Slashdot Mirror
Security Flaws Could Cripple Defense Network
userexec wrote to mention an FCW.com article about the uninspiring future for the Missile Defense System's software. The developers are apparently very worried about poor information security on the project. From the article: "The report said that neither MDA nor Boeing officials saw the need to install a system to conduct automated log audits on unencrypted communications and monitoring systems. Even though current DOD policies require such automated network monitoring, such a requirement 'was not in the contract.' The network, which was also developed to conform to more than 20-year-old DOD security policies rather than more recent guidelines, lacks a comprehensive user account management process, the report said. Neither MDA nor Boeing conducted required Information Assurance (IA) training for users before they were granted access to the network, the report stated. "
This does not suprise me at all, after all, we as Americans are quickly proving that we're becoming the bastion of incompetence. From NASA,
to the war in IRAQ,
irregularities in elections,
collapsing health care system,
cronyism in government,
out-sourcing out of hand,
the massive trade deficit,
the fact that communist China, Japan and the UK now help us with our balance of payments,
failing education system,
Katrina,....one wonders whether we as a nation can ever do anything right.
Question is: Is there eanything really?
How many more $500 USD toliet seats does the taxpayers have to buy before Boeing upgrades their network?
No matter what you do to design a system there will always be some hack who comes along to crap on your project. Just because you think you know better doesn't make it true. It certainly doesn't help that sites like this one jump on every little aberrant report like a pack of jackals.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Security Flaws Could Cripple Defense Network
Drunk Driving Could Be Dangerous
Microsoft Goes Head-to-Head With IBM
Mixing Household Chemicals Could Be Dangerous
notice a pattern? none of these headliness says or means anything. they border between "no $hit" and "duh".
instead of that say-nothing giberish how about "group passwords threaten MDA's communications network"? see, now the head line says something.
ps, not to be a jerk, just to point out an area where slashdot can be better than the rest.
--iggy_mon - www.ananonymouskiller.com - Die Trying -
How about Global Thermonuclear war?
"We are all geniuses when we dream"
- E.M. Cioran
The only reason the program exists at all is to hand out taxpayer money to campaign contributors.
And the thousands of American scientists, engineers, technicians and support staff that design and work on these systems. Based on comments like this, you'd think that the government is stuffing shells full of cash and launching them at the enemy. Where do you think these "weapon systems" are designed and built?
Maybe my perspective is skewed. The only job offers (early career engineer) I was able to secure (in a timely manner) were from "big aerospace." If they were not "wasting taxpayer money" on large, risky (read: cutting-edge) R&D technologies, I'd be out of a really interesting, fulfilling job. And unfortunately, until some "other" interesting R&D area (energy would be a good one) is as big a target in the crosshairs of national/international interest, or until I have enough experience to start my own company, I am pretty happy working in the defense industry.
if its not in the contract, it is fraud for a government contractor to implement an extra feature or add-on to the system because the govt has to pay for the extra expenses (software developers' hours, testing, etc) incurred to make those improvements.
so if the security is bad, and it wasnt in the contract, the only people who can begin to address this are actually the purchasing organization, not the developers. the purchaser **needs** to add these stipulations in the contract or else the contractor legally is not allowed to work on fixing it.
Contract companies love to say "that's not in the contract, but we'd be happy to renegotiate and do it for $x."
And for good reason. Same reason that when you order a Dodge Neon they don't ship you a Dodge Viper. The contract is what is specifying what the government is buying. Change what the government is buying to enhance it and it's not really surprising that they want more money to produce it. Taking the least expensive option is usually the right option for the company even if it isn't in the system. It also doesn't surprise me in the least. The government really should have some boilerplate in their contracts saying system much follow established DoD security procedures as specified in DoD Standard Security Policies v10.43 or something along those lines.
And whats your company going to do? Really only Boeing, Lockheed Martin and Northrop Grumman are big enough to handle the prime contract.