Slashdot Mirror
Cybersecurity Chief Resigns
Doc Ruby writes "AP is reporting that 'The government's cybersecurity chief has abruptly resigned after one year with the Department of Homeland Security, confiding to industry colleagues his frustration over what he considers a lack of attention paid to computer security issues within the agency. Amit Yoran, a former software executive from Symantec Corp., informed the White House about his plans to quit as director of the National Cyber Security Division and made his resignation effective at the end of Thursday, effectively giving a single's day notice of his intentions to leave.' Yoran is the third cybersecurity chief in a row, after Richard Clarke and Howard Schmidt, to quit the Bush administration citing organizational inability to do his job. Maybe the job can't be done." In a possibly related story, individuals take cybersecurity lightly: Ant writes "This story says that consumers have a casual approach toward cybersecurity and fail to grasp the pervasiveness of online threats, according to a study released Thursday. More than a third of the 493 PC users surveyed by the nonprofit National Cyber Security Alliance (NCSA) said they had a greater chance of winning the lottery or being struck by lightning than of being hit by malicious code."
Yoran has privately confided to industry colleagues his frustrations in recent months over what he considers the department's lack of attention paid to computer security issues, according to lobbyists and others who recounted these conversations on condition they not be identified because the talks were personal.
Of course they aren't paying any attention. People just aren't knowledgeable enough about the threat of cybersecurity to give a shit. These people think that there is a real threat that their house may be singled out in a dirty-bomb attack because the Bush administration is happy to have them think that. As long as the Bush administration can keep people's minds on a single track of terrorism there's no need to bring to light other avenues of attack. Why should they diversify right now? They might bore the public with their "crying wolf" on dirty-bombs and airplane searches and would need another shiny object to get everyone to pay attention to.
About 90 percent of computer users interviewed remembered the name of the performer from the last Super Bowl halftime show, while only 60 percent knew when they last updated their computer security program.
No fucking way, people remember the name of a performer from the Super Bowl after it was banged into their heads on every media outlet for two months straight? OMFG, I cannot believe it. You mean that these same people who are so concerned with the atrocities being fed to them on TV aren't concerned or knowledgeable about their computer? I can't believe it!
Face it, people don't give two flying fucks about being educated in computer know-how. They want to flip the switch and have it work. If it doesn't work they want to call up their ISP and have them fix it. Their computer is a dumb terminal for their ISP's webpage and http://www.thehun.com. As far as people guessing their chances at being hit by malicious code... They probably seriously believe that malicious code means that they bring home a disk and put it in their drive and run a program that will be an old-sk00l virus. They have no idea that there are programs out there "spying" on them every minute of their surfing experience. They just don't care enough to know. Plus these same people probably do think that their chances of hitting the lottery are good as they are dumb enough to ignore real news for their own realm of importance (Reality TV).
Without a Digital Pearl Harbor attack hitting us, it is unlikely that anyone will take him seriously, and since Digital Pearl Harbors was just Richard Clark FUD in the first place, his resignation was inevitable.
We now return you to your regularly scheduled thread.
More than a third of the 493 PC users surveyed by the nonprofit National Cyber Security Alliance (NCSA) said they had a greater chance of winning the lottery or being struck by lightning than of being hit by malicious code."
The problem is that many PC users are doing the cybersecurity equivalent of what some idiot did near my home about fifteen years ago.
He was in his boat out on a lake when a thunderstorm moved in. When others on the boat suggested that they should go to shore for fear of lightning he scoffed, stood up on the bow of the boat, stretched his arms upward and shouted "Take me now, God!".
God complied.
Connecting an unpatched PC to a broadband connection is pretty much the same thing.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Given frequent updates, ZoneAlarm, a firewall/router, precautions about not opening things I don't know about, VPNs, and other things, I probably AM more likely to be struck by lighting than hit by malicious code. But I'm a /. reader... :)
(Tinfoil cap, check.)
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming
In a possibly related story, individuals take cybersecurity lightly
To be honest, maybe it's hard to take seriously because we're busy trying to distort its meaning and importance with silly buzzwords like "cybersecurity." Why does everything have to be "cyber"-this and "cyber"-that? In my mind this doesn't sound any different than putting e- in front of everything and trying to market it during the dot-bomb bubble, and I imagine that it has a similar effect on the public. We've been conditioned since 1998 to ignore anything with e- or cyber- as a prefix. Why are we surpised that people don't take "cybersecurity" seriously, when we show by our vocabulary that we don't, either?
Instead of "cybersecurity," how about "computer security," or "personal computer security"? See, it's possible to communicate what you mean in a simple, effective way without fancy buzzwords, and people might even pay more attention. ("You mean my computer might be in danger?")
Secession is the right of all sentient beings.
Just getting people to pay attention in a corporate environment is hard enough, even with HIPAA and now Sarbanes-Oxley. Hell, if it weren't for Sarbanes-Oxley my company wouldn't even give a damn about security. That's sad, and frightening.
I can only imagine the nightmare it must be trying to be in charge of security in a beauracracy like the federal government. If you've never dealt with the feds as an employee or contractor, you have no idea how many layers thick it goes. You can't even fart without pushing paperwork and dealing with red tape.
Remember the Alamo, and God Bless Texas...
Sounds like he feels he was being setup to fail. That or they have the department wrapped so tightly with red tape that it makes the department ineffective. As most effective CIO/information directors will tell you, they're not interested in maintaining anything. They want to innovate and if you make that impossible or do not require innovation, they will leave.
-Randy
Hopefully the hydra will not spring forth another head to take its place. The question we need to ask ourselves here is: should the government even be involving itself in "regulating the Internet" to "improve security"? Considering the free market has a better track record at accomplishing nearly everything (compare the DMV to 7-11) why the hell do we need a useless figurehead like this in the first place? He's ex-Microsoft for God's sake.
If the government actually wanted to promote cyber security, the best way to do it would be to put a bounty system on the evildoers and let the market compete to catch them. Microsoft but a bounty on some virus authors and look how fast they were caught! Imagine if we had a bounty on web defacers, worm authors, and other such vermin. System administrators worldwide have the legal right to read their customers mail but until no profit motive, so they don't do it. All that would change. You think 802.11 wardrivers can't be caught? What if information leading to their arrest was worth $50,000 - how many Slashdot readers would be patrolling their neighborhood for wardrivers? It's not too hard to spot the goon with the notebook and the high power 802.11 antenna connecting to every network in his path.
Personally I'd love to put "Internet Bounty Hunter" on my resume. I'd probably start with the goon at 66.35.250.150 who keeps proxy scanning me.
If guns kill people, then CmdrTaco's keyboard misspells words.
Bruce Schneier should have this job. As a matter of fact he should be Secretary of Homeland Security.
Imagine someone walks up to you and starts talking to you about your car insurance:
"Well, here's the thing. Your car needs to be safe, and since 1997, with more highways available, more ISEC 45 systems can't accomodate Goodyear telecons. Car insurances? In your glove box, you can find your insurance info several tachometers. Make sure to astagate the TFGG Nationwide proteases for the next fifteen days, and then every fifteen days -- dirkonite 1997 malfunctions could lead to superfinite hexagon and then your gas mileage Liberty Mutual goes down. But the car is fine, it's a good car. It's going to explode and your dog will die. Just call the state RT-678 system box accelerator engine spark plug twice, after frubbing the seats and air conditioner. So, yes, Ford and Honda are a risk, but you have filters, GM just needs shafts -- in Japan."
That's basically what the average person hears when you start talking about computer security. They seem to understand some terms, but for the most part their eyes glaze over. Then they say "OK" and go back to looking on eBay for that autographed baseball. Even running Ad-Aware is a pain for most people. There's about 20 different options and if they click the wrong one they don't know what just happenned.
Small potatoes make the steak look bigger.
Really, same old - does ANYONE (I exclude the obvious hardcore security concious techies out there from this, obviously) take cybersecurity seriously? Companies dont. Home users dont. Hell, there are even Sys Admins out there that think security is just disabling the FTP server!
What I find odd though, is the differences in the way the media shows cybersecurity. Although it's been quite common in the media lately - movies (too numerous to bother counting - you know them anyway), news releases on viruses, phishing, etc. all have had (at least in Australia) an increase of media exposure in recent times. There's a lot of very serious attention out there to this issue, but it's not working!
People see a movie that examines cybersecurity, which may be discussing a real issue in the same way every other mainstream movie does (ie. somewhat realistic... Willing suspension of disbelief and all that). What I don't understand though is that movies about other topics make people stop and look at the bigger issue being discussed. People watch a war movie and go "oh hay, war is bad/good/hell". People watch a horror flic and go "oh hay, i'm going to buy me an axe and board my doors up to keep those psychos out". People watch a "cybersecurity" movie (or even news) and go "hah, it'll never happen to me - I know everything about my computer!".
Until we fix this problem, and get across to the public (and hence Governments) that this IS a major issue (and that it isn't going away), the problem is just going to get worse.
I guess part of the problem is the fact that the topics are usually quite abstract. Often, you can't explain how or even WHY these things happen without getting into some fairly abstract details. What do you mean people can talk to my computer? But it's listening to multiple things at once? And some might be good? But why would they want to use my computer to talk to websites?
AAAaaarrrrghhh....
Regardless, something needs to be done, as this is an all to common event.
[root@GRIFFIN root]# rpm -e coffee-1.22.3-1a.i386.rpm
error: removing these packages would break dependencies:
"Well airline security wasn't really an issue before Al-Queda's sightseeing tour of New York and DC, either. "
One quibble about that sentence: Airline security became an issue in the early 70s when hijacking came in vogue. All those security checks and rules are used to at the airport? Didn't exist back in the 60s and earlier. The hijackers would do something like smuggle a gun on board, and they would react by installing metal detectors. Then the hijackers would ratchet up the ante, and the security people would add a new check. Finally, security became fairly good at airports, such that hijacking went down in frequency. So the people who might have tried hijacking now tried, say, putting bombs on board, and the escalation of cat-and-mouse moved in a new direction.
It is a sad irony that people became trained to sit quietly during a hijacking since that was the best way to ensure your safety: wait it out until it was over and you'd be fine. The 9/11 hijackers used that psychology to their advantage. But that advantage is forever gone, for never again will passengers sit quietly by waiting for it to be over. That fact is how I know there will not be another 9/11 incident of the type we saw that horrible day. Instead, terrorists will try something entirely new. Something to think about as you wait in that endless line at the airport, realizing that they are busy chasing yesterday's terrorists, and probably haven't a clue what tomorrow's terrorists might dream up. Depressing thought, but probably realistic, given the history of airport security for the past forty years.
If a story were to come out that Amit say wanted to implement more DMCA-like restrictions on the Internet and was frustrated because the administration wouldn't let him we'd all have a different attitude. But since this guy quit the BUSH administration, he obviously was suffering in his job trying to do right by all Americans and was being squashed by the man. The fact that he gave effectively 1 day's notice points to a character problem. What's the over and under he starts popping up on talk shows and campaign stops with "a revealing look into the Bush administration" soon?
The average Joe does want to learn. They're just under no obligation to think that the things you want them to learn are worth learning. My mom gets on my case left and right about how culturally ignorant I am--I've only heard Monteverdi's Vespers of the Virgin Mary once, and how is it that I can hate The Marriage of Figaro when I've only heard half of it? But I'm not oblivious because I don't like opera. I've prioritized. I've made sacrifices.
The average person isn't apathetic or stupid.
Instead, the average person is not you and probably doesn't want to be you.
The average person cares a lot about things which affect their lives. Ask a farmer what he/she thinks about the latest pesticides, or if terracing has conserved as much soil as environmental proponents say. You'll get an easy hour of discussion out of a farmer that way. It'll bore you to freaking tears, but you'll get an easy hour of discussion out of a farmer that way.
Ask a teacher what he/she thinks about No Child Left Behind. Ask an automotive engineer what he/she thinks about the disappearance of shade-tree mechanics.
Kid, you are an elitist geek. The world's a much bigger and more interesting place than you give it credit for.
Open your eyes. Open your eyes and enjoy the world as much as you can while you're young. Don't do what I did and spend the first 25 years as a pessimist before realizing how empty and useless pessimism is.
I'm a cynic. A cynic is someone who's seen enough of humanity's beauty to be thoroughly convinced that it exists--and enough of humanity's ugliness to be thoroughly appalled at how rarely humanity's true beauty shows through.
But take my word for it. The beauty exists, if you're willing to open your eyes. And the beauty will take your breath away.
Have a nice life. Really. I mean that.
no you missed the problem...
"former software executive from Symantec Corp"
I have NEVER met an executive that has a farking slightest clue as to computers let alone something as complex as computersecurity.
Let's get a restriction that that office can not be held by anyone that was an executive at ANY company.
How about a REAL expert that spend 5+ years in the trenches of a NOC?
oh wait this is the USA, those who can.... do, those who cant, LEAD.
These are the people whose computers are being used to send spam while they sleep.
The purpose of Homeland Security is to centralize all information about YOU and ME and then use it... for something they never tell us.
... the truth is that even a patriot can see that the GWB White House is a criminal organization that has brought the USA to it's worst since the Vietnam Conflict, and this tim enext year you'll WISH it was only as bad as 1967. And we all know how well that turned out for those who opposed that war too. Of course, back then you only had to worry about the FBI, the CIA, the NSA, the cops... man, you'd think the USA was a nation of criminals.
Homeland Security cannot function without the Patriot Act to give it it's power. All of this is just like the purpose, and genesis, of the Gestapo. Back in 1933 it made sense to create new State Police only if you wanted to oppress disent.
And as we know, Homeland Security is really only famous for arresting artists, academics, hackers, musicians, and Tommmy Chong! wtf!
So of course people like Richard Clarke are "resigning"
Damn straight skippy! I've been dreaming of this for years
Sure, maybe. Or perhaps they have no idea what "malicious code" is in the first place. BTW: They shouldn't have to care about malicious code! It's like asking Joe-on-the-street what the US strategic and tactical strategies should be in the Middle East. What kind of background/training does Joe have? Why in the world would I give a crap about his answers on any polls.
Ahhh yes, IT snobiness strikes again. The average person shouldn't have to "give two flying fucks" . The PC industry should get its act togeather and deliver "dumb" terminals that do exactly what people expect them to do. Chances are, you don't know anything about natural gas fittings, but you still use a stove. I don't know anything about generating and containing microwaves, but I still eat frozen burritos. Why the hell should we burden Joe-average with patches, virus updates, malicious code, .dll's, conflicting IRQs, etc...? Especially when all they want to do is read e-mail, download pr0n, and play games. It's not like the average PC user is trying to develop a new OS kernel.
This one gang kept wanting me to join cause I'm pretty good with a bo staff.
>Face it, people don't give two flying fucks about being educated in computer know-how.
I dont care how my fridge and toaster work, at least on the level of maintaining them properly and repairing them. Along with my car. You're being too geek-centric here and blaming the victim.
Why aren't Mac users having the massive security problems Windows and Unix users have? The problem is the product and the vendor. We are at a point where you can make a safe OS you dont have to babysit. The market has delivered it in the form of OSX, for the most part. Linux is no magic bullet either as it runs so many services, is very user unfriendly, etc. Come on, face facts here before I get modded down for diverging from the "party line."
What people need is a better product, not four CS classes on network security. What people need is to do their work and shut the thing off and not worry about it. What people need and what they are getting from Dell et al are two very different things. If we're going to blame the Bush administration, lets blame them for letting MS go when they could have broken them up into two or three different companies.
For every field there's someone like you who blames the user. Be it the mechanic who is pissed that "stupid drivers" can't figure out how to change a fuse or their own tire. Or plumbers sick of doing midnight calls because landlords put off maintenance and something breaks in the middle of the night. Or local telco/power companies sick and tired of triming your trees for you when your tree breaks a power line.
IT should work for people. People shouldnt be working for their computers. Blaming the user is the wrong way to go about it. Blame the designers for not making a user-centric design. Blame the designers for shipping code riddled with security holes.
If my experience with the TSA and the DHS is any indication, then I'd have to say that this problem is not at all surprising.
The people who are in those positions seem more interested in keeping things from changing and keeping their jobs. They want a government paycheck but they aren't interested in actually doing their jobs. The problem with that attitude is that since the DHS is so new, there is no "keeping things the same." It's about growth and forming an organization. It's amazingly ridiculous how things operate (or fail to operate) within the places I've been exposed to.
>"Maybe the large numbers of Microsoft workstations present an intractable problem". Stunned silence.
If someone tried this at work I would give him a stunned silence too.
Here we are trying to fix a difficult problem with everyone's job on the line and someone want to play Monday morning quarterback by sprouting off comments that does not help, unless you think you can get the entire company migrated over and trained to use Linux in the next 2 hours.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Ask a teacher what he/she thinks about No Child Left Behind
I work for a large (45 school) district and I can tell you it does more harm then good.
Anyone that refuses to see the problem that MS is and continues to embrace MS software products in spite of more secure alternatives is stupid, corrupt, owns too much MS stock, or all of the above.
You are being MICROattacked, from various angles, in a SOFT manner.
Does everyone remember the 'secure linux kernel' that originally came from the NSA, which part of Dept. of Defense.
There is at least 100 NSA programmers who regularly contribute to various GPL/Open Source projects. The difference is that they don't use nsa.gov email addresses when they contribute.
I'm certain if those NSA programmers had their way, Linux or FreeBSD would be the only desktop OS allowed anywhere in the DoD.
~hostguy2004
In Soviet Russia ^H^H^H America, The bank finances YOU!
All those security checks and rules are used to at the airport? Didn't exist back in the 60s and earlier.
A side note, the US is the only country I've been to that allows non-passengers up to the embarkation gates. Anywhere else, you get stopped at customs and can't proceed without a ticket. Curbside check-in, which I'm still fuzzy on, but as I understand basically puts your luggage right on the plane stright from the taxi, is another huge issue.
Let's face it, the US was always behind in security, because despite the good sense of dozens of other countries (Canada, for example, and the UK, Israel, Holland, and so on), the US didn't care about security until they had to - and even then, the rules were so absurd that they served only to provide an assurance - terrorsts are after your lucky charms, but we've put measures into place to make your cereal safe!
It's all BS. The government only cares about security because it's one more thing they can claim when the election rolls around. They can make people afraid in general, then make planes safe, but still not make people safe from planes. They're trying to have it both ways, and it just doesn't work like that.
--Dan