Slashdot Mirror
Pentagon Cyber Defense Bill Comes To $100M For 6 Months
coondoggie writes "Protecting defense departments networks cost taxpayers more than $100 million over the past six months, US Strategic Command officials said yesterday.
The motives of those attacking the networks go from just plain vandalism to theft of money or information to espionage. Protecting the networks is a huge challenge for the command, Air Force Gen. Kevin P. Chilton told a cyber security conference in Omaha, Neb., this week.
'Pay me now or pay me later,' Davis said. 'In the last six months, we spent more than $100 million reacting to things on our networks after the fact. It would be nice to spend that money proactively to put things in place so we'd be more active and proactive in posture rather than cleaning up after the fact.'"
How much pentagon 'cyber' defense is protecting windows?
ban ding!
So how does this bill factor into the TCO of Windows?
I don't claim that the $100M would go to zero if Windows were eliminated in favor of more secure servers and desktops, but it would be a lot lower.
Are all the lessons learned in the public domain since the Pentagon is a government agency? I'm sure there are many others like myself curious to see how supposedly top-secret issues are kept safe from prying eyes. Failure intrigues me more than success because it's through failure that we learn.
In principle, the notion of securing defence networks is pretty much unobjectionable. And, if you are going to do so, doing it right the first time, rather than playing cleanup, is obviously superior.
I only hope that the project isn't going to become an endless money pit, at which various incompetent-but-well-connected contractors feed endlessly. A DoD remake of the FBI/SAIC farce would just be nauseous.
That even the Pentagon is spending a lot of time playing catch-up rather than staying on top of things. Not that it's really a good thing per-se, but its nice to know they're just as human as the rest of us.
The musings of just another geek and his junk.
The sad thing is, it didn't have to come to this. General Chilton's sharp, but his real area of expertise is space, and his command is behind the curve on cyberspace. Two recent events demonstrate this nicely.
First, and most recently, he commented on the vulnerability of the electrical grids -- that hackers, including possibly agents of foreign governments, have been able to break into power systems that are connected to the Internet. Computer security experts outside the government -- including people on SlashDot -- brought this issue up in 2001 or 2002, if not earlier. And Washington is just now aware of the problem? Now, to be fair, they might have been aware of it for years, in which case they might have recently declassified it with the intention of getting more money from Congress to "fix" the problem.
Second, and somewhat older news, is the brouhaha that is Agent.btz -- a worm that was spread onto the Secure Internet Protocol Router Network, most likely by someone who used a USB storage device to transfer data from an infected computer connected to the NIPRNet. But for the attack to succeed, the SIPRNet computers either couldn't have had antivirus software installed or had antivirus definitions that were at least six months out of date.
Now, all this is speculation on my part -- I don't have access to any information, classified or otherwise, that could corroborate this ... but given that we know how the virus spreads, it's a pretty easy conclusion to draw. But the course of events is pretty damning, given how heavily the U.S. military relies on its computer networks.
Do we need to step up security across our networks? Hells yes. But I'd rather see an Internet "militia," if you will, comprising experts from every part of the computer industry (including open source) who could collaborate with the military and with other government and non-government agencies to secure their networks from attack. It wouldn't be perfect, but it would work a lot better in my mind than trusting the security of our networks to either (A) a six-year-old checklist in the hands of an E-2 or (B) an overpaid contractor who's taking kickbacks from Microsoft, Cisco, et al, to promote one particular and proprietary solution.
!#@%*)anks for hanging up the phone, dear.
Call me cynical, but at Pentagon Pricing(TM), that sounds like a bargain.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Problem Solved.
I read the summary, and I read the article. Both contain only the name 'Davis' for the quotes. Maybe I'm missing something, but who is this person? I kind of doubt Davis is short for Air Force Gen. Kevin P. Chilton, the only other name mentioned in the article.
our government should just pull the plug on this whole internet thing and stop using it. seems too costly.
“Common sense is not so common.” — Voltaire
And that's why you're seeing stories like this one, plus the other one claiming Chinese penetration of software controlling power plants. Fear, fear, fear. Only the spooks can save us. Turn over the internet to people who will stamp "classified" on what they do.
That's roughly $6.34 each second.
If you tried to put together a single 9 man team consisting of the , it wouldn't be enough to pay them to finish the season.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
Woo-hoo! Now *China* will be outsourcing!
100M over 6mo sounds pretty low imo. This same conference, the speakers mentioned it costs ~6M per security incident to clean up the mess. The panel also mentioned there are thousands of attempts a day on govmt cyberspace infrastructure.
How about we just disconnected the government from the internet?
Seriously though -- save $100 million and run a separate network. The idea that if I had the right combination of addresses and credentials I could launch a nuke right now is ludicrus. Is it really necessary to have systems that could compromise our national security connected to the internet? In this day and age? Really?
Seems likely the reporter misplaced a B with an M.
Oh and here's a somewhat related xkcd comic. http://xkcd.com/558/
Insanity: voting in the same two parties over and over again and expecting different results
Why they need Internet access is beyond me. They should have their own network - whoops wasn't the Internet designed by the DnD?
http://www.stratcom.mil/ has been /.
In short...he is the antithesis to modern Republican behavior, an excellent leader, and a true soldier. He was also human and made mistakes...but FAR better than the "leaders" we have had over the last few decades.
There are many Republicans and self-identified conservatives who were completely against what Bush et al. were doing, and spoke up publicly about it. Jerry Pournelle is one that comes to mind.
"I don't claim that the $100M would go to zero if Windows were eliminated in favor of more secure servers and desktops, but it would be a lot lower. - by Anonymous Coward on Wednesday April 08, @08:39PM (#27512281)
Would it be? I state that, because even SeLinux can use SOME work for "security-hardening" & the tool that can show that much to anyone, is the multiplatform CIS Tool...
(Which a benchmark of security basically, based on industry "best practices" for Linux variants, BSD variants, Windows variants, & other *NIX variants also)
Once CIS Tool's points are applied to Windows (to the tune of a 99/100 score being possible)?
It helps a great deal & makes 'security-hardening' Windows, either professional/workstation class OR server versions of Windows, easier & the end-result is a Windows setup that IS, much more secure.
Case-in-Point/Example (of a user who had applied it in early 2008, & he is running malware infestation FREE, to the current date):
(From an End-User's perspective)
----
"Its 2009 - still trouble free!
I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point.
So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008.
Great stuff!
My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads.
APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)"
THRONKA @ -> http://www.xtremepccentral.com/forums/showthread.php?s=6f9097928745786bab6ab447b252b33e&t=28430&page=3
----
Thus, as you can see? Securing Windows IS fairly easily possible, & especially via the CIS Tool + its guidance... it works! The guide he used IS part of that thread in which he made his statement, in that very posting there, & his results are very good thusfar.
APK
P.S.=> Also - The guide goes "above & beyond" CIS Tool, in many ways, also, in order to help secure Windows NT-based OS' of modern variety (such as 2000/XP/Server 2003, & to an extent, the principles in that guide apply to VISTA &/or Windows 7 as well (I just wish they'd put back PORT FILTERING gui controls into them, AND, allow 0 as a valid blocking IP address in the HOSTS file in VISTA &/or Windows 7 also - the removal of port filtering adversely affects the concept of "layered security" in them, & only allowing 0.0.0.0 or 127.0.0.1 as blocking IP addresses in HOSTS files only promote inefficient bloat))... apk
http://diajobs.dia.mil/
Says it all!
i thought they already did that for us.