAD.
We need a newer test that encompases more to make it fair. I sugues we measure the following to determine if their security grades.
Are their packet-filter inclusive?
Do they secure Appletack, Tokenring or just Ethernet?
To the set aside special days and allow special packets in?
To they support 2 letter passwords, and not just the 8 letter ones that advantaged people can type?
Do their proxy servers filter out gender discriminatory words like 'He' or 'Mister'?
Do their computers have master/slave IDE systems?
Just and example of how the curent test is biasedh
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
The sad thing is that instead of fixing these things, they go on and take away liberties from the citizens to prevent ' terrorism '. Patriot Act anyone? So, for their ineptitude, we lose our rights.
"There is no teacher but the enemy."-Mazer Rackham
I wanted to replace TELNET access with SSH to our most important server (manages all budgets, accounting, payroll, and also contains a LOT of data that would be considered a privacy breach if released.) I was informed that this could not be done because a hand full of people use an app from the vendor which requires telnet access to work. This server is on a LAN which is accessed by several hundred members of the public daily.
So I ran ettercap and showing how trivial it was to capture my boss's password and capture the whole telnet session including root password. I was again told that "Yeah, that is a risk, however, you still can't disable TELNET. It is required."
Of course, the right thing for my boss to have done would have been to pressure the vendor to move to SSH on their app. But that would have cost money after all. I couldn't even filter telnet from the public access systems because it was some of them which actually needed to run the application. In the end all I could do was send a memo detailing the risk to my boss so I could cover my own ass if something happened.
Frankly I'm not surprised. The whole "lowest bidder" framework is crap in most cases. Here is the process for building our last new school (from a tech standpoint anyhow) if anybody is intersted:
With the "lowest bidder" mentality, your specs better be PERFECT and include EVERY little detail on the setup and configuration. You can't assume ANYTHING. You had better include all the details or at least reference standards which do. The vendors who care to do a good job won't get the contract because they'll come in with a higher bid.
The ones who don't care usually win because they bid exactly what is in the specs... no more, no less. If there is a mistake, they'll build it with the mistake in place. If there is a security hole, guess what.. it goes into the system. And if you aren't writing the specs yourself, watch out. You might get an architech like we had who in one meeting finally admitted, "Well, I really don't know much about this computer cabling stuff."
You are most likely not evil, you just look like it because you like to get the job done, period.
I have worked in several different companies in the IT field from small to very large. One trend that I have noticed is that a knowledgable "technical" manager is a rarity. Some may argue that this is not true, I apologize to those managers that are 'actually' hands on at least a little with their admins. I have been lucky and have had a couple of these rare species, to learn from
From what I have seen, most managers are hired for the position because they have a degree, not a technical degree mind you but a degree (usually management).
This is appropriate in the managerial sense, however I still feel that to be an appropriate 'technology' manager you can not base your technical experience on your "Intro to Microcomputers" (ASU - consisted of 8 weeks of introductory Java and 8 weeks of Autocad...WTF), or "Using Excel/Powerpoint" classes alone.
I would be more inclined to have an highly (or moderately so) technical manager who merely has a BS in computer science (minor in business). Shows that his interest lies in the technical domain and supporting his employees in the proper ways (ie...training, mentoring, etc.), rather than someone with an MBA "climbing the ladder" to the next butt-kiss.
:-( --- argh. Despair, I owe again.