Slashdot Mirror
State Department Joins NOAA, USPS In Club of Hacked Federal Agencies
Hot on the heels of recent cyber attacks on NOAA, the USPS, and the White House, the New York Times reports that the U.S. State Department has also suffered an online security breach, though it's not clear who to blame.
“This has impacted some of our unclassified email traffic and our access to public websites from our main unclassified system,” said one senior State Department official, adding that the department expected its systems to be up soon. ....The breach at the White House was believed to be the work of hackers in Russia, while the breaches at NOAA and the Postal Service were believed to the work of hackers inside China. Attributing attacks to a group or nation is difficult because hackers typically tend to route their attack through compromised web servers all over the world. A senior State Department official said the breach was discovered after “activity of concern” was detected on portions of its unclassified computer system. Officials did not say how long hackers may have been lurking in those systems, but security improvements were being added to them on Sunday.
All of these agencies had to follow FISMA (among others regs). Perhaps its time to stop letting politicians tell us how to do security?
do they ever say when their classified system gets breached? no, of course not, it would let people know how laughable their security really is.
Anons need not reply. Questions end with a question mark.
Well, they were SUPPOSED to follow the regs. Of course that doesn't mean they did. As you suggest, though compliance and security are not only not the same thing, but they are only very loosely coupled, of it all. In some cases we've had security regulations require the use of insecure methods, such as MD5. I spent 15 years doing security for small companies before I just recently started learning compliance with all of these "security " standards.
PCI is pretty good, though. It's not comprehensive, but it doesn't require insecurity.
NOAA, USPS? Yawn. But State Depaetment is a big deal.
USPS is a Government Sponsored Enterprise, not a Federal Agency.
I wonder if, in the middle of a huge pile of unclassified e-mail, there might be some little bit of classified material that got sent over the wrong channel, due to an honest mistake or because of a misplaced "damn the regulations I'm getting this done now no matter what" moment.
It's easy these days to just throw your hands in the air, say you were hacked, and point fingers at the rivaling world powers. Yes, we are speaking of Americans, but to think that the U.S. government wouldn't be able to secure its networks, and that only the Chinese and Russians would be trying to "get in", is ridiculous. This is nothing but baseless propaganda.
Hot on the heels of recent cyber attacks on NOAA, the USPS, and the White House, the New York Times Reports that the U.S. State Department has also suffered an online security breach, though it's not clear who to blame.
For a moment there I thought TFA was not going to blindly name drop China or Russia. Don't worry folks, they did not forget!
Dealing with the State Department is already a byzantine process. It'll only get worse now.
[ ] I am gay
[ ] I am a wigger
[X] I have used SLASHDOT BETA to find a sex partner
> but to think that the U.S. government wouldn't be able to secure its networks, and that only the Chinese and Russians would be trying to "get in", is ridiculous.
For $5000, you can buy a heavy safe made of concrete and steel. For $32, I can rent a concrete saw made to cut concrete and steel. You can't secure ANYTHING and have it still be useful. The question is "how hard should it be to breqk in?" The state department network should be pretty hard to breqk into. It'll never, ever be impossible.
The government of China isn't stupid. They know that if you are going to have a military and be a world power, it makes sense to also have significant cyber resources - so they do. They use them regularly, especially since the US allows it. The US doesn't respond to cyber attacks the same way they'd respond to physical attacks.
With the huge surveillance state we have, such hackings are impossible. It has to be a hoax. There is no other explanation.
I can see 2 things as the main root cause of this:
- Layers and layers of outsourced IT. Especially when dealing with a federal agency, almost every IT service in any agency has been outsourced. Those outsourcers hire other outsourcers and it becomes a big mess when you try to do anything that affects multiple parts of a system. I see this in the private sector as well working for an outsourcer...our team does their best to help but it's really maddening to see how much things slow down when the control gets dispersed. The network team has to talk to the storage team, who has to talk to the server team, who needs to open a ticket with the field services team to implement change #C9348673634. I do systems architecture work, so it's really painful to have to design around a garbage system like this rather than having a few smart people who know the system end-to-end.
- Security is tough and no one wants to be bothered. It wouldn't be impossible to enable 802.1x on a network, implement proper PKI to enable its effective use, and encrypt hard drives. But often, it either becomes too difficult to support or no one has the will to say things must be done in a certain way. Plus, user education is impossible. No matter how stringent the password policy is, they just write them down. People leave unencrypted laptops on trains with company data on them. It's just not possible to get them to care, full stop. They could be working with top secret nuclear weapons designs and it would mean nothing to them.
Of these two, I think the first is the hardest to overcome. Once a company or government agency has given up control of its IT environment to a company that needs to squeeze every nickel out of a contract, nothing difficult will get done. If an organization retains some sort of control and mandates change, it can be done at least to some degree. Look at how the attack on Target was carried out -- the group responsible figured out that the outsourced HVAC repair company had a connection to the store network, which (idiotically,) the POS systems were also directly attached to. So by the time the outsourced IT services team figured out they had a problem, it was too late. This is what leads companies to delay things like patching and updates to equipment, because the process is too painful when dealing with the 25 third parties you have to line up for such a change.
Some just don't know it...
> You also seem to think that the U.S. is the prime embodiment of justice, innocence and conduct,
Where do you see any of that? You might note that the only thing I said about the US is that they don't respond to cyberattacks the same way they respond to physical attacks. You seem to be smoking something pretty strong that gives you textual hallucinations any time an expert disagrees with your guess.
> Your analogy with the safe and saw is lacking of understanding of the topic.
Let's look at your CVEs and mine and see who is lacking understanding of the topic. Oh, your name isn't on any CVEs? Okay, we'll compare kernel contributions. Whoever is mentioned most in the kernel changelog probably knows a little something about what they're talking about. Oh, not a contributor, are you? Maybe a different metric - the security system I wrote only protects about 34,000 ecommerce sites. If yours protects more, you win.
Maybe it's time for FedGov to build their own Internet that is intentionally incompatible with the foundational building blocks of the Internet (except at well-controlled, secure interface conversion gateways).
What's the correlation between being on the current State Department shitlist and getting accused of 'hacking'?