Slashdot Mirror
U.S. IT Infrastructure Highly Vulnerable
An anonymous reader writes "The President's Information Technology Advisory Committee in their February 2005 report to GW writes "...infrastructure of the United States, which is now vital for communication, commerce, and control of our physical infrastructure, is highly vulnerable to terrorist and criminal attacks." It goes on to say that "fundamentally new approaches are
needed to address the more serious structural weaknesses of the IT infrastructure" and finally offers "four key findings and recommendations
on how the Federal government can foster new architectures and technologies to secure the
Nation's IT infrastructure." Here is yet another, not surprising, bleak outlook for cyber security in the United States. The full 72-page report can be found here."
Secure, is what IT ain't!
Is slashdotting a .gov site an act of terrorism?
or maybe the terrorist took it down to keep there secret protected...
-Tim Louden
I don't know if this is just to increase paranoia or not in the US, but if there are security issues it is better that they talk about them, bring them out into the "open" so to speak. There is nothing they couldn't dream up as a terrorist or other attack on the IT infrastructure that hasn't been thought up already by others, even in the terror game it is hard to be truely original. And at least by going through the exercise of thinking like an attacker they may help spur the development of better defenses, traps, early warnings, recovery procedures , what have you.
The rock, the vulture, and the chain
... true indication of the US governments commitment to security if they moved away from M$ operating systems.
Free Firefox news reader.
I'm not doubting that this report is accurate in so far as systems are insecure, but the real danger is from script kiddies and other such people, NOT TERRORISTS. Using the word so far out of context to drum up interest (and thus funding) is despicable.
It always worries me when I see the current administration saying things like this...
:-\
highly vulnerable to terrorist and criminal attacks."
fundamentally new approaches are needed to address the more serious structural weaknesses of the IT infrastructure
It isn't that they aren't right... It's just that whenever they go on and on about terrorists threatening our way of life it seems all they really want is to implement new ways of taking away our rights without actually protecting us at all.
Sure wish I could actually read the article.
I haven't RTFA (who can, it was /.'ed almost instantly), but this sounds a bit like a segway into trusted computing -- or paladium, or whatever MS is calling it. I would love to believe they'd get the clue and go OSS, but with the amount of sugar-daddy financial pull MS has with our government officials, I just can't put any hope in that theory.
Working in a DevOps shop is like playing in a band made up entirely of keytarists.
http://lazowska.cs.washington.edu/CyberSecurity.pd f
if found this /. quite (from the bottom of the page) to be perfect: /.ed AND is supposed to be talking about a failure of communication. Anybody else like it?
"The biggest problem with communication is the illusion that it has occurred."
considering that the server was
-Tim Louden
Just a single example, but when you have a principal and an assistant principal at each school, both making 100,000+ $USD, that money gets used up in a hurry. Why don't they spend some of that money on teachers to lower class size? It's a bunch of stupid politics, and the students continue to suffer for it. There are dozens of other positions like that. I can see a need for a single principal, but what about all these other stupid positions?
In the High School at the K-12 district where I worked before, the "assistant principal" fixed his three sons' grades before he got caught and had to "resign to pursue other opportunities", and the "normal principal" was caught (by me) surfing porn after hours. Fucking brilliant.
Can you tell I'm jaded?
Qualitas edurus commercium, nullus penitus net rimor, nullus deus beneficium
This all seems a little alarmist. Our IT infrastructure is far more secure than our physical infrastructure, because our IT infrastructure has grown up under constant threats from script kiddies, trojans, and worms. 9/11 was possible because we have (or had) a basically open, trusting society. That's not true online.
Servers across the internet are under constant attack from all kinds of viruses, worms, and malicious hackers. Even the most successful viruses amount to little more than annoyances, and can be easily protected against by any systems administrator worth his salt. Like the human immune system, continuous exposure to cyber-pathogens results in our information infrastructure growing increasingly good at resisting and fending off attacks.
There's no reason to think that Islamic terrorists would be any more competent virus writers than those that currently plague us. In fact, given the backwardness of the arab countries where most islamic terrorists come from, I think there's good reason to think they would be less competent as computer programmers than people from other parts of the world. The only significant difference between cyber terrorists and today's virus writers is motivation. Most virus writers are interested in the technological challenge, and want to show off their prowess. They don't really want to do any damage. Others are more sinister, and try to install keystroke loggers or bots in order to steal your credit card numbers or extort money from people threatened with having their servers brought down by an attack from an army of compromised computers. Cyber-terrorists, on the other hand, would want to cause some spectacular failure that would grab all the headlines. Unfortunately for them, the systems that the terrorists would like to bring down are administered by professionals, people who are a lot more sophisticated than a grandma who forgets to update her anti-virus definitions.
Finally, two more features of our information infrastructure make it resistant to catastrophic failure. First, it is resilient. Our information infrastructure is largely owned by private industry, and is supported by an army of trained to quickly get systems back up and running should they ever be brought down. Second, and more importantly, the systems that comprise the infrastructure are diverse. No program can run natively on a Cisco router, an Apache webserver, and a Microsoft SQL server. It's therefore extremely unlikely that a single program could bring the nation's cyber infrastructure to its knees.
The only thing that piece of shit legislation does is give the kids more tests to suffer through. It adds no actual "accountability" to schools. Instead of teachers preparing their students for what they might actually need in life, they focus on only what's going to be on the test. What happens when some struggling inner-city school gets shut down because their kids don't pass their proficiency tests? They disperse into other schools and bring their scores down, resulting in less funding for those schools. Brilliant.
If Bush has added $13 billion in education funding, I'd like to know where it went. Districts all over are struggling just to keep the lights on. They are being forced to go to the voters for property tax increases. It's not a pleasant situation for anyone. The kids suffer because all their extracurriculars get cut and the property owners suffer because their taxes go up.
The state of education in Ohio (where both of my parents are in the field) is abysmal. Over 10 years ago, the state's Supreme Court ruled our school funding system was unconstitutional. Yet here we are 10+ years later, and the Legislature hasn't done a damned thing about it. My dad is convinced they're trying to kill public education, and from what I see, it's working. People are getting laid off, everything outside of the State Board of Ed.'s required curriculum is being cut, and the kids suffer. They've even cut bussing. It's really a very unfortunate situation.
In conclusion, fuck our incompetent politicans. I'm sick of agendas (as they almost always end up screwing the common man).
I think it's an insult to victims of 9/11 and other real terrorism around the globe to call any attack on a *computer network* "terrorism".
I know it's trendy to attach the word "terrorism" to everything you don't like (Microsoft: "industrial terrorism", some politician just today: "medical terrorism"), but can we at least reserve it for cases when somebody might *die*?
Yes, our economy will suffer a major blow from an attack on our computer networks, but if you give me a choice between having to become a farmer to feed myself and *DYING* in a suicide attack, I think I'll take the former.
But one thing is true: our computers are horribly insecure and are at risk not ONLY from terrorists, but from pimply-faced teenagers that live down the street. And it doesn't matter what license your software uses or what OS it runs. The fact is that there aren't many programmers out there who bother writing secure software, and even fewer customers who demand it.
I located two other government sources here and here.
Another poster also found it here.
I'd like to point out that while there is no direct mention of Trusted Computing, it calls for a "fundamentally different architecture", some sections mostly later in the paper apprear to describe Trusted Computing functionality, the experts they cite all appear to be Trusted Computing speciallists and proponents (in particular David Spafford was the author of the semi famous WHY_TCPA and TCPA_REBUTTAL papers), at least some of the committee members appear to have Trusted Computing ties, and an earlier Cyber Security Advisor gave a speech at the Washington D.C. Tech summit calling for Trusted Computing and for ISPs to eventually make it a mandatory part of terms of service for internet access. A call to fight worms and viruses and to Secure the National Information Infrastucture against terrorist attacks, to defend against Osama bin Laden himself. Yes, he actually cited bin Laden by name. chuckle.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Having worked on some .gov systems over my time the bigget problem is often that the resources are spread very thinly across the country. They really need each department to invest in people that will just focus on keeping things upto date.
Primary focus can be desktop and internet facing systems. This can be made alot easier. Windows update for example is much more reliable than it has been in the past (not perfect but better). And most unix systems are compatable with systems like pkgsrc which would make it much easier to at least try and resist incoming attackers.
Having centralised management and control over all systems would be a great start. Thats something that many countries have however from my experience many american departments have different staff in different offices/regeons making the mismatch in staff quality and skillset diverse enough to affect security.
The security of a network is a combination of factors:
Technological
Physical
Social
We can fight the battles in the technological front till we're blue in the face, but the temp at the front desk is a hole you'll probably never close.
In my head obvious questions this document failed to address are as follows:
How many people have access to your data center?
How many people have access to your most remote networked buildings?
Scrolling through this document there is no mention of the greatest security challenges facing IT today. Worms have been around since before the public internet, and as IT warriors we fight those battles constantly.
Ignoring the other aspects of "cyber" security is folly and tantamount to IT security suicide.