Slashdot Mirror
800 Break-ins at Dept. of Homeland Security
WrongSizeGlass writes "Yahoo is reporting about the computer security nightmare going on at the Department of Homeland Security. Senior DHS officials admitted to Congress that over a two year period there were 800 hacker break-ins, virus outbreaks and in one instance, hacker tools for stealing passwords and other files were found on two internal Homeland Security computer systems. I guess it's true what they say ... a mechanic's car is always the last to get fixed."
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I guess it's true what they say ... a mechanic's car is always the last to get fixed.
That's very true.
Especially when the mechanic is incompetent, and more interested in throwing around political weight than actually trying to accomplish anything useful.
Microsoft is to software what Budweiser is to beer.
The people that are smart enough to really do this IT stuff properly for the DHS are smart enough to earn more money elsewhere.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
...that failed to deliver when it came to 9/11 warnings by layering on a new bureaucracy on top of the failed bureaucracy.
Clearly what we need is a new Dept. of Homeland Security Security.
Point 1: Considering the complete inability of standard technical solutions to security problems to prevent a significant number of attacks/infections from being successful, this is not like the mechanics car getting fixed last. It's called "the security industry and standard methodologies continue their long history of consistent failure at organizations, both public and private"
Point 2: Those numbers are a completely meaningless abstraction without tying them back to type of attack, actual damage, importance of the data on those systems or their roles in launching further attacks, what kind of infections occurred and their damage potential, and finally what those numbers look like compared to other orgs of the same size.
Point 3: Homeland Security is comprised of multiple mostly-independant sub orgs (like Coast Guard, TSA, etc)....so..saying DHS had so many attacks is misleading without clarification
Point 4: Not saying theyre not making mistakes, just that those "facts" dont tell you either way what the actual state of things is.
DHS was started by a number of folks from the marines (I worked for one). They were ALL windows believers ( but the ones that I knew were very so-so in the tech work). They were adamant about not being like NSA in spite of the fact that NSA has 2 missions; 1) obtain any info that they can on others 2) secure our boxes. NSA has a LARGE number of mathematicians as well as computer geeks. And windows is only allowed in none secured arenas or have their network capability severed at a hardware level (i.e. no nic or usb). If DHS had been ran by professionals and not politicians from the military (ALL of the tops one were W.s, Cheney's and esp. Rumsfeld's friend), then they would not have had the break-ins.
I prefer the "u" in honour as it seems to be missing these days.
That's nothing. A password cracker is included in the OS load of every server here. Our security auditing program uses it! Better yet, it would normally be detected by our antivirus program, but a guy here is paid to remove it's pattern from the vscan updates before they're sent out. When an unedited vscan pattern file manages to make it's way on to the machine somehow, it nukes the audit program. How's that for "administratively broken"?
Part of their mandate and jurisdiction is Information Security; they are charged with protecting the computing infrastructure of the country.
--
$tar -xvf
Kinda like "War on Terror"?
It goes from God, to Jerry, to me.
This post failed to pass my spam checker.
they are charged with protecting the computing infrastructure of the country.
What's Chinese for "pwned"?
Blank until
...that you could fly a 747 through!
Oops, that was in bad taste.
technical writing / development
DHS was created in response to the 9/11 attacks as a purely political move to make it look like we were serious about fighting terrorism. It created a huge bureaucracy, gave it an impossibly broad mandate, and made it more difficult for existing agencies (that were moved under DHS because they were at least tangentially related to protecting the country against various things) to do their jobs. As a result, the government is far less capable of intelligently defending against attack than it was before. It is only capable of wildly overreacting to perceived threats (like someone slipping through airport security with 4 ounces of hand soap rather than the mandated maximum of 3), again so it can appear as if it is on top of things.
DHS was a bad idea that was implemented poorly out of a panicked need to do *something* following the attacks.
Gotta agree with that. If they were competent, they'd have their own house in order.
Just as anyone here who's competent with a computer has their systems up-to-date and tuned.
I think the reason that people see any irony at all in these type of stories is the fact that they actually expect that the government is as good as its hyperreal image. Of course government agencies aren't infallible, but to suggest this is to deny this hyperreal, overemphasized "we're efficient, intelligent and we know things about you you don't even know" public persona. Without a sufficient belief in the agencies like the CIA and the FBI, and the belief that they are actually more informed than the masses and that the government is more in the know than anyone is aware (unless they are in the government), people would want to know where all this security spending is going (which is a problem for anyone). The government is an inept, massive body of people that is unable to act upon information quickly due to its many layers of bureaucratic bullshit and the legality of everything. The only solution to this problem is to eliminate some of the bureaucracy (firing people, which, of course, can't be done), or to eliminate the red tape (legislation, which, if you eliminate too much becomes a Bush-like grab for power), neither of which will ever be done due to the nature of the politicians in charge. So the federal government, no matter what the politicians say will continue to grow as a monolithic, insecure and ineffective beast while feeding you the image of a secure, fast, intelligent and best of class organization and terrorists with their small but efficient plans will continue to find gaping holes in the system. And that's why irony in this case can be saved for the naive and the uninformed, the rest of us see things like this coming a mile away.
Judges and senates have been bought for gold; Esteem and love were never to be sold.
Ok so here is the deal. DHS' network is a mesh of multiple other networks that were already in existence. This is problematic in itself as it involves a heavy amount of integration and also borders upon borders of perimeter security (each disparate agency is part of the whole but may have its own controlled interfaces for some level of separation...
Now lets go to the article. To the laymen you say 800 compromises and they go into "WOW THAT IS SO BAD" mode, but seriously come on. The compromises are mostly workstations. Now that doesn't mean they get a free pass, but its not like they have had their core servers owned by foreign states... What they should be doing is not only scanning apps, DBs, and servers and patching/hardening them appropriately, but also client-side firewalling, config control of workstations, baseline security mechanisms for remote users, centralized virus/vulnerability patching... This article does not surprise me what-so-ever and it really is not an indication that DHS security is horrible. Its not the best, but 800 is not that bad.
News Reporters Make Tasty Polar Bear Treats!
Outsourced.
TSA (Not covered by CIA, FBI or other Law Enforcement)
4 .shtm
FEMA
Customs and Border Protection
Immigration (Former INS)
Secret Service (Not covered by CIA, FBI or any other Law Enforcement)
Coast Guards (Not covered by CIA, FBI or other Law Enforcement)
I'm no fan of them, but how about you take a look at their website if you want to know what they are supposed to do:
http://www.dhs.gov/xabout/structure/editorial_064
I am assuming you mean S&T, not DHS overall. Science & Technology is the primary research and development arm of the Department - we're different from other science-related organizations like NIH, NSF, etc., in that our work must have clear line-of-sight to security applications. Not to say we don't have some focus in the basic sciences, but rather to say that it's only about a 20% focus. We also have a portion of our research budget that goes to high-risk things that will probably fail. Thankfully our leadership hear in S&T understands that in science, you need to have at least some fraction of your research portfolio 'on the edge' - that's where you find the home-runs, and not always in the 'safe' stuff. This is hard to defend though, since Congress doesn't hearing that you're spending research dollars on 'risky' projects expected to fail. In addition to research, the 'T' in S&T means that we develop technologies for the first responders and other users (i.e., interoperable radios and communication, Chemical and Biological detectors, other miscellaneous cool widgets, etc.) You may also (correctly) guess that any significant effort to prevent terrorist use of WMD requires top-notch scientific and technical expertise as well, so we do a lot of WMD-related work. Hope that helps.