Uncle Sam Earns C-minus Grade for PC Security

An anonymous reader writes "Twenty-four federal departments and agencies earned a collective grade of C-minus last year for their performance in meeting computer and network security requirements, according to marks handed out by a key congressional oversight committee today. The government-wide grade is up slightly from the 2005, when it earned an overall grade of D+. Eight agencies earned A grades, while as many warranted failing marks. '..the Department of Defense led a group of eight agencies that received failing marks for computer security. Also receiving that dubious distinction were the departments of Agriculture, Commerce, Education, Interior, State and Treasury, as well as the Nuclear Regulatory Commission. The Department of Homeland Security earned a D, although its overall performance improved since 2005. The Department of Veterans Affairs did not provide enough data to earn a grade. In 2005, it received an F.'"

Comments

If it were only so simple

[stratjakt]

Letter grades and color coded terror levels.

I like how they think they have to kindergarten-up government to teach it to the people.

I've worked on a few different government 'nets. It's always just a little bit more complicated than that.

Re:If it were only so simple

[feepness]

Naw, I work with the government too and most of the problems really are quite simple (or at least no more complicated than most). It's all the paperwork and bureaucracy that makes it complicated. Oh sure, we COULD just go to the store and buy the thing, but instead we'll fill out form 361-B in triplicate, ensuring one is in English, one is in French and the other is in some language only three people in the world can speak (meaning you'll have to get approval and fill out more paperwork to fly them in to finish that section the form) and then wait 4-6 months for the document and its approval to weave it's way through the maze of middle management. Oh well, at least it keeps me and many other workers employed.

Because if you don't go through that process... well... then you've got some "no-bid contract" designed to fill the coffers of evil corporations.

Re:I am not surprised

[Anonymous Coward]

I suspect there is reason to their madness. Getting clearance for an individual costs quite a bit of money - in the order of a few thousand dollars I'm told, depending on clearance level - and requires a lot of time - some people I know had to wait a few months for their secret clearance. Not that this really should be an excuse for hiring knowledgeable people, but I can see it being a factor. Do you really want to spend a few thousand dollars and wait three months just to find out someone isn't right for the job? Maybe in the ideal world companies would recognize that the fact that a good worker would "earn" them back a much larger return than they had to spend initially, but in reality, I find a lot just look at the short term. We need to spend money AND time?! Next!

Re:I am not surprised

[cyphercell]

funny, the security clearances are making the system insecure, me thinks something is broken.

What a scam...

[eklitzke]

I don't understand the attraction to full disk encryption. Sure, it will prevent a would be thief from reading some of your personal emails or getting access to your credit card information. But all the good secrets are on servers and corporate networks, not on people's laptops. And if the secrets are really good, you're not going to be able to just get to them just by stealing someone's laptop.

For example, where I work, to get onto the corporate intranet you need to actually be physically connected to the corporate network, or you need to access it via a VPN. To get on the VPN, you need the group password and your individual password. The group password is static, but your own password is a combination of a PIN plus the sequence of digits on the RSA SecurID card you're issued, which change every sixty seconds. This is a really standard setup, and means that to get anywhere you would need to steal my laptop (to get the group password), know my PIN, _and_ steal my SecurID card. Actually, you would _also_ need my corporate username and passphrase, but if you're good enough to get all of the above I assume you can get those too.

If you want to secure email (or whatever), that's easy too. To get to the mail servers you need to be on the VPN, which is already a pretty good start. At that point all you need to do is make sure that all the really sensitive email accounts are local delivery only (i.e. no POP/Exchange/IMAP access). To read email you get a web based email solution or a shell account on the mail server. Either way you log in by connecting to the VPN and doing your normal Kerberos authentication. Obviously web mail presents a bit of a problem in the way of the browser cache, but it's fairly simple to lock down a shell account in such a way that users can't connect out from the account (or scp files).

Anyway, adding full disk encryption to this is a joke. It's a scam to let the companies that provide the disk encryption hardware/software make a lot of easy money. If you were doing things right in the first place it would be a _lot_ easier for someone to get the encryption password than it would be for them to get to your sensitive data. Instead of paying hundreds of thousands of dollars on a proprietary disk encryption solution, get some competent system administrators.