Slashdot Mirror
DARPA Seeks Input On Securing Networks Against Attackers
hessian writes with an article in Wired about the problems facing the U.S. Government's networks in an increasingly hostile world. From the article: "The Pentagon's far-out research agency and its brand new military command for cyberspace have a confession to make. They don't really know how to keep U.S. military networks secure. And they want to know: Could you help them out? DARPA convened a 'cyber colloquium' at a swank northern Virginia hotel on Monday for what it called a 'frank discussion' about the persistent vulnerabilities within the Defense Department's data networks. The Pentagon can't defend those networks on its own, the agency admitted."
Darpa convened a “cyber colloquium” at a swank northern Virginia hotel on Monday for what it called a “frank discussion” about the persistent vulnerabilities within the Defense Department’s data networks.
Well there's your problem! The ones at the forefront of breaking-into-electronic-systems-in-interesting-ways aren't the usual crowd the DoD are used to wooing (heads of industry, academic engineers, the conference-at-swanky-hotel crowd) but people working out of their basements fiddling with things for the fun of it.
If they want a real assessment, offer a honeypot network with some stand-in data, and set a prize for whoever can get it and tell them how.
I wonder what this says about their own confidence in SELinux.
Then who can?
Super Man?
Oh, you want really secure? Turn it off and never use it.
No doubt!
Gooberment:"Please secure my network from any possible attack."
l4t3r4lu5: Yoink. bzzzzzzrrrrr. "There you go!"
Having to work for a living is the root of all evil.
Start using systems that were designed to be secure in the first place. Stuff that works on a "deny by default" basis, that refuse to process any data that it doesn't understand, use OCSP as a white list on the CA side, defence in depth: use strict validation of input on multiple levels (when making web app: using default deny application firewal, then strict validation in form processing and finally use modular application design that validates data received from other modules) and so on.
This will require throwing away most, if not all, software in use. Including OSs, probably even Linux as I'm not sure if SELinux (or other such systems) go deep enough on the kernel side. Then making new software from scratch with primary design objective to be secure. As no politician or PHB can justify spending this amount of money on such nebulous concept as security, the whole idea will fail. Because this won't eliminate, just reduce the number of security related bugs, won't help the cause.
We have to start by teaching new programmers how to make secure systems first (and I repeat, systems, not just programs) and just then how to program.
The candy man can
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
TYPEWRITERS! TYPEWRITERS FOR EVERYONE!
Filter error: Don't use so many caps. It's like YELLING.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
Another country?
If you're not willing to make the hard calls when someone can't do something as simple as patching, you're doomed from the start.
Securing the network on Windows is just about impossible. It was originally designed when computer security was nothing but a far-out concept and attempts to retrofit security into it without tossing out the basic design have been unsuccessful so far, actually securing it would require a silly level of hacked-up modification (try to prevent wifi dual-homing, I dare you). Toss out Windows, start with a custom Linux distro and go from there. Network-booting machines secured with in-house-administered TPM will be extremely hard to break into. Allow centralized control of all software so that any change to a computer's OS that wasn't signed off on by the IT department sets off the biggest red flag in the world.
It can be done but not while trying to pussyfoot around with commercial consumer-grade toys.
"When information is power, privacy is freedom" - Jah-Wren Ryel
The core problem for the US government, and whichever of the many branches that is taking responsibility for this or that part of the government's cyber infrastructure, is a lack of pervasive talent among the staff. In order to attract talented staff, it is essential to have a very transparent mission and vision for an organization. Is the US government really committed to securing the infrastructure?
Well if you look at the Chinese attacks they are all based on spear phishing. So what you need to secure is prevent people from running code sent to them via emails. Its really easy to do - simply enforce whitelists - not blacklists, whitelists. For example, the OS should refuse to run unsigned exe files - not simply ask you if you're sure, but actually tell you that you can't, period. And by unsigned I mean anything not signed with the private keys of your organization. Also, make a whitelist of domain names so only approved websites can be visited. That cuts a large swath of infection vectors - now you can't enter into the computer network with the help of gullible employees because even if they want to run your exe or follow that link to your website and enter their password THEY CAN'T.
Frank discussion? That's the 1st problem.
Security seems to be extra vulnerable to fraud. Many times, I saw military customers wooed by vendors who are perfectly willing to give them a load of bull about how they can't explain why their devices, software, and ideas are secure, because that would compromise the security. Then the military goes a step further, and abuses their secret classification system to cover up security problems, keeping important information even from their own people. They base security decisions on politics. They are more interested in getting a system approved as secure, than in whether it is actually secure. and will lean on people to just rubberstamp systems. They play favorites. They like Windows, because they find it more user friendly, so they push to have it declared secure. Systems they don't like are held up to extremely difficult standards, the better to reject them. They engage in plenty of their own bull to pull that off. For instance, Linux is coded by foreigners, which they deem automatically makes it insecure. How can they know some foreign programmer won't put a back door into the Linux kernel? Never mind that Microsoft might employ Indians to work on Windows. And who's to say that US citizen programmers would never sell out?
They want COTS (Commercial Off The Shelf), to save money, but there is no COTS that meets their needs. They play a funny game with contractors too. Employ people as contractors and treat them with deep suspicion, but won't employ them as their own experts who just might possibly be a touch more committed and loyal.
No surprise that the military stinks up their security.
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
Thats what VPNs and ACLs are for. You dont think you could securely configure VPNs and ACLs for less than it would cost for a parallel infrastructure? What happens when someone bridges a wifi device onto your network?
Stop putting critical systems online.
"If any question why we died, Tell them because our fathers lied."
out good tech people or force them to be mangers and then on to some other post.
Also alot of tech people are to old for the military others don't have the mine set to make it though a military boot camp. If some of it needs to be military maybe then it's needs a special rank systems so techs are not forced to start at private pay and officers should not be the same way as the rest of the military is.
Also have a special boot camp say maybe little to no exercise part, no forced gun trading, no other battle field skills (we want people to work on IT and not be a soldiers that can be sent any where) Maybe even have some kind of tech school but I don't know if they should come officers (As some of tech people make for poor managers) maybe have techs become team leaders.
Come on, Android is hardly Linux, the Linux-based kernel isn't even compatible with the mainline Linux kernel. Apart from that distinction, it's about as far from a locked-down security-centric distro as you can get.
And yes you can lock down Windows with an insane amount of work, but why not put that work towards a more fundamental and long-term solution, instead of slapping armor onto a vulnerable black box that was never designed to do the job?
"When information is power, privacy is freedom" - Jah-Wren Ryel
Not all of those connections will be legitimate
Which is why we have things like PKI infrastructures, pre-shared keys, and RSA tokens. At least there you know what the threat is, and can fortify around it.
Im not sure Ive ever heard of a scenario where someone broke into a secure network by bruteforcing both the PKS and the secondary form of authentication; invariably, breaches are because someone made a stupid mistake like getting a virus, or by letting someone walk out with un-secured media, or connecting a wifi device to the secured network.
And with your parallel infrastructure, the problem is that (unless you have other control mechanisms in place) a single wifi device on the network compromises the security of the whole segment.
It's B1 in the old (stringent) rating scheme, and can be configured to provide a lot of protection against theft of data, via
- mandatory access controls (not changeable by the process or user)
- secure path (knowing it's really you at the keyboard)
- covert channel analysis (genuinely hard, this is often "ongoing")
- audit (which eventually runs you out of disk (;-))
There is some protection against attack, but more or less as a side-effect of protecting against spies leaving with data.
--dave
davecb@spamcop.net
Was anyone ever able to compromise a correctly configured VMS box? Has anyone broken strong well configured public key encryption? Security is not a big secret, not easy, but good, effective practices are not unknown. So is the question "how do we keep script kiddies off our sharepoint site installed by a neophyte sysadmin"? Really the only valid response is a well quoted "*sigh*".
4chan!
They ANYPA
NO SIG
That solution has always befuddled me. Why bother physically securing hardwired, functioning USB ports when you can
1. Remove the USB ports or
2. Disable the USB ports in Group Policy.
The simplest way to prevent burglars from coming in your windows is to not have windows. Though you may like your windows, USB ports are not a necessity.
Then you run into problems with data that needs updating, like say, a map. Putting it on CD/DVD only works until malware realizes it needs to embed itself on said media, and once it has, there's nothing to prevent another stuxnet-like attack.
If data needs to flow somehow between airgapped networks, you're screwed. Doesn't matter if you use a data diode, physical separation, etc. As long as there is some way that data needs to go from an insecure network or insecure PC to a secure one, it's a vulnerability vector. Stuxnet has proved it's possible.
Oh, and patches count too - regardless of what needs patching. Unless the patches originate as developed on the secure network, it's a mechanism for insecure systems to pass data to secure networks. Even if you go so far as to enforce that the source code be displayed on the insecure PC, and typed in manually on the secure PC - the typists may get complacent and type in the malware as well.
And there's a LOT of data that often has to be passed into a secure network - Intel (photos - where did the digital camera's memory card get plugged into?, maps - like the UAV fleet got infected, etc), reports, etc.
Actually if you wanted real USB security you'd open the system pull the wires off the headers then epoxy/clip the header so no one could open the system and add a stealth usb port to the header. Keep in mind there are anywhere from 1-6 sets of headers on the motherboard and a few minutes of work would allow someone to attach usb devices whenever they wanted.
Any Internet connected system will be compromised at some point in it's design life. The only way to prevent this is to get really important things offline, and keep them off the Internet ( including all of those government networks like Intelink, Siprnet, Nipnet, etc, etc, etc, etc, etc, etc, etc. )
AFAIK SELinux can protect you from attack only from user-space. It won't help for attack on kernel itself (it's important if we want secure networks). But then I'm not sure if any system in a monolithic kernel would be able to do this. On the other hand, monolithic kernels are the only OS kernels that actually work outside academics. This would suggest that the highest security rating a general purpose OS can have is B1...
The problem is that they have government contractors reviewing potential solutions. The same people who are incapable of coming up with workable solutions themselves. So what makes anyone think they would know a good solution, even if it bit them in the ass?
DARPA announced a grant program for this last August at Black Hat. We spent a month crafting an RA for developing a solution based upon formal methods that would change the advantage from the attacker to the defender. Even if we were full of shit, you'd think DARPA would want to know more, in case we weren't. We got a form letter rejection for "Mudge". Am I bitter I spent a month trying to help out the DoD? you bet. I have better things to do.
It reminds me of when the Web was first emerging and I was getting my MBA - Anderson Consulting came to our school with a "contest" to see who could come up with the best business model for the web. Anyone know where AC is now? The DoD needs a good shot of Darwin.
You got it! My uncle is now a security officer in the military. he's a highly skilled Linux Programmer, and knows how to attack the network if he needs/wants to. the only reason he got in the military and is now in security is because he had a 96% accuracy at 300 yards. After all this time, the military still values killing over technical skills. While they should be on equal footing.
If an Iranian Nuclear power plant can be attacked by a virus, which could have caused major damage we are just lucky it didn't, you'd think the military would take a better look at their skill requirements. But they rely on their current ranks, the NSA/FBI/CIA to foot for when they can't make up. (and the majority of their skills are about as good as the Military) we need a skill refresh, its long over due.
I don't think you really know much about the military, or your Uncle is pulling your leg. That's not how the armed forces work in the U.S.
How to make a network secure, well lets see, enable OpenVPN configure IPSec, make sure everything inter-departmental is using a PKI token and ensure everyone has PGP. Separate various parts of the network after the employees have better things to be doing than browsing facebook or youtube updating their twitter status and reading there hotmail from a government system. Throw out all those copies of Windows (tm) software their really not doing you any good in a virtual environment or other, is everyone using the latest version of a secure and trusted OS like OpenBSD or Linux on their desktop?