Slashdot Mirror
Computer Security Lacking at Homeland Security
peter303 writes "The New York Times (reg. required) reports that computer backup procedures are woefully inadequate at 19 centers of the Department of Homeland Security. Should this agency strive to be good example for the rest of the country and protect against extreme hackers? " From the article: "Adequate backups were lacking for networks that screen airline passengers, that inspect goods moving across borders and that communicate with department employees and outside officials.
Those same agencies, the auditors found, have in most cases failed to prepare sufficiently written disaster recovery plans that would guide operations if a main office or computer system was knocked out."
Oh what a delicious irony. Insecurity and the Dept of Security.
The days of the digital watch are numbered.
... for every little thing we want to read.... User ID: slashdotreader Password: slashdot
There's no place like localhost
It is wrong that they don't have backups. However a lot of this data is stuff that I want to be on a server that crashes hard, without backups. Preferably in such a way that even disaster recovery places can't get the data back.
If they can trace down who's hacking them, they deserve a stiff jail time. Any one who attempts to hack homeland security computers knows that they're going to get serious jail time. Basically the only people who want to hack homeland security computers would be terrorists.
God spoke to me.
Don't take this as flamebait but I have the feeling that nobody's really trying hard enough to protect us. We stand an hour longer in the security line just so that people can bring explosives through in their shoes? Now they make us take our shoes off. What if someone brings explosives through in their pants?
Same here...they pretend to try to catch terorists when in reality the next power failiure could knock the whole list out.
~Ilyanep
To get message, take amount of carrier pigeons at each stage mod 2. Then decode binary.
It's easy to pick holes in the lack of backup of a system, but it's pointless when the system has no utility to begin with.
DHS has computer problems, sure, but the agency as a whole is a misguided waste of resources. It's probably better that it's computer systems don't work, otherwise they'd figure out a way to stop Ted Kennedy from driving or using an elevator in addition to not flying.
"I'm sorry, Sir, you can't board. Our screening system is down."
"I've got a ticket. I've shown you my papers. You (and every RFID hacker within 50 feet of my entire path through this airport) have scrutinized my RFID passport. I've given my decilitre of blood for biometric screening. The plane is about to close door and push off. I'm returning home after 18 months dodging RPGs and Kalashnikov fire in Bagdhad, and I'm still in uniform. And you're telling me I can't board because you can't be sure I'm actually not bin Laden in extremely clever disguise?"
"No, Sir, I'm telling you that you can't board. Our screening system is down."
"This is unacceptable. Who is your supervisor?"
"That is classified. Please wait here. [whispers into radio: "Got another Gitmo client for ya."]
Welcome to the Panopticon. Used to be a prison, now it's your home.
This is very interesting news after Bush just got done saying how great the new patriot act is. It looks to me that our own security got lost while we were busy questioning the integrity of others. Between the roving wire-taps and the judge-less warrants, I think I deserve to know that the people taking away my information can keep it safe from others who would want to take it away.
Keep the faith, share the code
Since when does failing to back up your hard drive make your system easier to hack into? If you're talking about them having poor data integrity that's one thing, but this doesn't seem to point to poor computer security.
Wake up - the future is arriving faster than you think.
WTF are "Extreme hackers"?
People who crack Windows boxen while bungee jumping? Releasing IIS worms from a wi-fi enabled handheld in a canoe half-way down some whitewater rapids?
Or, y'know, just yet another pathetic attempt to make something fundamentally known and understood sound suddenly somehow exciting and dangerous?
Oh, and for reference? The "Extreme Hacker" your link's about was a 37 year-old script kiddie who Haxx0red Us government machines direct from his own home connection.
You couldn't get stupider (and less '1ee7) if you tried...
Everything in moderation, including moderation itself
If general public especially computer nerds say "eh whats new" then no one else is going to bother, coz the general public doesn't even realize they have to bother.
I know I am going in to a ramble mode but for gods sake their only job is security and they fuck it up royally and blame terrorists.
Come on.
Is anyone really surprised that the Bush administration has done nothing significant right in the War on Terror?
The agencies still can't communicate, they're security holes in themselves, our resources are diverted to a fanatical war in Iraq that has nothing to do with terror in America, and we find that the greatest threat to the safety of Americans today is the lies the President told or ordered to be told in order to get 1500 kids killed in a place he admits we had no pressing reason to attack.
This isn't a troll. It's a list of the facts. Anyone disagreeing can disagree, but will be fighting the truth. Consider that before posting political dogma.
This reminds me of a story. I once worked for a company that specialized in tape backup software, name withheld. (I worked on Long Island then, not the on the plains of CHEYENNE, so don't try to guess the name of the company.) A few months after I stopped working there, I received a phone call from my ex-manager that went something like this:
Mgr: So how's it going? Blah blah blah...
Me: It's fine. Blah blah blah...
Mgr: So..um..did you ever "borrow" a copy of the source code to the Disaster Recovery solution that you single-handedly wrote? You know, for "posterity" reasons?
Me: Of course I didn't. That wouldn't be ethical for sure and probably would be illegal. Why do you ask?
Mgr: Well, it seems that the hard drive that your machine used crashed and we don't have a backup.
Yep. That's because no one is looking at the systems and processes with the intent of actually improving them.
Instead, we have knee-jerk reactions from people who do NOT understand security who attempt to compensate for previous attacks with new rules/regs.
And the "pretend" is the problem. That's exactly what they're doing. And they're hoping that the public will accept that as them actually doing something about the problem.
It's all about the public perception of the issue.
The same as it is in all aspects of politics.
As long as there isn't a power outage, they're doing a "good" job, as far as the public is concerned.
If there is a power outage, then it comes down to whom they can blame.
It's a lot easier and far more cost effective for the politicians to be re-active rather than pro-active.
Which is why security is NOT something that ANYONE should allow a politician to be involved in.
From the summary (no, I'm not going to RTFA when the subject and summary are so far out of whack):
Adequate backups were lacking for networks that ... in most cases failed to prepare sufficiently written disaster recovery plans that would ..."
So, if I have valid backups of all the patient data here, I guess those HIPAA security requirements are met, eh? Or do I have to have valid backups and a DR plan to achieve 'computer security' nirvana?
Now, if the issue were that their backup tapes were going offsite, unsecured and unencrypted, then the subject might make sense. But, this is silliness. Almost as silly as the DHS itself (hint: The Department of Homeland Security isn't supposed to keep the people safe from terrorists, it's supposed to keep the government safe...think about that one), but...whatever. (sigh)
Governments are hopeless at dealing with security. They are slow, lack innovative thinking and care more for their own careers than for their constituents. What matters most is whether or not you can protect yourself, your assets and your family when (if) the time comes. Then you can rid your mind of all the political and media led one-upmanship that comes along with security and the war on terrorism and get more important things done in life.
Backups are part of an overall security strategy, comprising, to use a well-worn phrase, confidentiality, integrity and availability. In a broad sense, you can apply this to DHS' "mission" (such as it is) as well. And yes, a DR plan, especially for an organization which is supposedly so "critical" to the nation's safety, is part of the whole shebang.
What's this have to do with HIPAA?
Cole's Law: Thinly sliced cabbage
No matter what the government (any government) does, it will not be to protect you, it will be to protect the government. Why do they ban firearms, yet the government has firearms.... is the government somehow more responsible than the individual? No.
As a matter of fact the governments of the world have laws that make them exempt from being responsible for anything.
From a global perspective, law abiding and responsible humans are screwed. As Geryon would say "I think the end of the world must be getting near. Hell is getting full."
"It's too bad she won't live, but then again who does?" - Gaff
Security? The same argument may be applied to politicians running the economy and creating legislation and regulations, too.
Perhaps we ought to look into education so our peasants aren't so damn gullible to the wiles of politicians.
"Provided by the management for your protection."
However, if members of the military were given special treatment at the border, it would create a rather obvious security hole ... I don't think it's a good thing to hassle members of the military on the way home, but if we're truly interested in securing the borders, it's necessary.
I'm not talking about special treatment nor do I think hassling members of the military is necessary. I suppose it comes down to the fact that I don't think anybody should be treated like that.
The real problem I have is that "homeland security" has decided that the idea of probable cause is unfashionable in this "terrorist" riddled day and age. I will grant the proceedure searching my luggage and my person for prohibited items at a security checkpoint. If I am not carrying any prohibited items, not doing anything illegal at the time, and if I am not acting in a clearly suspicious fashion, then airport security should have no probable cause to detain me.
The military of all groups is security concious. Servicemembers traveling on orders these days have multiple ways to authenticate who they are and account for their actions (we are required to carry official copies of our orders when we travel). If the military trusts these documents enough for their own security purposes, then airport security should, too. Otherwise, the whole trust metric breaks down.
Basically, if I show up at the security checkpoint with my military ID and orders, once I have been physically checked, why should they have any further need to detain or check me? Members of the military might not warrant special treatment but like it or not we are held to a different standard. If "homeland security" ignores that standard, then they're saying that it is as much as worthless, which is yet another slap in the face.