Slashdot Mirror
Bush Cyber Initiative Aims To Monitor, Restrict Access To Federal Network
dstates writes "Details of George Bush's Cyber Initiative are beginning to trickle out. The Cyber Initiative was created in January to secure government against electronic attacks. Newsweek says that over the next seven years, Bush's Cyber Initiative will spend as much as $30 billion to create a new monitoring system for all federal networks, a combined project of the DHS, the NSA and the Office of the Director of National Intelligence. The U.S. government has launched a classified operation called Byzantine Foothold to detect, track, and disarm intrusions on the government's most critical networks. ComputerWorld reports that all data traffic flowing through agency networks will be checked, and that it will be inspected at a deeper level than the current system is capable of. BusinessWeek, meanwhile, reports that one requirement is to reduce the number of internet access points in the Federal Government from the thousands now in use to only 100 sites by June 2008. How this will impact public information resources such as the Library of Congress, National Library of Medicine or even the US Congress remains to be seen."
Why is it that everything the government does costs so much more than what it would normally cost?
Are they really itemizing hammers for $300, toilet seats for $1000? Are government contractors just taking us to the cleaners?
Why does the public not have any say in where this money goes?
Well, from a network-security point of view, having fewer links to the web at large is actually a good thing, and things like this SHOULD be secured.
Implying that simply because the departments arn't completely open to the internet in a thousand ways is a denial of freedom of information, is a huge leap.
Granted, nobody trusts bush, and they shouldn't, as this is likely what he plans to do, but this part in particular is a good idea.
Seriously, try saying that with a straight face: "the George Bush Cyber Initiative". Me, I'm picturing an old arcade cabinet-style version of Galga stuffed into a corner of that idiot's office (right next to the "Missile Command" cabinet that stands in as SDI).
Anyhow, just my first reaction, but it was good for a laugh on a Tuesday morning. Please go back to your normally scheduled conversation.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
TCP/IP was never intended to be secure. It was intended to be flexible, robust and fault-tolerant. Security was not incorporated in the design of TCP/IP networks, save as a kludge attached after the fact. Fine for most of us; but if security is critical, I recommend using a different technology at the network level, one which incorporates security at the fundamental level. Since these networks should already be defined as "dark" networks, the potential for inter-network connectivity issues should not be a major consideration.
Yes, DarpaNet is a remarkable invention - but it's the Model-T of the computing industry. Y'know how many guys got their arms broken by that bloody starter crank, before Henry F. incorporated a lead-acid battery and electric starting moter? Sure, the hand-crank works well enough, but it's time to come up with the next advancement, not to mandate more foam padding and other safety features for the arm-breaker.
You're right, we need a new name for this sort of thing....hmm....well, the government will be putting up a sort of metaphorical "wall"....and the people who intrude will get burned, so "fire" would be good...maybe "Wall-Fire"...or "Fire-Wall"? Naw, it'll never catch on. I'll keep thinking...
The U.S. government has launched a classified operation called Byzantine Foothold to detect, track, and disarm intrusions on the government's most critical networks.
Disarm an intrusion?! Because the intrusion is armed?
This was obviously worded to stir the 'Left' trolling the comments.
The article speaks of data lost to China last year due to hackers on the Government network. If our tax dollars should pay for anything, it should be national defense and to protect this data.
I'm glad to see that the Bush administration is finally on target with their network monitoring. They've been monitoring innocent citizens on the open Internet for years now. Pretty amazing that they'd do that before bothering to secure their own networks.
What's more amazing is that I'm still amazed by government stupidity and corruption.
Software sucks. Open Source sucks less.
Wait a second, here... This is funded? Why the hell has money been taken from my (shrinking) budget to subsidize this program for my Cabinet-level Department???
"The big issue with the George Bush Cyber Initiative is that it's called "the George Bush Cyber Initiative". "
...so no, I don't see why that name is an issue.
They spend tens of billions (it will probably go into the hundreds in a few years) of our money implementing the worst possible solution to a simple design problem,
I hope classified data already runs on its own networks isolated from the Internet. Some unclassified but sensitive data, such as taxpayer and social security data, should be given the same treatment.
When the technology allows for it, I expect most companies to do the same thing, limiting or eliminating access to their sensitive data from computers that have access to the Internet.
As for data that is supposed to be public, read-only copies - perhaps made nearly in real time - must be accessible to the public. If someone manages to break security and trash a read-only copy, the original data remains uncorrupted.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Since the LoC and Congress are Legislative branch, and the President's Cyber Policy is from the Executive branch, I'd say "very little".
Best Slashdot Co
...I'm assuming your a government employee? Or just someone who leeches a federal internet line?
Ginga no Rekshiya Mata Each page.
The White House can't even manage to back up their emails. How are they going to manage a "Cyber Initiative"?
(whatever that is...I don't think I want to find out)
Just make it mandatory that a government agency has to use NetBEUI as their network protocol, using MS Proxy Server as their gateway to the tubes. Hacking potential goes WAY down.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
stuffed into a corner of that idiot's office
Dude, what corner? His office is oval. Who looks like the bigger idiot now?
Yeah, but back in the day you never had to worry about your battery dying.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Well, if it follows the same pattern of security as other parts of the government, each packet will be required to show two forms of government-issued ID, restrict its data to whatever it can fit into 3 ounce bottles in a clear quart-sized bag, and remove its shoes. Additionally, packets will also be subject to a "No-Route" list, and may also be randomly pulled aside for deep inspection. It will be suggested for packets to arrive at least 1 hour earlier (2 for international routing) for the extra queue length caused by the increased security.
Shameless plug for my photos on Flickr
They can't eevn back up their emails...
;-p
Sorry, just the first thing that came to mind.
Knowing governments, they will specify an implementation like:
This internal email is incriminating, set archive bit to not archive.
Take Nobody's Word For It.
And maybe if frogs has wings...
Ask not what you can do for your country. Ask what your country did to you
...there, fixed that for you =)
Walk with Music;
So, you're right that TCP/IP has some attributes which make it less than ideal for a number of applications. However, it has (literally) network effects--the protocol is more valuable because of the number of people using it--which is why it has eclipsed all the alternative technologies: DECNET, OSI/ISO, ATM, X.25, Frame Relay, etc.... (I know I'm mixing OSI layers there) Heck, IPv6 is having a hard time even though everybody has pretty much agreed to move to it.
Sure, if you wanted to, you could create a networking protocol with security built in at the lowest layers -- encryption in the data frames, maybe. (Or, more likely, adopt one that was created 15 years ago.) And then, you could create your own network cards that spoke the protocol, your own routers and switches and gateways. Along the way, you'd have to figure out how to solve all the problems that have been addressed in TCP/IP over the past 30 years. And then you'd have to retrofit it all to your existing infrastructure, train people on it and keep it up to date.
Along the way, you'd lose the ability to buy a $60 router or a $15 switch. In the end, it would cost far more than $30B. But, even worse, you'd lose the ability to adopt any future TCP/IP applications.
What's that going to cost, in terms of software design and implementation, training to effectively use and maintain those security kludges, and - oh, yeah, the odd intrusion/data loss which are inevitible?
Ask not what you can do for your country. Ask what your country did to you
Reduce access to 100 sites by June 2008? That must be a typo unless work is already started. I would imagine that it would require leases on buildings, secure power, purchase and installation of electronics, and training, hiring, and relocation of people to run it. All in two months? I don't think that could be accomplished even if the sites were run by private companies who get non-competitive contracts. Oh, is that the point?
Nate
Would You Like To Know More?
Well, the biggest security problem isn't really in the network protocol -- the intrusions that you see happening aren't really due to TCP/IP directly -- they're because of high-level holes in the software, stuff like not checking boundary conditions or sanitizing database inputs. Most intrusions are not really related to TCP/IP, except in an ancillary sense. Intrusions into supposedly secure networks are made from machines which are already authorized to communicate on those networks.
I don't see it as a losing battle. TCP/IP (well, UDP) also wasn't designed to carry voice traffic, but is now carrying a large majority of such traffic (even when a subscriber uses POTS.)
SSL is a reasonably good first step toward securing TCP/IP traffic. You can call it a "kludge" if you want, but it's very well-understood and fairly effective. SSH is another great example.
Galaga. Galga is Spanish for gauge. I don't know what it might mean in other languages. Sorry for the spelling nazism, but I finally saw a chance to somehow rationalize all the quarters I wasted as a youngster.
Please don't use "umm" or "err" or "erm".
If only Government was "open source"...
Every single email in the white house's email system is backed up and available for congressional auditors. The problem is Bush (and at least 88 other officials) broke the law and used the RNC and Bush/Cheney '04 accounts for official business.
Uhmm. So this is a classified project?
Then why do we know about it?
But it is only about shutting the windows of government workers and forcing everyone else through a handful of guarded doors with frisking. As if anybody currently expects some kind of free pass today with how the current admin is running this country. They shouldn't if they do.
;-)
Now, I wonder if every entry point will have a pop up asking of you are really sure you want to move forward to the next page?
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Get your Trojans in while there is still time!
Actually on a serious note; I used to work for the Governors Office which we had locked down fairly well behind two firewalls (edge and office), and an active IDS system. When the DCOM viruses started hitting hard we saw an enourmous influx of traffic coming from Department of Defence, Homeland Security, and FBI, networks. Taking a sip from the fire hose with etheral showed that over 98% of it was DCOM exploit attempts coming from well over 1000 unpatched windows boxes, leading me to believe that they had all been massivly infected.
Doesnt speak very highly of the agencies that we are supposed to be relying on to protect us does it? It took them weeks to get things under control. All told, we had ONE infected machine in our network from a laptop that had been off site that was shut down within 5 minutes of being plugged in to the network, and wasnt able to infect even one other machine.
Point is, based on my experience working for the man, and things I have seen both there and within other agencies that I had the opportunity to work with. Anybody with some rudamentary knowledge, and access to metasploit or something, could likely compromise any one of these agencies with ease provided they knew where to plug in. With the exception of a select few agencies such as the NSA, the government in general is not as advanced as people seem to think they are. Once you get past their edge firewalls its pretty much free reign in a surprisingly open network.
The entire state government where I live is on one huge FDDI ring, with one of a hundred thousand places to plug a laptop in that have no checks or boundries on them at all. In fact, half or more of the state agencies dont even have firewalls within the FDDI ring, and use public addresses for their workstations, without even NAT'ing network traffic. Go figure.
Anyhow, Im glad they are finally actually taking a look at these problems.
Does anyone see the irony in calling a large scale government information project "Byzantine"?
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
The ball has been rolling to reduce the number of entry points to government networks for a long time. For example, the DoD's Defense Information Systems Agency has been awarding contracts to agencies to try to reduce the amount of entry points to their systems to allow for better centralized management and security. The Air Force even threw extra money at it for their own systems:
http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/12-17-2003/0002077687&EDATE=
On the contrary, if we give them less money, they will have less power
Oh, yeah, sure. After all, the government can't spend money it doesn't have.
The US free market: two halves of a government-granted duopoly are free to set the market price.
and get all their sensitive material on the SIPRNet (or something like it) where it should belong. Nothing should reachable from the public network.
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
To screw things up takes an idiot. To really frack things up takes a Bush.
What are the odds the Federal Internet goes down first?
Seriously, do they really think this failocracy can secure and buttress its own networks better than the open Internet everyone else uses?
I'll give them this, though: At least they're having the common courtesy to try and keep attacks on the federal government from affecting my Internet. Damn kind of them.
This is a rehash of a rehash of a rehash of what Business Week posted a week and a half ago. Way to stay on the cutting edge.
Marty Roesch was just talking during the RSA conference about IDS making a comeback - and more and more the signs point to observing and examining, not just reactionary blocking, of traffic. I'm going to start buying stock in Enterasys, ISS, Sourcefire and similar companies now because I think a good part of this 30 billion may be headed that way.
I think with the interesting people, their lives can't possibly be wrapped up into a nice little package.