Slashdot Mirror
Pentagon Cyber Defense Bill Comes To $100M For 6 Months
coondoggie writes "Protecting defense departments networks cost taxpayers more than $100 million over the past six months, US Strategic Command officials said yesterday.
The motives of those attacking the networks go from just plain vandalism to theft of money or information to espionage. Protecting the networks is a huge challenge for the command, Air Force Gen. Kevin P. Chilton told a cyber security conference in Omaha, Neb., this week.
'Pay me now or pay me later,' Davis said. 'In the last six months, we spent more than $100 million reacting to things on our networks after the fact. It would be nice to spend that money proactively to put things in place so we'd be more active and proactive in posture rather than cleaning up after the fact.'"
How much pentagon 'cyber' defense is protecting windows?
ban ding!
Are all the lessons learned in the public domain since the Pentagon is a government agency? I'm sure there are many others like myself curious to see how supposedly top-secret issues are kept safe from prying eyes. Failure intrigues me more than success because it's through failure that we learn.
In principle, the notion of securing defence networks is pretty much unobjectionable. And, if you are going to do so, doing it right the first time, rather than playing cleanup, is obviously superior.
I only hope that the project isn't going to become an endless money pit, at which various incompetent-but-well-connected contractors feed endlessly. A DoD remake of the FBI/SAIC farce would just be nauseous.
You mean just as human as you, meat bag. WE cylons don't have the weakness of being swaying by lobbyists and ...OOOH! A PIECE OF CANDY!
This is my sig. There are many like it but this one is mine.
The sad thing is, it didn't have to come to this. General Chilton's sharp, but his real area of expertise is space, and his command is behind the curve on cyberspace. Two recent events demonstrate this nicely.
First, and most recently, he commented on the vulnerability of the electrical grids -- that hackers, including possibly agents of foreign governments, have been able to break into power systems that are connected to the Internet. Computer security experts outside the government -- including people on SlashDot -- brought this issue up in 2001 or 2002, if not earlier. And Washington is just now aware of the problem? Now, to be fair, they might have been aware of it for years, in which case they might have recently declassified it with the intention of getting more money from Congress to "fix" the problem.
Second, and somewhat older news, is the brouhaha that is Agent.btz -- a worm that was spread onto the Secure Internet Protocol Router Network, most likely by someone who used a USB storage device to transfer data from an infected computer connected to the NIPRNet. But for the attack to succeed, the SIPRNet computers either couldn't have had antivirus software installed or had antivirus definitions that were at least six months out of date.
Now, all this is speculation on my part -- I don't have access to any information, classified or otherwise, that could corroborate this ... but given that we know how the virus spreads, it's a pretty easy conclusion to draw. But the course of events is pretty damning, given how heavily the U.S. military relies on its computer networks.
Do we need to step up security across our networks? Hells yes. But I'd rather see an Internet "militia," if you will, comprising experts from every part of the computer industry (including open source) who could collaborate with the military and with other government and non-government agencies to secure their networks from attack. It wouldn't be perfect, but it would work a lot better in my mind than trusting the security of our networks to either (A) a six-year-old checklist in the hands of an E-2 or (B) an overpaid contractor who's taking kickbacks from Microsoft, Cisco, et al, to promote one particular and proprietary solution.
!#@%*)anks for hanging up the phone, dear.
Call me cynical, but at Pentagon Pricing(TM), that sounds like a bargain.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
While working for the USAF, I was required to do some online training. To run the training, ActiveX had to be enabled and IE basicially set to "slut mode", that is, accept and run everything. That really didn't give me a good feeling about their security.
Problem Solved.
Pentagon or generally military efficiency is a myth, or rather propaganda. It's really no different than any other government organization in that it is highly bureaucratic, politicized (as in office politics, petty infighting over promotions etc, not democrat v. republican type of politics) and staffed mostly with second rate people who couldn't get a better paid job in the private sector. Apologies to exceptions who do it for patriotic reasons or whatever but that was my experience in working with military bureaucracy.
Negative moral value of force outweighs the positive value of good intentions.
And that's why you're seeing stories like this one, plus the other one claiming Chinese penetration of software controlling power plants. Fear, fear, fear. Only the spooks can save us. Turn over the internet to people who will stamp "classified" on what they do.
That's roughly $6.34 each second.
If you tried to put together a single 9 man team consisting of the , it wouldn't be enough to pay them to finish the season.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
You should have been able to fix this yourself.
Don't allow slut mode for everything.
Figure out what sites they use for the training, and add them to the trusted sites list.
I've seen this before in various places, and always disregarded the instructions for setting it up, and figure out what sites to add, instead.
They end up a lot more secure when I've finished setting them up, than if the instructions were followed.
"City hall" in German is "Rathaus" Kinda explains a few things......
I didn't have administrator access and wasn't employed to do IT, and thus couldn't have done a proper set up for everyone, anyway, so I took the easy way out - just setting slut mode to do training, then turning everything off when finished. As far as I am aware, everyone else in my office (and on that base, for all I knew) had slut mode set full time so they could do training when required,. As the training wasn't base-specific, it wouldn't surprise me to find out that the average Windows installation on non-sensitive systems USAF-wide is set with similar lax settings with the base firewalls being the main idea of security.
Hopefully, someone from the USAF will jump on and tell me that things have changed since then and/or that base must have been an exception.
Something tells me the nuke launch systems aren't on the same network as the rest of the DOD.
Seriously though -- save $100 million and run a separate network.
Do me a favor - go read up on military networks in Wikipedia. You can start with the 25-year old MILNET network.
You can also bet that there's networks that nobody in the public (or low-to-medium levels of military) knows.
---
The idea that if I had the right combination of addresses and credentials I could launch a nuke right now is ludicrus.
You're right, it's ludicrous. That's why the idea is never pursued, except possibly for honeypots/misinformation.
Man, I just wasted 15 minutes trying to enlighten you!