DHS CyberSecurity Misses 1085 Holes On Own Network

Idiots by Zeek40 · 2010-09-09 01:27 · Score: 2, Informative

This is why the government always ends up hiring contractors to do the jobs they already pay their own staff to do.

Re:Idiots by Anonymous Coward · 2010-09-09 01:42 · Score: 0

And having had to work with those contractors ...
It doesn't help.
Re:Idiots by Neil+Watson · 2010-09-09 01:51 · Score: 1

More likely this is what happens an organization does not have processes for execution and validation. Regardless of whether they are contractors of FT's if no one audits their work this can happen.

--
UNIX/Linux Consulting
Re:Idiots by mcgrew · 2010-09-09 02:10 · Score: 5, Insightful

No, its that DHS has nothing to do with true security. Their job is security theater, as evidenced at any airport. The Armed Forces and National Guard are there for the real security.
DHS is a waste of good tax money. It should be spent on infrastructure.

--
Free Martian Whores!
Re:Idiots by spamking · 2010-09-09 02:58 · Score: 1

They can transfer the risk all they want, but they are still ultimately responsible.
Re:Idiots by Bigjeff5 · 2010-09-09 04:06 · Score: 2, Insightful

It's almost like "The Ministry of Truth" in Orwell's 1984 - it was the propaganda machine for the government, and therefor was responsible for spreading lies far and wide.
DHS is similar, though not exactly a polar opposite of what its Orwellian name would suggest. It spreads the feeling of security without securing anything. The guys who are actually doing anything to prevent terrorist attacks are folks like the CIA and FBI. DHS doesn't do shit.
For example, I know a guy who accidentally brought a box cutter in his carry-on at least half a dozen times when he was flying. It wasn't until he found it in the bottom of his bag that he realized it was there and removed it. That's the same damn weapon the 19 hijackers all used, yet here at least six of them would have gotten though.
And yet we have to take our shoes off, just in case someone put a bomb in our shoes. Give me a break.

--
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
Re:Idiots by Locutus · 2010-09-09 04:42 · Score: 1

The DHS was Bush's jobs program. I thought it should have been called the "New Central Central Intelligence Agency".

LoB

--
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Re:Idiots by hesaigo999ca · 2010-09-09 05:23 · Score: 1

They should fire everyone IT related in Virginia for this offense, and replace them with more competent individuals.
Re:Idiots by ChiRaven · 2010-09-09 05:34 · Score: 1

One correction. The DHS LOCAL affiliates, the county Emergency management agencies, usually do a pretty good job of mobilizing local resources (like the Red Cross, etc.) to respond to local situations like tornados and minor flooding. These are the LOCAL groups that are affiliated with FEMA, which is under DHS. They get overloaded when there is a major emergency and the federal people have to take over, but in a local situation these people do a tremendous job.
Re:Idiots by timeOday · 2010-09-09 06:34 · Score: 1

this is what happens an organization does not have processes for execution and validation
They do, or this story wouldn't exist. The DHS audited its own systems and this is what they found. If they were a company, they would just quietly fix the problem (or not) and move on. Since it's government, they self-report and we get the daily anti-government whine.
Re:Idiots by Ex-MislTech · 2010-09-09 06:41 · Score: 1

"Adobe Acrobat, Sun’s Java and some Microsoft applications."
I think you did not read the article, but that is common isn't it ???

--
google "32 trillion offshore needs IRS attention"
Re:Idiots by NatasRevol · 2010-09-09 06:59 · Score: 0, Troll

Dammit. I was here for the anti-MS whine.
Cause I knew MS would be at fault just by the title :-)

--
There are two types of people in the world: Those who crave closure
Re:Idiots by inanet · 2010-09-09 10:15 · Score: 2, Interesting

I wonder how well the audit was done? I have seen really poor security audits done by professional auditing companies in the past that just showed the lack of ability with the auditors, as an example we got the following from an audit on a few unix boxes: "Security risk - High: Telnet not disabled" "Security risk - High: SSH passwords don't expire" "Security risk - High: FTP not disabled" our response? - no risk, telnet not installed. port not open. - no risk, ftp not installed. port not open. - ssh uses a key mechanism. passwords are invalid in all cases. basically they had a script they ran that would check to see if things like ftp and telnet had been disabled, and if the correct password expiry was set, they had no idea that you could configure a system that didn't actually _have_ ftp or telnet installed, or that you could set up ssh in such a way that a password was never any good. I just mention this, even though its great to hate on security - govt. depts. you never know how good the actually auditing is, there is a saying that those that can, do, those that can't audit* * this may not actually be the saying. I'm just saying.

--
"This is my Sig. there are many like it but this one is mine."
Re:Idiots by BlindRobin · 2010-09-09 19:48 · Score: 1

Hiring contractors by the government does not increase efficiency, competence or quality, it just pushes more money into different places and muddies things up even more. In my experience, the contractors (with whom I have had contact) hired by the various USGOV agencies and their departments are marginally competent leeches whose ability to acquire contracts has more to do with relationships that have little to do with actually accomplishing their stated mission. While I haven't worked in Washington since 2005, I doubt that this has changed.

It's shit like this by tsalmark · 2010-09-09 01:27 · Score: 2, Insightful

It's shit like this that needs to make it to main stream media. To show how messed up the fear mongering side of the Government really is.

Re:It's shit like this by slick7 · 2010-09-09 02:21 · Score: 1

It's shit like this that needs to make it to main stream media. To show how messed up the fear mongering side of the Government really is.
Exposing the inadequacies of the government will just result in more "National Security" obfuscation. The more holes in security equates in more money to fill those holes. It's only a matter of time until Haliburton gets involved.
The powers that be have no intention of letting their senior bosses know the truth. They will throw more money at it until some major incident occurs and it airs on "60 Minutes", at which time the incompetence will be swept under the rug. When the issue becomes so tangled with corporate wrangling, senate hearings, an actual loss of security, DHS will just go dark, thereby allowing the matter to be taken up as an internal affair. In the meantime, security hole exploitation will become the raison de guerre.(excuse my french)

--
The mind conceives, the body achieves, the spirit manifests.

Do as I say... by Arrepiadd · 2010-09-09 01:29 · Score: 1

... not as I do.

bureaucracy maybe? by metalmaster · 2010-09-09 01:39 · Score: 2, Insightful

Its possible that even IT drones that work in bureaucracy have to deal with the red tape. A good number of these holes might have been fixed by installing the "latest" version of software. At most of the companies i have worked with software installs have to be vetted by corporate suits that would rather play golf.

Im not going to defend software that simply requires an update. Stuff that needs a fresh install or a new software package altogether can be a pain in the ass.

Re:bureaucracy maybe? by Anonymous Coward · 2010-09-09 01:55 · Score: 0

Pretty much this. The iron law of bureaucracy no doubt is in place.
Where I work, to get any change done, requires going through 2 committees for approval from people who have no knowledge of the technology in the first place. Then you send in a ticket for the work to get done outside your control (network changes, san assignments) which sits in a queue for months. Eventually, people just give up bothering to patch or upgrade systems. Too much hassle and they get paid whether or not it gets done.
Re:bureaucracy maybe? by Neil+Watson · 2010-09-09 01:59 · Score: 1

At some organizations it can take months to get schedule and get approval for patching. When someone claims the business needs a service to be available all of the time it's difficult to find a business level advocate for patching.

--
UNIX/Linux Consulting

no this is what you get with outsourced IT VA by Joe+The+Dragon · 2010-09-09 01:40 · Score: 1

no this is what you get with outsourced IT The state of VA went with Northrop Grumman that did not work that good.

DItch Windows by jdigriz · 2010-09-09 01:42 · Score: 1

Well, obviously they need to run some instances of Windows for research and testing purposes to protect the public, but you'd think the organization devoted to cybersecurity would run something with fewer targeted attacks designed especially for it.

Re:DItch Windows by AHuxley · 2010-09-09 01:57 · Score: 1

One big honeypot to see what is been used?
If some new tool works well with 'secure' MS, the US can use them too around the world.
The endless contractor cash supply is cute too.

--
Domestic spying is now "Benign Information Gathering"
Re:DItch Windows by Anonymous Coward · 2010-09-09 02:29 · Score: 0

in my experience using nessus at work, the linux machines actually turn up with more "vulnerabilities" than the windows boxes. the problem is that you need to tune your scans, it generates a lot of false positives.

Meh... by Anonymous Coward · 2010-09-09 01:42 · Score: 0

This is blown out of proportion. Vulnerability scanners will report lots of things as "MAC I vulnerabilities", and since they are automated, a lot of the time they report non-risks. Things like file permissions when the OS is fully patched, ports locked down, and so on.

You can scan a single fresh updated copy of red hat and get 50+ high-risk items, for instance.

On a whole network, this result isn't bad because it is basically impossible to meet the moving target of a perfect score on a vulnerability scanner in a constantly evolving large network.

Re:Meh... by Neil+Watson · 2010-09-09 02:03 · Score: 1

Very true. I've seen auditors report that users default Umask was incorrectly set. When you try to explain that any user can set any Umask they want so why bother they stare at you like you just told them the Sun was blue.

--
UNIX/Linux Consulting
Re:Meh... by Anonymous Coward · 2010-09-09 03:20 · Score: 0

I've gone through quite a few external security audits. They had absolutely stupid things. The fact that an ICMP ping wasn't returned (we were dropping inbound ICMP) counted as a point against us. I changed the firewall rules to allow pings, and then we had a point against us for returning the ICMP ping. There was no "right" way to do that.
That was just one of many items. It was an absolute pain in the ass. There were about a dozen low to moderate threat items that had to be fixed. Most didn't even apply to us, and a few were outside of our control, like the time it took to resolve our name. Their nameserver was slow, not ours.
I really don't mind security audits. If your company is large enough, you'll be getting them all the time by people who want to break into your network. The audits really need to be delivered by someone who knows network security, that you can discuss the failure points. As it was, we only had communication with a glorified CSR who could only say "fix it or else".
Re:Meh... by qwijibo · 2010-09-09 04:15 · Score: 1

I gave up on trying to educate auditors. They often have the logical reasoning capability of a brick, without the value of being a building material. Compliance auditing is about reducing a complex set of circumstances and requirements into simple numbers. Comprehension of the underlying issues is not a job requirement.
The reason why that's a checklist item is that 99+% of users are have access to, but not knowledge required to set a umask, therefore making your point moot.
My recent favorite audit vulnerability was mode 644 on wtmpx. If someone has an account on a system (which is already limited to legitimate need anyway), I'm not deeply concerned if they can find out who has recently logged into the server. In fact, I'd rather that simple troubleshooting be done by unprivileged users, some of which fall into the 99+%, rather than requiring they get root access to look at harmless information.
The best part is when one compliance program says that SSHD should have PermitRootLogin=No, but another group needs it to be Yes to allow all of the root passwords to be centrally managed to meet some other compliance requirement.
Re:Meh... by Rubinstien · 2010-09-09 19:26 · Score: 1

The most ludicrous (on multiple levels) I have had to deal with was an audit by one of our customers flagging our software for SQL injection, simply because the 'Defects Addressed' section of the release notes contained the text of an ODBC error administrators may have seen in the server log in prior releases, that had now been fixed. They would absolutely not allow the software into production until this 'critical vulnerability' in the static HTML release notes had been fixed. The scripts that spell-check our release notes now flag 'ODBC', and suggest that this acronym be replaced with the HTML numeric entities . This lets us pass the audit. I wonder how many real SQL injection vulnerabilities get passed over by this audit software because the output is encoded in some way?

i've seen nessus reports by mrzaph0d · 2010-09-09 01:49 · Score: 4, Interesting

unless the people running the scans are experts in setting up and configuring nessus for scanning, i wouldn't assume every one of those is a true vulnerability.

--
this is just a placeholder till i send back my real sig from the future.

Re:i've seen nessus reports by SocialEngineer · 2010-09-09 01:52 · Score: 2, Interesting

Exactly. Just running Nessus does not a proper security audit make.

--
"Better to be vulgar than non-existent" -Bev Henson
Re:i've seen nessus reports by nicolas.kassis · 2010-09-09 02:07 · Score: 1

Yup. nessus isn't magical, unless you instruct it to use the vulnerability and attack the host (no suggested) then you can never be certain the vulnerability exists.
Re:i've seen nessus reports by Larryish · 2010-09-09 03:04 · Score: 1

Very wise you are.
Re:i've seen nessus reports by Bigjeff5 · 2010-09-09 04:07 · Score: 1

Well considering it was a failed audit, and not just a failed scan, I'm sure they know what they are doing.

--
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
Re:i've seen nessus reports by qwijibo · 2010-09-09 04:22 · Score: 2, Insightful

Running Nessus produces numbers. Those numbers are then the metrics which management uses to judge how well people are doing their jobs. Lower numbers are always good and higher numbers are always bad.
Comprehension of what the numbers represent, or if they're accurate, is not really relevant from a management perspective. If you show that your numbers are small and keep getting smaller, then any security vulnerability can't be your fault, because the magic number machine says your compliant. It's the same thinking that says anyone who got a free virus scanner installed on their computer when they bought it 7 years ago is intrinsically safe.
Tools like Nessus can be useful from a technical perspective, but far more often are used for political reasons.
Re:i've seen nessus reports by carp3_noct3m · 2010-09-09 05:39 · Score: 1

It should be noted that there are various certifications which any company hiring vulnerability assessment should look for, many of them cover in depth how to properly use Nessus, Saint, etc.

--
"It's ok, I'm completely secure as long as my iron is off"

Re:no this is what you get with outsourced IT VA by erroneus · 2010-09-09 01:51 · Score: 5, Informative

This is exactly correct. They would rather hire contractors who CLAIM they will do things so that they can fire them later when they don't do it. If they actually hire good people, they have additional egg on their faces when things don't go right and the blame game is even harder to sort out. This is all about blame shifting and the appearance of easy "correction." Having worked for DHS for a couple of years, I saw a lot of rather disgusting and disturbing things about the way they hire contractors and then don't oversee their activities. When security screeners were being hired, I witnessed an 18 year old girl being hired as a supervisor and this was her VERY FIRST JOB. She had absolutely zero employment experience and was hired on in a leadership role. Nothing explains this adequately. They had contractors doing the hiring and staffing for that operation and it didn't work out so well. I heard that somewhere between 20 and 25% of the people initially hired didn't pass the background check and were subsequently let go more than a year later so I got to see the process repeat itself AGAIN where they used contractors to do another round of mass hiring and staffing. They never learn.

Obvious solution to this.. by Lakitu · 2010-09-09 02:02 · Score: 4, Funny

We need to create a Department of Department of Homeland Security Security immediately.

Re:Obvious solution to this.. by Anonymous Coward · 2010-09-09 02:55 · Score: 0

Yo dawg, i herd you like security holes, so i put a dept. of homeland security in your dept. of homeland security so you can be insecure while your being insecure!

Quick! by Anonymous Coward · 2010-09-09 02:02 · Score: 0

Let's all hack the motherfuckers before they fix the holes!

Re:Quick! by Paracelcus · 2010-09-09 03:55 · Score: 1

Listen! they're coming up the driveway, out the back door! ;-)...

--
I killed da wabbit -Elmer Fudd

Re:no this is what you get with outsourced IT VA by Divide+By+Zero · 2010-09-09 02:05 · Score: 4, Informative

Commonwealth of Virginia != Department of Homeland Security.

This is an entirely different issue. The Virginia thing was a waste of money and an added frustration which, as anyone who's been to Virginia DMV can tell you, is NOT necessary.

What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.

While it's very difficult to keep out an experienced, dedicated attacker, you could at least shore up the defenses enough to keep the /b/tards and script kiddies out.

--
Dare to Hope. Prepare to be Disappointed.

I think it speaks more to the tools available by joeflies · 2010-09-09 02:06 · Score: 1

Managing configuration for one box is easy. Sometimes managing configuration for multiples of the same box is doable. But managing configuration for a large scale multi-vendor deployment is a headache that nobody solves particularly well, and the tools for checking the various things (patch level, logs, configuration scanning, etc) typically all come from different security vendors and those don't work together either.

Acrobat, Java, and Microsoft by MrTripps · 2010-09-09 02:11 · Score: 2, Informative

The article says most of the flaws were unpatched installations of Java, Acrobat, and Windows. When new patches for those come out every week it is easy to let that slip without some sort of patch management tool. I wonder what they used other then WSUS.

--
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach

Re:Acrobat, Java, and Microsoft by idiotnot · 2010-09-09 02:56 · Score: 1

A thousand times this.
But, then, I suppose the people who wrote TFA, or are commenting here, don't have a single unpatched copy of Acrobat Reader or JRE around. Am I right?
Cluestick time: while there's problems in government IT, I can guarantee you that many, many large corporations would have fared worse on a similar audit.
Re:Acrobat, Java, and Microsoft by mcgrew · 2010-09-09 03:14 · Score: 1

Indeed. I guess the day before yesterday was Patch Tuesday, because as soon as I got home from work and turned my netbook on it said there were "critical updates".
Last night I got another one for Adobe's PDF viewer. Then BitTorrent asked me if I wanted to update it.
I rebooted that thing more in the last two days than I have since I bought it in April. At least BT didn't need a reboot. It was annoying, because I'm trying to DL and try Kubantu with BT and seed my novel and Mandriva with it, and all that rebooting cut into my uplodaing and downloading and beer drinking.

--
Free Martian Whores!
Re:Acrobat, Java, and Microsoft by Anonymous Coward · 2010-09-09 13:46 · Score: 0

Cool story bro.

FUD by setrops · 2010-09-09 02:14 · Score: 1

The lack of details in the paper makes it so that it is impossible to know exactly what they found. Scanners such as Nessus, Foundstone, Languard are really noisy and can report normal system operation as a high vulnerability irregardless of system configuration.

Something like telnet will be a high, but put the proper mitigation such as access list, 2 factor authentication and you can show it as a medium or low.

It's all subjective.

Re:FUD by crypticwun · 2010-09-09 02:44 · Score: 2, Insightful

Actually, reading the report tells me that the problems were almost certainly Windows desktop systems lacking a cohesive patch management solution. Also, if you read further the IG even states that as of the time this report was published all the problems were already remediated including acquisition and deployment of a "software management" solution. Further, the IG claims that NCSD is not following FISMA. NSCD is not a legally recognized entity (agency) under statute, so that means *DHS* is the responsible party for FISMA reporting. FINALLY, US-CERT != the troubled network. US-CERT uses that network, but has no control over the operations of that network. Both the IG and Wired go out of their way to NOT make the distinction on that.

if you read the actual report pdf by Anonymous Coward · 2010-09-09 02:17 · Score: 0

you find the most grotesque microsoft powerpoint like data crap: a half page picture that is a pie chart with two sectons (figure 4, page 9 in the pdf)
Anyone who would put together such a bs piece of eye candy isn't competant to pound sand down a rathole, even if they do use their spellchecker

Re:if you read the actual report pdf by flydpnkrtn · 2010-09-09 02:45 · Score: 1

you find the most grotesque microsoft powerpoint like data crap: a half page picture that is a pie chart with two sectons (figure 4, page 9 in the pdf)
Anyone who would put together such a bs piece of eye candy isn't competant to pound sand down a rathole, even if they do use their spellchecker
Have you ever briefed such a report to management? Management wants to see the 'bottom line' type of information, not piles of information packed into slides.
Pie charts are common on these types of high level reports... remember that managers are looking at this. To get into the nitty gritty and fix vulnerabilities (or invalidate scan findings if they're false positives) the Information Assurance techs would look at the actual Nessus scan findings, not the pretty pie chart (that's for management).

--
Here's to the crazy ones
Re:if you read the actual report pdf by setrops · 2010-09-09 06:53 · Score: 2, Interesting

Yes actually I do this quaterly.
We divide the vulnerabilities in 3 category.
OS patching.
OS Hardening.
Application Patching.
By doing this you can focus to the root cause of the issues. System owners, Application owners. It's a nice 2 page report with colours. they love it.
Administrators who care and are not tied up in red tape tend to really shine in these reports.
Another thing to realise is that in a corporate production environment, nothing will ever be 100% secure 100% of the time.

obvious by slick7 · 2010-09-09 02:27 · Score: 2, Funny

This looks like a job for Kevin Mitnick...naaah.

--
The mind conceives, the body achieves, the spirit manifests.

Security? by Caradoc · 2010-09-09 02:31 · Score: 1

So the Department of Homeland Security's network security measures are approximately equivalent to the security measures on the border between Mexico and the United States.

I am Jack's Complete Lack of Surprise.

The Department of Homeland Security's primary mission is not "security." Its mission is "training the public to be properly responsive to idiotic demands from the Federal Government."

--
Specialization is for insects. - R.A.H.

Re:Security? by flynns · 2010-09-09 02:45 · Score: 1

Heh, that was the first thing I thought of when I read this: "I am Jack's complete lack of surprise."
Which, of course, made me go here.

--
'If you're flammable and have legs, you are never blocking a fire exit.'

Re:no this is what you get with outsourced IT VA by Hylandr · 2010-09-09 02:36 · Score: 2, Insightful

I have done work with the government and had to participate in this scanning before bringing new hardware aboard a military facility.

Their scanning software requires remote access to the registry from a central scanning computer and looks for every "recommended" patch, setting, or configuration and throws a flag for every non-compliant instance it finds. The list of recommended settings are often security theatre regimen or disastrously harmful to performance. But someone convinced congressman Y,Y,Z that this setting was imperative to have enabled or disabled.

Performance was so horrible we had to disable the scanner's access in order to perform our demonstration.

- Dan. .

--
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.

Remember.... by Anonymous Coward · 2010-09-09 02:51 · Score: 0

Gary McKinnon? He got into .mil/.gov systems with superuser access with extreme ease/simplicity...

BLANK passwords.

And these are the same people that think pot is bad for you, alcohol is good for you and all the red on their budgets look fine. Pshhh.

Grain of salt by Spazmania · 2010-09-09 02:55 · Score: 4, Informative

Take it with a grain of salt. The security scan was checklist-based, taking no account of the context. Worse, it's was based on version to database matches, utterly failing to account for backported security patches and similar protections that render specific vulnerabilities moot.

I have no personal knowledge of this specific case. But I've seen it enough times to know what this report really means.

--
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.

It gets worse. by 140Mandak262Jamuna · 2010-09-09 03:01 · Score: 0, Offtopic

Imam Rauf is building mosques on 900 of these holes. Rev Bigot is burning Q`ran in 984 of these holes and Osama Bin Laden is hiding in the last one.

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Doesn't surprise me at all... by Anonymous Coward · 2010-09-09 03:17 · Score: 0

... there is nobody in the 'visible' Three-Lettter-Acronym agencies that can do computer security, and very few people in the 'invisible' TLA contractors/agencies that are allowed to speak about how they prolong that problem in order to stay employed.

Re:no this is what you get with outsourced IT VA by Anonymous Coward · 2010-09-09 03:21 · Score: 0

I'd be so bold as to say that the baby's candy protection perimeter was a bit more secure, based on the reports we're seeing.

Re:no this is what you get with outsourced IT VA by human-cyborg · 2010-09-09 03:25 · Score: 1

What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.

?!? Where are you getting this analogy from? ?!?

Can't you think of an appropriate car-themed analogy?

Taken with a grain of salt.... by Kalidor · 2010-09-09 03:26 · Score: 1

Several years ago I was working at a company hired to do a similar outside audit, who ... was in turn of course hired to fix the situation.

I was handed a Nessus by the fellow who did the audit that pointed out several servers were missing critical windows patches in the audit the week before ... and to please go out and patch them. Small problem when I arrived on site ... servers were running Debian. So Nessus might be a great auditing tool, but any report is only as good as the people that ran the tool.

--

Code softly but carry a big magnet.

misleading by Lord+Ender · 2010-09-09 03:33 · Score: 1

With Nessus, the "high" severity results are the only ones that really matter. And even then they sometimes don't. For example: "you are using a version of PHP with a security hole in one of the API calls your programs might use" is high, but it isn't a real vulnerability unless you actually use that specific call.

--
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.

Just like the old saying by Thyamine · 2010-09-09 03:35 · Score: 2, Insightful

Something about the carpenter's house or the cobbler's kids have no shoes. I work for a computer support company, and this happens to us and everyone else. Backups/patches/etc don't get tended to unless someone up the chain knows how important they are and makes it get done. Even then it's hard to keep on top of _everything_ unless you really have people dedicated to it. It's no surprise, and I don't think it's any reason to be angry. It just shows that they need to get better organized about it like everyone does..

--
I will shred my adversaries. Pull their eyes out just enough to turn them towards their mewing, mutilated faces. Illyria

DHS runs Security checks all the time by realsilly · 2010-09-09 03:36 · Score: 2, Interesting

The Govt. runs security scans on all of their systesm all of the time. They are using tools that are designed to help them make their security tighter and more difficult to hack, and they are improving this all the time. As new security tools come to market they evaluate them just like any corporation. And before they let new applications on their networks, and before any releases upgrades are performed they check security on those applications. All security issues identified must be addressed before applications are put on their systems.

I would have like to have seen a comparison of our Governments security run against some of the Banks and Wallstreet system that hold our financial data. I would suspect you'll find as many or more on the public sector as you will on Govt. sector systems.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.

1085 high vulnerabilities... by idcard_1 · 2010-09-09 03:37 · Score: 1

across 174 MOE computers scanned of 202 unique vulnerabilities... which comes out to be about 6.2356 vulnerabilities per computer.

Re:no this is what you get with outsourced IT VA by Paracelcus · 2010-09-09 03:50 · Score: 1, Informative

"18 year old girl being hired as a supervisor and this was her VERY FIRST JOB"

I guess if I was getting my pole waxed by an 18 year old girl, I'd give her any job she wanted too!

--
I killed da wabbit -Elmer Fudd

Re:no this is what you get with outsourced IT VA by Anonymous Coward · 2010-09-09 04:07 · Score: 0

Their scanning software requires remote access to the registry from a central scanning computer

LOL. You had me right there, I mean, what could possibly go wrong? :)

Re:no this is what you get with outsourced IT VA by Anonymous Coward · 2010-09-09 05:07 · Score: 0

Several things explain an 18 yr old in leadership position quite adequately.

1. "Broken oath of office." (FIOS Splitters, Failure to regulate the monetary sys, Torture, Spying, data hacking, fucking bs, hell on earth pain weapons, and abuse of electronics and physics, or training young minds with unconstitutional bullshit)

2. "Brainwashed Propaganda Replacing the United States Constitution and Bill of Rights" (MIAC REPORT, UN, UNEP, IMF, IPCC, TC, PNAC, AIPAC, CFR, CARBON TAX/POPULATION CONTROL (un/unep/ipcc/imf), FLORIDE(local), VACCINES(cdc/who/local), AND A ZILLION OTHER THINGS YOU FUCKING CORPORATIONS YOU'D BEST MAKE SURE YOUR FUCKIN CANDIDATE ISN'T AFFILIATED WITH, ALONG WITH THE CORPORATE MEDIA OWNING 90% OF THE FUCKING PUBLIC SPECTRUM-SHITTING ON YOUR INTELLIGENCE)

3. "Corruption protected by State Secrets" catch 22, and "No Expedited, Clearly Written Procedures, for taking out a Oath Breaker" (not to be confused with this never-ending-unconstitutional-undeclared-fucking-invisible-war-on-terror)

FAILURE (TM) by myspace-cn · 2010-09-09 05:17 · Score: 0

Step one, outsource everything

Several things explain an 18 yr old in leadership position quite adequately.

1. "Broken oath of office." (FIOS Splitters, Failure to regulate the monetary sys, Torture, Spying, data hacking, fucking bs, hell on earth pain weapons, and abuse of electronics and physics, or training young minds with unconstitutional bullshit)

2. "Brainwashed Propaganda Replacing the United States Constitution and Bill of Rights" (MIAC REPORT, UN, UNEP, IMF, IPCC, TC, PNAC, AIPAC, CFR, CARBON TAX/POPULATION CONTROL (un/unep/ipcc/imf), FLORIDE(local), VACCINES(cdc/who/local), AND A ZILLION OTHER CORPORATIONS YOU'D BEST MAKE SURE YOUR FUCKIN CANDIDATE ISN'T AFFILIATED WITH, ALONG WITH THE DANGEROUS CORPORATE MEDIA CULT OWNING 90% OF THE FUCKING PUBLIC SPECTRUM-SHITTING ON YOUR INTELLIGENCE)

3. "Corruption protected by State Secrets" catch 22, and "No Expedited, Clearly Written Procedures, for taking out a Oath Breaker" (not to be confused with this never-ending-unconstitutional-undeclared-fucking-invisible-war-on-terror)

Computer Maintenance since 1961, therefore... by Anonymous Coward · 2010-09-09 06:09 · Score: 0

Check InZerosystems.com... TOTAL security! btw, The name is posted with a smile)))

Re:no this is what you get with outsourced IT VA by AnAdventurer · 2010-09-09 06:16 · Score: 1

Yup, I too was hired by DHS via a contractor. My UA was hot for Benzo (I was in the middle of a messy divorce, but had no script), I told the Dr at the physical and they passed me through. I left for the same reason you mention. No rhyme or reason for speciality hires. Myself and another highly qualified co-worker applied for a IED detection instructor position and it was awarded to a 55+ year old woman who had probably never seen an explosive in her life. I left a few weeks later. My co-worker lasted a few more months until he threw in the towel and moved into private security.

--
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86

Re:Idiots and real Idiots, Reality Check! by OldHawk777 · 2010-09-09 06:25 · Score: 1

The government always ends up hiring contractors, this is why the jobs are already contractors, because .Gov/.Mil/.Com C*O/management get to blame-storm the contractors, the contractors can blame-storm each other, and the public thinks civil servants can't do the job. I know a few .Gov IT/Services folks and they know security basics very well, but they cannot interfere with the contractors doing a questionable job, until post-audit or post-incident.

Go discover how many contractors are on the .gov/.mil payroll. Are contractors more competent? Well from this incident and many others, I suspect, the answer is NO!