Slashdot Mirror
Uncle Sam Earns C-minus Grade for PC Security
An anonymous reader writes "Twenty-four federal departments and agencies earned a collective grade of C-minus last year for their performance in meeting computer and network security requirements, according to marks handed out by a key congressional oversight committee today. The government-wide grade is up slightly from the 2005, when it earned an overall grade of D+. Eight agencies earned A grades, while as many warranted failing marks. '..the Department of Defense led a group of eight agencies that received failing marks for computer security. Also receiving that dubious distinction were the departments of Agriculture, Commerce, Education, Interior, State and Treasury, as well as the Nuclear Regulatory Commission. The Department of Homeland Security earned a D, although its overall performance improved since 2005. The Department of Veterans Affairs did not provide enough data to earn a grade. In 2005, it received an F.'"
I heard on the radio that some gov spokesperson for DOD said
...LOL
But it's a strong improving "F"
I don't recall that ever working with mom "But Mom...it's an improved F over the last F I got"
The infrastructure to the DoD's system extends far beyond it's headquarters.
"To be is to do." -Socrates
"To do is to be." -Jean-Paul Sartre
"Do-be-do-be-do." -Frank Sinatra
They didn't have any data, since all of it was stolen last year! DOH!
stuff |
Letter grades and color coded terror levels.
I like how they think they have to kindergarten-up government to teach it to the people.
I've worked on a few different government 'nets. It's always just a little bit more complicated than that.
I don't need no instructions to know how to rock!!!!
I guess not every US department has a Chloe O'Brian.
"Our firewall will be down in 2 minutes, thereby exposing our agents all around the globe!"
Twenty-four federal departments and agencies earned a collective grade of C-minus last year for their performance in meeting computer and network security requirements
It sounds like their security is more "social" than they'd like!
The theory of relativity doesn't work right in Arkansas.
Sad, very sad.
"The Department of Homeland Security earned a D" Irony?
Adebisi
This is why there is a 90-day project currently in progress to select a Full Disk Encryption suites for all government owned computers. A Request for Quotation (RFQ) has already gone out on the April 12, 2007. See http://www.herbb.hanscom.af.mil/download.asp?rfp=R 1450&FileName=NOTICE_OF_AVAILABILITY_OF_A_SOLICITA TION_2.doc
Consensus is good, but informed dictatorship is better
1) Central Intelligence Agency
2) National Security Agency
3) Office of Naval Intelligence
4) National Reconnaissance Office
5) Defense Intelligence Agency
6) National Geospatial-Intelligence Agency
7) Army Intelligence
8) Air Intelligence Agency
Their security system is so good, it regularly deletes all email, just so that no one else gets it.
___
If you think big enough, you'll never have to do it.
if it was good enough for our president...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Read up on what Gary McKinnon http://en.wikipedia.org/wiki/Gary_McKinnon found.
Just like in the control room for Springfield's reactor in Last Exit To Springfield (9F15).
The US has all the Get Smart like security, but then has the dilapidated MS door wide open for any and all.
Domestic spying is now "Benign Information Gathering"
An open source government wouldn't need security, now would it?
Especially not if universally applied.
Yesterday, we have a story where Turbo Tax's online system exposed a few tax forms for returns with similar names.
Last Friday, it was reported that the IRS lost 490 computers with potentially millions of taxpayer records. (The IRS is not sure what was lost.)
Tell me why the latter isn't a bigger story?
Answer: With TJ Max, Georgia CHIP, the CIA, and Los Alamos were all desensitized to the daily reports.
figured I'd post a link to the report.6 _fisma_report.pdf
I have to believe any report that gives only 5000 systems (wtf is a system? a box, a subnet?) as being owned by the DoD to be of dubious credibility
http://www.whitehouse.gov/omb/inforeg/reports/200
It may not need security from discovery, but it would still need data security. You don't want your code of laws being hacked, now do you?
We shouldn't be surprised by this. Considering the size of the federal gov't it's safe to assume that they're a representative cross section of the population. If it's true that 25% of the computer in this country are part of a botnet, (http://it.slashdot.org/article.pl?sid=07/01/26/22 29203 ) then the gov't. is on par with the rest of the country.
I've had grades like that, you know where you just didn't show up or didn't do the homework, I kinda wonder what happened here.
Under the influence of Post-Cyberpunk Gonzo Journalism
A "C" - that's great!
We're all the way up to average!
We (kind of) rock!
I suspect this also includes government networks run by contractors.
A while back I use to be friends with someone who worked for one of these companies that do contract work for the government, for one of those agencies that require Secret or Top Secret clearance along with requiring routine polygraph tests.
I was told stories on occasion how IT jobs would come open and be filled not with individuals that had the technical qualifications but those that had the security clearance.
Heck, my friend who had a clearance and did clerical work was promoted to run the Help Desk and was giving a book to learn on the job. Then again a few years later to administer servers spread around the globe, with no formal training.
I was told the contracting companies would not hire individuals for the clearance jobs unless they already had the clearance. The clearance trumped any sort of job qualification.
If this has changed since 9/11 I don't know.
You mean _Another_ governmental department is not as secure as the rest of the world?!
Note sarcasm...
My 17 year old sister has better security on her ME box...
As someone dealing with a security audit right now, all I can say is: don't believe a word of it. The auditors tick off items on a checklist. Telnet running? Lose points. Telnet running on your Cisco routers in a configuration where a man-in-the-middle attack is impossible? Its Telnet. Lose points. Telnet running in an impregnable fashion because that's what the vendor offers for remote access and you locked it down damn tight to compensate? Its Telnet. Lose points.
Damn auditors.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Is it insecurity when the Republicy government deletes over 5 million emails it's legally required to archive, to hide evidence of Republicy crimes? How about when the Republicy government lets its boss, Karl Rove, circumvent all White House security to do 95% of his emailing through Republicy laptops and servers, to hide evidence of Republicy crimes?
The answer starts with "F".
--
make install -not war
So there I was, at my local national guard Armory, while a non-commissioned officer used his login and password to sign in. While at drill, it has been remarked that the computers are completely 'locked down', so much so that they are remotely maintained and local users can do nothing on them.
SO...guess what. One of their clueless Sgts wanted to transfer files from one box to another. He goes into network neighborhood...where EVERY WINDOWS BOX IN THE ENTIRE STATE IS ON THE SAME LAN!!!! I was like "uh...if a malicious hacker wanted to crack this, how many seconds would it take them to break into the entire national guard?"
Granted, this is the Army national guard, and except for pay systems, I can't imagine what secret info is actually on those computers. All the equipment I have ever seen is old and clunky. Sure, some of the manuals for the radios are technically 'secret'...but these radios are archaic boxes from the 1980s that weigh a ton, and I suspect any secrets in them our enemies have long since learned.
Hmmm, the order was given in June of 2006, so now they're finally doing something about it in April of 2007? Such competence is awe-inspiring.
Dude, sorry to be the one to tell you, but everyone else knows your sisters box is penetrated nightly.
So the agencies were all graded on their self-reporting of their own security... I think I'm seeing the problem here. My guess is the DoD and other high-profile agencies got poorer marks because they grade themselves harder. I have seen many times where a group gets a bunch of security requirements and responds back, "yeah, we meet those."
And even legitimate reporting of FISMA requirements is damn near pointless. Q: "Do you have a firewall?" A: "yes! It's default allow with no rules but the requirement sais firewall." Q "Do you have an IDS?" A: "Yes! It has the default rule set, no one monitoring it, and we don't even know if you can access the logs but it's there." I have seen that answer, literally, on a system that people would simple assume had someone personally approving every packet.
In the end, it's damn near impossible to tell who's secure and who isn't without having a single team do unannounced pen tests on everything and reporting how they compare. And there are so many problems with that approach I don't know where to start. But you will always have teams that lock a system down so tight water doesn't get in yet fail requirements. You have people who meet the letter of requirements yet add no measurable security. And you will have the people who simply lie because they can't be bothered to hire someone competant to do the reporting.
I do security
If they get hacked it's our money anyway...
My Own Millions Blog
I don't understand the attraction to full disk encryption. Sure, it will prevent a would be thief from reading some of your personal emails or getting access to your credit card information. But all the good secrets are on servers and corporate networks, not on people's laptops. And if the secrets are really good, you're not going to be able to just get to them just by stealing someone's laptop.
For example, where I work, to get onto the corporate intranet you need to actually be physically connected to the corporate network, or you need to access it via a VPN. To get on the VPN, you need the group password and your individual password. The group password is static, but your own password is a combination of a PIN plus the sequence of digits on the RSA SecurID card you're issued, which change every sixty seconds. This is a really standard setup, and means that to get anywhere you would need to steal my laptop (to get the group password), know my PIN, _and_ steal my SecurID card. Actually, you would _also_ need my corporate username and passphrase, but if you're good enough to get all of the above I assume you can get those too.
If you want to secure email (or whatever), that's easy too. To get to the mail servers you need to be on the VPN, which is already a pretty good start. At that point all you need to do is make sure that all the really sensitive email accounts are local delivery only (i.e. no POP/Exchange/IMAP access). To read email you get a web based email solution or a shell account on the mail server. Either way you log in by connecting to the VPN and doing your normal Kerberos authentication. Obviously web mail presents a bit of a problem in the way of the browser cache, but it's fairly simple to lock down a shell account in such a way that users can't connect out from the account (or scp files).
Anyway, adding full disk encryption to this is a joke. It's a scam to let the companies that provide the disk encryption hardware/software make a lot of easy money. If you were doing things right in the first place it would be a _lot_ easier for someone to get the encryption password than it would be for them to get to your sensitive data. Instead of paying hundreds of thousands of dollars on a proprietary disk encryption solution, get some competent system administrators.
#include ".signature"
Got an F in Sex........says her drivers license. Ba dum dum :)
The organisations who want to have minute detail information about pretty much every inch of our life and promises us that it would never ever be used for malicious plans is unable to keep this information secure? In that case, it's pretty much a given that said information can and will be abused. It's even easy to abuse it themselves, if they need to, they'll simply claim it's been stolen and "outsource" the actual deed.
But at least I can sleep well again. An agency that well organized is no threat to my security. Well, as long as I don't give them information, that is.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This has already been done for a bunch of laptops. It was a complete pain for most programs. Not all government laptops contain patient or investigation-related data. Most are just used for simple word processing and to check email while traveling.
They've told us that we'll get to encrypt external hard drives . . . including all USB thumb drives.
Should be fun.
I almost said the "real world", but decided that was unfair to the government.
Anyway, at work, on my performance review I get a "does not meet", "meets", "exceeds" or "far exceeds" expectations. That's even more simplistic than a letter grade.
I work at a defense contractor. The scores given for performance of a project are similar; very, very simple.
I'm sure that like both of those examples, the departments were given detailed descriptions of what was wrong and was right, probably with each area having a grade that was aggregated to the overall grade.
...what did the Department Of Justice get, and did their third-party email servers at georgewbush.com and gwb43.com (POP3, Exchange?) factor into the score? Because if they were used for official government business, they should be.
I'm sure that they would rather write laws and point fingers at who's fault it is, rather than address it. I'm sure if the media said it would save lives, it would be George Bush's fault and Democrats would address it.
"Please, shut up. Just when I think you can't say anything more stupid, you speak again." -Archie Bunker.
Many organizations do not have, nor want, VPN access to their corporate network. First, its offers another conduit for exploitation. A poorly managed VPN, much like wireless, is just another way malicious people can get at your data. I do agree that a properly implemented, and administered, VPN can be a very useful tool. However, that requires time and money. The biggest road block is the maintenance aspect. Remember, management often view IT services as a facilities expense, much like simple electricity service. They always want the least costly solution. Also, many old school managers do not see the benefit in VPN, often because they are more comfortable simply making copies of data onto their laptops and taking it home or on the road. I have read articles profiling occasions where business laptops storing customer information, including names, addresses, credit card info, etc are stolen. So if VPN is not an option, what is the alternative? Disk encryption or loss of productivity.
I have to wonder if the department of education surveys included state colleges.
From my experience, these places have pretty wretched security in the departments despite pretty good security on the residence hall networks (at least at my college).
I recall back in the day that EDU sites were always first choice hacks because the entry was seldom noticed quickly and the bandwidth was near unlimited.
Even still, unsecured and poorly controlled forum and wiki software is fairly common.
Behold this porn-spam-filled forum on WSU's Spokane campus:
N entirely SFW
Posting AC from work for a state college.
It is trivial to break in to a laptop when one has unrestricted physical access.
It is usually non-trivial to break into a server that is in a data-center behind firewalls given zero-knowledge.
Fortunately for the bad-guys, laptops have been proven over and over to contain network information, passwords, and raw protected data:
Chicago Public Schools
FBI
Boeing
Starbucks
Towers Perrin
US Commerce Department
US Department of Transportation and Sovereign Bank, et al.
US Navy
US Department of Veteran Affairs
Federal Trade Commission
Equifax
Ernst & Young (many times)
Unless "Get competent administrators" is software that prevents users from putting data on their laptops, this suggestion is meaningless.
"Get competent administrators" is a finger-waving nebulous non-solution from those that have no idea what competent administration looks like.
Competent adminstrators recognize that security problems are not simple and they are only solved by tangible, disciplined, and rigorous solutions, rather than dismissive statements of "be smarter."
I'm not exactly a anti-government nutcase, but I do recognize where a legislature + bureaucracy routinely fsck up. Hell, even smart people screw up security assessments.
f ights.html
I agree with Richard Bejtlich's assessment: FISMA is a jobs program for unskilled "security consultants" who can not themselves 'operationally defend' system or network assets. That is to say, it's a boon for paper pushing drones wasting the time of the geeks at the sharp end who can actually make a difference if let alone.
Bejtlich writes it up here: http://taosecurity.blogspot.com/2007/04/fisma-dog
The right assessment metrics assess 0wn4ge, not comprehensiveness of policy documentation.
Interesting.
This makes "24" even more credible. There are always some security breaches, moles, stolen keycards and laptops...
I really wonder why there still hasn't been a major terrorist attack on the USA except for 9/11.
Maybe they'll wait for the national internet reboot (yes, national, that's what slashdot said ^^) to exploit more security breaches.