Slashdot Mirror
DoD Networks Completely Compromised, Experts Say
AZA43 writes "A group of U.S. federal cybersecurity experts recently said the Defense Department's network is totally compromised by foreign spies. The experts suggest the agency simply accept that its networks are compromised and will probably remain that way, then come up with a way to protect data on infected machines and networks."
to spread misinformation to those foreign spys that only think they compromised DoD computers (naw too good to be true) the US Gov is too stupid to do anything like that
Politics is Treachery, Religion is Brainwashing
“DoD is capability-limited in cyber, both defensively and offensively,”
Anyways, are we talking a bunch of old NT boxes plugged right into the internets, I mean the cyber.
Its nice to see the DoD finally catching up with basic best software practices.
Why does the network have to be accessible remotely? It should be isolated and need a meat sack to get the information from the system and relay it to the party that needs the information. Same thing with public utilities and such - why is it wired so that someone remote can tap a few buttons and remotely access controls for water plants?
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
Stuxnet was still able to reach such methods, though direct control wasn't possible, it was more of a phone home/carrier pigeon type of compromise.
Surely will convince public opinion that the new measures of surveillance on all internet connections have a good reason and they should give up on privacy forever.
The military would like a bunch of script kiddie canned attacks as their 'offensive' capability. They don't want to rely on anyone with a brain in real time. That doesn't work very well in practice.
They're never going to get what they want.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Well it's defense so ultimately what this boils down to is: "here's a file that says they're going to kick our ass". Can they do that? "Yes". Well, at least we infiltrated their network so we know our asses are going to get kicked and we can prepare for that. "No we can't, we'd have to move the entire country and kick somebody elses's ass to do it. What's more is our network is infiltrated too so they'd know we were going to do it and what's worse is we don't have much ass kicking capability". So. We're dead meat; but we know it in advance. That showed them!
... given the general below-mediocre quality of the contractors and government employees that work for the DoD, and the amount of senseless policies for policy's sake claiming to be for 'security' but, uh, no, not really. The people in charge are the worst.
I just started working for DoD again, and want to punch people in the face all day long.
Reminds me of when I was sent to a DOD site to try to figure out why everyone was scoring 97% on a certain test.
30 seconds of looking around and I had a pretty good guess:
(1) The unused tests were printed out in print runs of 10,000 and kept in an alcove in a dusty unused office. Said alcove had a plywood door with 18 inch gaps at top and bottom. Padlocked, but with the hasp mounted backwards, with all the screws exposed.
(2) There was a 50 page per minute xerox copier in the same room, no access card needed.
That was a rude introduction to DOD security measures, and the cluelessness of the security folks.
is that they will do political things. As such, they have LOADS of windows. And yes, they are LOADED with spies (and the DOD knew it). However, I differ with the expert. NSA should step in and help DOD upgrade everything to a decent set-up. Secure Unix or Linux (with SEL). NO MORE WINDOWS. In addition, restore the security that we used to have back in the 80's. We have slacked so much that many of the contractors are spies. Hell, I have dealt with a probable Chinese spy that was married to a USAF officer.
The USS reagan should be refitted with secured systems, or we should simply send it in the middle east and allow Iran to blow it up (better iran than china).
What amazes me is that EU, Russia, and China are all brighter than so many of the idiots in the DOD and at American companies.
I prefer the "u" in honour as it seems to be missing these days.
The experts suggest the agency simply accept that its networks are compromised and will probably remain that way, then come up with a way to protect data on infected machines and networks.
This is actually one of the smartest things I've heard come out of the DoD relating to information security, in a long while.
One of the first rules of thumb when developing secure client-server applications is, never trust the client. One must assume that given a high enough incentive, any public facing interface can and will be exploited in one way or another, and there is no way to reliably anticipate all attack vectors.
It is smart to develop policies and procedures around this assumption.
Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
While I agree that I'd like to see the DoD move to more secure technical solutions, I don't think it'd solve the security problem. Like you pointed out the system is only as good as the people that are using it. And even with a very small percentage of people willing to spy it'd be almost trivial for a foreign government to buy their way into almost any system.
Prior to 2001 everything was more compartmentalized, which was good for Information Security's sake. But it proved to be bad for our national safety as the CIA wouldn't pass on information about a potential threat to the FBI for what amounts to dick measuring reasons. In the aftermath of 9/11 the policies swung the other way and we end up with Bradley Manning having access to way more information than he needed for his job.
A proper solution is a multi faceted problem. We need technical systems that are secure and yet still useable by a barely trained 18 to 50 year old volunteer. We need systems designed to be as secure as possible but still interface with each other and work in a timely manner. We need people that are as immune to corruption and insanity as possible. And the hardest part is probably sticking to fights and engagements that don't force those people to question the morality of the job they are tasked with doing.
Oh har har har. Do you know how much paperwork that's going to require? To re-write all the specs that specify Windows 3.11 for Workgroups will cost TEN BILLION DOLLARS! So do we re-write all those specs or do we buy the FRONT TIRE of a Joint Strike Fighter! It won't be so funny when a Joint Strike Fighter can't land because it doesn't have a front tire!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
We use CA epoxy as a very effective security measure. For any commodity hardware we buy, we fill all of the USB ports with a CA epoxy that prevents access. We also use it to permanently attach mouse and keyboard. Motherboard USB headers are also filled with CA to prevent the casual attachment of devices (although users cannot physically get to their machines, since they are in locked cabinets, with IDS tied to building security. Same goes for unused SATA, PCIe, and other ports. Any plug that isn't used is made unusable.
PCs are on a network, but users have no physical access to cables, and similarly we use a secure cable type with a current loop and TDR to detect physical tampering. If the current loop is cut, building security knows precisely where the cut is within seconds.
There is no wireless, and no bluetooth. Employees are not allowed to bring in cell phones, MP3 players, or anything else with any capability of capturing data, and yes, we 100% search at the door with metal detectors and millimeter wave detection like you see at the airport (except we actually know how to use it). We're also in a steel building with no windows and and EMI shielding, just in case.
We're not on the Internet. We have absolutely no need to connect to it. Even if we did have a spy as an employee, they would have to reproduce anything they did on another machine outside the office in order to transmit it anywhere else. And obviously, there is no means to allow employees to "work from home" in their pajamas in sandals.
Any new software has to go through a thorough vetting process, and any vendor wanting to sell us software is required to allow us to load the source code and build environment onto our build farm, review and inspect the code for possible attacks, and then compile it ourselves. This is a lot easier to achieve than you might think.
Finally, we're old school. Everything is compartmentalized. The guy working on the math routines has no idea why he's working on them, or what they will be used for. All he knows is that he's a software engineer in charge of high-level math function development. He doesn't know what the product is or what it does.
millions-of-dollars research projects, are underway right now. in fact, a guy from the l0pht, named Midge.
see
http://en.wikipedia.org/wiki/Cyber_Insider_Threat
im sure theres no coincidence between 'experts' pushing this and the industry about to 'provide the solution'.
nevermind that they are basically, built around theories like "maybe a guy changes the time he eats lunch".
and that 'insider threats' also = whistleblowers.
"A group of guys whose budgets revolve around coming up with new cybersecurity defenses testified today that they should be given a LOT more money to play with."
For your security, this post has been encrypted with ROT-13, twice.
But when did the Soviets begin this type of research?
Well, sir, It looks like they found out about our attempt to telepathically communicate with
one of our nuclear subs. The Nautilus, while it was under the Polar cap.
What attempt?
There was no attempt. It seems the story was a French hoax. But the Russians think the story about the story being a French hoax is just a story, sir.
So, they've started psi research because they thought we were doing psi research,
When in fact we weren't doing psi research?
Yes, sir. But now that they're doing psi research, we're gonna have to do psi research, sir.
We can't afford to have the Russians leading the field in the paranormal.