Slashdot Mirror

← Back to Stories (view on slashdot.org)

Pentagon Cyber Defense Bill Comes To $100M For 6 Months

Posted by samzenpus on from the freedom-isn't-free dept.

coondoggie writes "Protecting defense departments networks cost taxpayers more than $100 million over the past six months, US Strategic Command officials said yesterday. The motives of those attacking the networks go from just plain vandalism to theft of money or information to espionage. Protecting the networks is a huge challenge for the command, Air Force Gen. Kevin P. Chilton told a cyber security conference in Omaha, Neb., this week. 'Pay me now or pay me later,' Davis said. 'In the last six months, we spent more than $100 million reacting to things on our networks after the fact. It would be nice to spend that money proactively to put things in place so we'd be more active and proactive in posture rather than cleaning up after the fact.'"

12 of 92 comments (clear)

  1. frist post! by Anonymous Coward · · Score: 5, Interesting

    How much pentagon 'cyber' defense is protecting windows?

    ban ding!

    1. Re:frist post! by EbeneezerSquid · · Score: 2, Interesting

      Yes, it is a lot.

      - however, primarily these are client machines, and the forms of attack that military systems endure are, if not OS-independent (ddos, etc), then perpetrated by individuals who will adapt for whichever OS is being run (espionage, etc).

      Moving from Windows to another OS would provide relatively little additional security for client machines while incurring a HUGE cost in user re-training.

      Servers, on the other hand, are, ummmm. . . Let's just say the server world is a LITTLE different from the client world.

  2. Public domain? by concernedadmin · · Score: 5, Interesting

    Are all the lessons learned in the public domain since the Pentagon is a government agency? I'm sure there are many others like myself curious to see how supposedly top-secret issues are kept safe from prying eyes. Failure intrigues me more than success because it's through failure that we learn.

    1. Re:Public domain? by Anonymous Coward · · Score: 5, Interesting

      Our military does not exist for the benefit of our citizens, and has not for a long time.

      It never did - at least not in American history.

      Originally it was:
      Militia = Civil defense
      Military = Federal Defense

      Now:
      Militia = Domestic Terrorists
      Military = Military Industrial Complex defense

      Or maybe I am just having a bad day.

    2. Re:Public domain? by Anonymous Coward · · Score: 5, Interesting

      Are all the lessons learned in the public domain since the Pentagon is a government agency? I'm sure there are many others like myself curious to see how supposedly top-secret issues are kept safe from prying eyes. Failure intrigues me more than success because it's through failure that we learn.

      The TS/SCI networks are 100% physically separated from the Internet, and they are monitored. As a cleared government employee, I was working on a TS/SCI machine and had a typo in a URL for their intranet... I retried it several times until I realized the mistake. About a minute later, my internal phone rang and the IT department wanted to know what I was trying to do. And this was in 2000.

    3. Re:Public domain? by RockWolf · · Score: 4, Interesting

      you're just watching to figure out how they got there, their techniques, and what they're after.

      I'd just like to congratulate you on the gramatically correct use of there, their and they're in the same sentence - it's a rare thing to see in these parts.

      /~Rockwolf

      --
      February 9th, 2009 8:55pm: Slashdot becomes self-aware.
    4. Re:Public domain? by bleh-of-the-huns · · Score: 2, Interesting

      Unfortunately, while it is supposed to be physically isolated, there have been times (and I have witnessed this) where stupid admins, or rather admins under extreme pressure from higher ups to get something done, have ended up connecting machines on SIPR and JWICS to NIPR, and then forgetting to disconnect after whatever they did was done, so you end up bridging the networks, oh, there are are for some reason still plenty of analogue modem lines on some of those secured networks (although some are secured with crypto cards)

      --
      I came, I conquered, I coredumped
  3. I hope the execution is good. by fuzzyfuzzyfungus · · Score: 4, Interesting

    In principle, the notion of securing defence networks is pretty much unobjectionable. And, if you are going to do so, doing it right the first time, rather than playing cleanup, is obviously superior.

    I only hope that the project isn't going to become an endless money pit, at which various incompetent-but-well-connected contractors feed endlessly. A DoD remake of the FBI/SAIC farce would just be nauseous.

    1. Re:I hope the execution is good. by PhxBlue · · Score: 4, Interesting

      In principle, the notion of securing defence networks is pretty much unobjectionable. And, if you are going to do so, doing it right the first time, rather than playing cleanup, is obviously superior.

      Except that we're talking about the Pentagon. The execution will be sloppy, and it will only get worse for two or three years until it becomes such a mess that the secretary of defense personally has to step in, smack some bitches and get it cleaned up. Then it will be okay, at least for a year or two.

      Think I'm kidding? Look at the whole debacle with Darleen Druyun a few years back, or the more recent mess surrounding the Air Force's contract for a new tanker. In fact, I can't think of a single DOD acquisition program that has come in on budget recently, at least not among the high-ticket items symptomatic of what Secretary Gates called "next war-itis." My impression -- as a servicemember 1,400 miles outside the Beltway -- is that the Pentagon doesn't give a shit about cost overruns because it knows Congress will gladly pony up more taxpayer money at the drop of a hat to keep the military-industrial complex running smoothly.

      You see, there's a precedent for the bank bailouts we just bent over to pay for: the American public has been "bailing out" Lockheed Martin and Boeing for decades.

      --
      !#@%*)anks for hanging up the phone, dear.
  4. Re:TCO? by wasted · · Score: 5, Interesting

    So how does this bill factor into the TCO of Windows?
    I don't claim that the $100M would go to zero if Windows were eliminated in favor of more secure servers and desktops, but it would be a lot lower.

    While working for the USAF, I was required to do some online training. To run the training, ActiveX had to be enabled and IE basicially set to "slut mode", that is, accept and run everything. That really didn't give me a good feeling about their security.

  5. NSA wants to control cybersecurity by JoeBuck · · Score: 3, Interesting

    And that's why you're seeing stories like this one, plus the other one claiming Chinese penetration of software controlling power plants. Fear, fear, fear. Only the spooks can save us. Turn over the internet to people who will stamp "classified" on what they do.

  6. Re:It didn't have to come to this. by Chmcginn · · Score: 4, Interesting

    But for the attack to succeed, the SIPRNet computers either couldn't have had antivirus software installed or had antivirus definitions that were at least six months out of date.

    Software (even patches) for a non-secure DOD computer requires a review before it can be installed or updated. I would imagine that the requirements for SIPRNET are more strict, certainly not less. It's likely that the review was not as high a priority as it should have been.

    --
    Have you been touched by his noodly appendage?