Slashdot Mirror
Report: DHS Failing On Cybersecurity
chicksdaddy writes: It's always interesting to listen to what politicians say on their way out of office — after the pressure to get re-elected and say "on message" has been lifted. Eisenhower's historic farewell address in 1961 warned Americans about the influence of the Military-Industrial Complex. Twenty years later, Jimmy Carter warned of the distorting influence of "single-issue groups and special interest organizations" on the political process. And, this week, outgoing Sen. Tom Coburn (R-OK) used his final days in office to issue a blistering report on the Department of Homeland Security. Coburn argued that DHS was failing on each of its five, critical missions, among them: cyber security.
The report, "A Review of the Department of Homeland Security's Missions and Performance (PDF)," was released on Saturday. In it, the outgoing Senator said that DHS's strategy and programs "are unlikely to protect us from the adversaries that pose the greatest cybersecurity threat."
Despite spending $700 million annually on a range of cybersecurity programs, Coburn said it is hard to know whether the Department's efforts to assist the private sector in identifying, mitigating or remediating cyber incidents provide "significant value" or are worth the expense. DHS programs are still heavily weighted towards software vulnerability mitigation, Coburn says, an activity that "will not protect the nation from the most sophisticated attacks and cybersecurity threats."
The report, "A Review of the Department of Homeland Security's Missions and Performance (PDF)," was released on Saturday. In it, the outgoing Senator said that DHS's strategy and programs "are unlikely to protect us from the adversaries that pose the greatest cybersecurity threat."
Despite spending $700 million annually on a range of cybersecurity programs, Coburn said it is hard to know whether the Department's efforts to assist the private sector in identifying, mitigating or remediating cyber incidents provide "significant value" or are worth the expense. DHS programs are still heavily weighted towards software vulnerability mitigation, Coburn says, an activity that "will not protect the nation from the most sophisticated attacks and cybersecurity threats."
It's doing exactly what it was intended to do: bilk appropriations to well connected people and Corporations in the name of National Security. If anyone EVER thought it was something other than that, they're far too naive for the present reality!
I would believe this more if it weren't coming from Tom Coburn.
This is the agency responsible for helping to militarize our civilian law enforcement, full-body nudie scanners and the 100-mile 'Constitution Free Zone.' Mission Accomplished
Just ask the NSA on how good we are at spying on ourselves. But we seem to be looking at ourselves as the biggest threats when in fact our enemies have been accruing more and more technology and intelligence to attack what would hurt the US the most, commerce. People have said for decades that the US is too cozy with China and that makes us vulnerable. The US used to make almost everything it consumed in commerce and now we have lost that edge and even in technology and its security we seem destine to ignore the gorilla in the room. DHS is another waste of a government agency, created by politicians to sooth the American people. We have a military, CIA, FBI, Boarder Patrol, Local and State Police, National Guard, Coast Guard, and other well oiled national defense organizations. Did we need a Department of Homeland Security? NO. What we needed was to beef up our long standing defenses and make offensive moves to thwart attacks. Let's not be stupid and wait for our homeland to be attacked. Let's make sure they won't attack us by using measured attacks, be it electronic, physical, or restrictions to make sure we are protected. Another agency we did not need.
Take a bunch of overly bureaucratic organizations that have needed weeding out for decades, create a huge new bureaucracy to oversee them all, and WTF can you expect?
// Homeland security never made any sense to me
/// I vote Republican prolly 70% of the time
/ Bush was the worst president in my 50+ year lifetime
People fail to realize that if it wasn't for the Department of Homeland Security, Al Qaeda would be flying airplanes into buildings every single day. Mind you, I wouldn't shed a tear if a million white people died, but just think of all the African-Americans that the DHS is protecting. God bless the DHS.
The *LAST* thing we need is DHS thinking that they know security better than computer professionals. This article is just an invitation to get DHS to install "protection" software onto our PCs, or otherwise screw up the internet.
Why does anybody care what a 66-year-old doctor from Wyoming thinks about information security?
The report criticizes the DHS as ineffective at "cybersecurity" because of.. zero days or something.
It's clear that neither Coburn, nor the author of the report, understands infosec or how it is different from kinetic war. You can't amass troops or use force. It's very difficult to even know who attacked you.
You can do something like building defensive lines, but that's exactly what the report criticizes.
You won't normally find me talking about the federal government being very effective at anything, but they have done some things right with cyber security. For example, their series of free online classes covering cyber security is much better than I would have expected.
Of course they did contract that out to a STATE agency, and a rather unique one that whose budget process and operations is more like a private business - if people don't like the product (the classes), the agency doesn't get paid. So maybe I can acknowledge the good results without it being political heresy. :)
Disclaimer - I work nearby the cyber security program that made the classes, so I may not be objective. Then again, I don't praise most people I work with. I was expecting the classes to not be very good, and I was genuinely surprised at how good they are.
Typical politician - his comments could be interpreted to mean almost anything. The effort is wasted. We're not doing enough. Who knows?
Is that pretty standard? Doesn't that like rule out like 46% of the population or some such? Shouldn't he have instead began the report with "Dear Voter"?
That would be the Defense Security Service.
The Department of Homeland Security is about physical security.
"Senator arguing that DHSâ(TM)s $700 million cybersecurity budget could better be spent elsewhere."
A $700 million budget alone is evidence that they are way off target. The mission should be fairly narrow and focused and require only relatively small staff. The private sector does fine in most security area's. They just need to fill the gaps that are outside the scope of the private sector. Pick 8-10 real priorities do those really well and just cut everything else. Considering the FBI/NSA isn't even part of their budget, $700 million is just obscene. What exactly do they need to do that couldn't be done with a staff of two or three hundred good people and a $150-$200 million budget? WTF
Even a stopped clock is right twice a day.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
What talented coder in his right mind would want to work for the government ? Its not that the government is bad, but the working environment the government mentality creates would be utterly soul-crushing.
DHS follows the FISMA model, which means they utilize the NIST Special Publications 800 series for IT governance and security. In particular, the NIST SP800-53 controls are the best I've ever seen in my 15+ year cybersecurity career. If you put the time and effort into assuring your systems and policies meets these controls, and follow the additional guidelines for continuous monitoring, you're going to be about as safe as anyone can be.
The operative phrase is "put the time and effort into assuring your systems and policies meet these controls."
That seems to be where DHS is falling short, according to the cited reports. The tools and knowledge are there, but they're useless if not applied & overseen.
Everytime the word "Homeland" is used, we should post reminders of how eerily familiar these Sophistries are to Hitler's own:
Motherland, homeland, fatherland terrorism, terror cells. None of this shit is new. The communists did it too.
Liberty.
I wonder if this $700million helps float the IT budgets of some corporations...
It's not hard to imagine a company firing most of its IT staff because it can claim "Security Stamps" from the DHS.
So DHS pretty much exemplifies all that is wrong with our government. And I think Sen Coburn is dead on on because DHS can do little to protect us from sophisticated cyber attacks. But he's right to the sense of a stopped clock is correct every so many hours sort of way.
Vulnerability mitigation is part of a successful hardening of our IT infrastructure. Replacing Windows with Linux on workstations, telnet with ssh, wireless with wire... this stuff does make cyber crime harder and thus does have a preventative effect. Not sure what $700million buys anymore after government porking up, probably a fancy presentation or two on using good passwords from MBAs at a long time defense contractor... but it is not going to stop state sponsered cyber attacks. The only way to stop cyber attacks is to unplug from the rest of the world. But the hardening thing it does make a difference just like replacing hardware, patching system, running backups and testing backups. Deterrence on the other hand won't stop anything.
In it, the outgoing Senator said that DHS's strategy and programs "are unlikely to protect us from the adversaries that pose the greatest cybersecurity threat."
DUH! DHS and the NSA are the greatest threats to American cybersecurity.
I'm an American. I love this country and the freedoms that we used to have.
Every time I hear bureaucrats rumbling about "cyber security" only thing that comes to mind are schemes to legalize spying "for our own good" ... Still seeing politicians getting airtime rambling about legislation to indemnify corporations for "sharing" information with the government not letting the Sony opportunity go to waste.
The military industrial complex has countless billions of dollars at its disposal and the only constructive thing I've seen out if it is US-CERT mailing list which for the most part delivers very little we didn't hear somewhere else first.
Most everything from what I have heard and seen from DHSs own website is structured for defense after the fact or screwing around with ridiculous hacker wargames as if cyberspace was somehow meaningfully analogous to meatspace.
They have all of the open source code, they have Microsoft source code, they can probably get source code from others if they asked nicely enough... They could use some of their money to find and plug holes before everyone gets owned or fund R&D efforts to improve the state of security technology... instead it is all reactionary masturbation.
You fail my test, everytime, "Forrest" -> http://slashdot.org/comments.p...
APK
obscure, poorly-defined, well-funded, with no vested constituency. what could possibly go wrong.
"the outgoing Senator said that DHS's strategy and programs "are unlikely to protect us from the adversaries that pose the greatest cybersecurity threat." By that he means American civilians pose the greatest threat, right?
Nothing to see.
Hold on... I work in the private sector in info sec. DHS is nominally spending $700M annually on trying to provide value for the private sector? Huh? DHS doesn't provide value for anyone, as far as I know, much less the private sector. What kind of hallucinatory BS is this?
The thing is, the task of the Department for State Security (their true designation) is not tasked with protecting any citizens or cooperations. Their task is to protect the state and its bureaucracy, by funneling billions of dollars to people with the "right" beliefs. And, as the budget numbers show, they are not failing at that at all.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.