Slashdot Mirror
800 Break-ins at Dept. of Homeland Security
WrongSizeGlass writes "Yahoo is reporting about the computer security nightmare going on at the Department of Homeland Security. Senior DHS officials admitted to Congress that over a two year period there were 800 hacker break-ins, virus outbreaks and in one instance, hacker tools for stealing passwords and other files were found on two internal Homeland Security computer systems. I guess it's true what they say ... a mechanic's car is always the last to get fixed."
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I guess it's true what they say ... a mechanic's car is always the last to get fixed.
That's very true.
Especially when the mechanic is incompetent, and more interested in throwing around political weight than actually trying to accomplish anything useful.
Microsoft is to software what Budweiser is to beer.
The people that are smart enough to really do this IT stuff properly for the DHS are smart enough to earn more money elsewhere.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Point 1: Considering the complete inability of standard technical solutions to security problems to prevent a significant number of attacks/infections from being successful, this is not like the mechanics car getting fixed last. It's called "the security industry and standard methodologies continue their long history of consistent failure at organizations, both public and private"
Point 2: Those numbers are a completely meaningless abstraction without tying them back to type of attack, actual damage, importance of the data on those systems or their roles in launching further attacks, what kind of infections occurred and their damage potential, and finally what those numbers look like compared to other orgs of the same size.
Point 3: Homeland Security is comprised of multiple mostly-independant sub orgs (like Coast Guard, TSA, etc)....so..saying DHS had so many attacks is misleading without clarification
Point 4: Not saying theyre not making mistakes, just that those "facts" dont tell you either way what the actual state of things is.
keep the USA safe from soccer Moms with sippy cups full of water, homeland security and TSA are competent. Anything more complex, and they are all butterfingers. Even the name "Homeland Security" freaks me out, not because they have extraordinary powers that threaten me, but because the name reminds me of something out of 1984 type double speak, sort of a Stalin-esk soviet type of pun. I suspect Homeland Security is much more likely to be applied against citizens of the homeland than it is likely to be applied against any enemy of America.
Look at any government agency or corporate IT infrastructure - 800 break-ins is not a big number. I have been conducting information security analyses for many years for corporate networks and government entities and 800 is not a high figure. What you have to find out before considering this a valid story is; was integrity, confidentiality or availability of their infrastructure effected by these break-ins or was it just dorks poking their nose through the DMZ to see what they could find.
I agree with you that DHS is a "juicier" target than some businesses, I'm willing to bet that the attacks (and the frequency of them) against Bank of America, Citibank, Equifax, etc, are just as bad if not worse.
This is no exaggeration. As with virtually any other government employment, the DHS is filled with people who just want titles and a paycheck. Most morons know how to install windows and office and a few of those can even install a server and exchange email. Whether they know anything useful or not, they don't really care about doing more than the bare minimum to keep their paychecks flowing. I blame the way government pays and oversees people for this. There is not much in the way of pay or advancement by merit in government employ. Everyone's too afraid of descrimination suits and the like. So the only measured basis one can use safely is time in service really. Other than that, the culture is to keep your head down and do the bare minimum.
And if you think the creation of DHS was a carefully planned and well-thought-out move, I think the historical evidence speaks to the contrary.
The only solution is for detailed requirements for security and data handling. It would be more effective than not having any... they really don't have much in place now. How secure can they be with Microsoft everything running their offices?
Never mind predicted, this is desirable for the DHS, it's further 'proof' there are bazillions of terrorists out there hell bent on destroying the US.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
800 includes virus infections as well. Lets see there are about 150,000 employees of DHS, so assumining there is at least 1 computer per employee, there must somewhere in the range of150,000 computers? Lets be conservative and say 100,000 computers. 800 incidents, that is less then 1%. Now take any other enterprise with that many computers, you IT guys tell me, is under 1% rate for computers without virus infections or intrusions a failure? Hell it isn't perfect, but it should be expected.
The bottom line is I dont care what kind of agency, business, enterprise, securing that many computers is impossible no matter what. You always have the human factor involved. Once you get 150,000 people thinking security (impossible to do) then you can be close to perfect..
Most companies' security strategies primarily rely on two things: patching and virus scanning.
Maybe break-ins are rare for you, and you think you are doing security really well. In reality, your success is based primarily on the fact that nobody good is targeting you. The people who discover flaws, write the exploits, and create the effective viruses do NOT target your pissant little company. They target governments and financial institutions.
Once the flaws and viruses are discovered by the primary targets, you get the luxury of updating your software and signature files before anyone gets around to target you.
DHS may have security a million times better than yours, but they are a primary target, so they get hit a billion times harder.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Gotta agree with that. If they were competent, they'd have their own house in order.
Just as anyone here who's competent with a computer has their systems up-to-date and tuned.
You get accountability by rewarding incompetence with unemployment.
Other than Rumsfeld and a couple of low-level stooges from Abu Griab, no one seems to have been fired.
We reward incompetence with bigger budgets which breeds more incompetence.
Ok so here is the deal. DHS' network is a mesh of multiple other networks that were already in existence. This is problematic in itself as it involves a heavy amount of integration and also borders upon borders of perimeter security (each disparate agency is part of the whole but may have its own controlled interfaces for some level of separation...
Now lets go to the article. To the laymen you say 800 compromises and they go into "WOW THAT IS SO BAD" mode, but seriously come on. The compromises are mostly workstations. Now that doesn't mean they get a free pass, but its not like they have had their core servers owned by foreign states... What they should be doing is not only scanning apps, DBs, and servers and patching/hardening them appropriately, but also client-side firewalling, config control of workstations, baseline security mechanisms for remote users, centralized virus/vulnerability patching... This article does not surprise me what-so-ever and it really is not an indication that DHS security is horrible. Its not the best, but 800 is not that bad.
News Reporters Make Tasty Polar Bear Treats!