U.S. Agencies Earn "D" For Computer Security 302
Fighting.Cephalopod writes "For the fourth year in a row, most federal agencies have received low grades for failing to protect their computer networks from hackers and other cyberterrorists, according to a computer security report card issued today by the House Government Reform Subcommittee on Technology."
Other readers point out coverage of the report at ZDnet, Reuters (via Forbes), The Washington Post, and ComputerWorld." As
mr. don't points out, the agencies receiving an actual failing grade are "the U.S. Department of Justice, as well as the departments of Energy, Health and Human Services, Interior, Agriculture, Housing and Urban Development, and State."
How did (Score:5, Interesting)
Re:How did (Score:5, Informative)
Daniel
Re:How did (Score:5, Informative)
See quote from article.
The Department of Homeland Security was one of eight agencies that received a grade of F for its network security efforts.
Davak
Correlation - unsat supplier -> unsat security (Score:2, Informative)
I suppose there's a correlation [cnn.com] there somehow [govexec.com]. An unsatisfactory supplier leads to unsatisfactory security. Choose products more carefully next time.
It's not like there wasn't a warning [internetwk.com] ... for the last 10 years.
Re:How did (Score:5, Funny)
Update (Score:5, Funny)
The problem has been traced to kindergarten hackers and has been fixed. Please disregard the following terror-alert color codes:
Brick Red
Flesh
Lemon Yellow
Prussian Blue
Spring Green
Sincerely,
Homeland Security
Re:Update (Score:3, Funny)
Re:How did (Score:3, Funny)
Re:How did (Score:5, Interesting)
Either we've got a bunch of idiots for IT guys in the government, or they're bright guys who are battling the bureaucracy and losing. Personally, I think it's somewhere in the middle.
Re:How did (Score:5, Funny)
There's a centre built for it, somewhere in Cuba.
Re:How did (Score:2, Funny)
Re: How did (Score:2, Interesting)
Re:How did (Score:4, Interesting)
The problem as I see it from the ZDNet article is that secretaries and such have unsecured linux/windows/etc machines sitting under a desk running some support application. Nobody really cares enough to secure it (if they even know it exists).
Re:How did (Score:3, Interesting)
That's wishful thinking on your part. The point of the review is to review all systems.
If they can't even identify and inventory
Comment removed (Score:5, Interesting)
Re:How did (Score:5, Interesting)
If they're so completely ineffective at one of the most fundamental tasks they've been assigned, maybe they'll be ineffective at further eroding our civil rights.
They got off to a bad start much earlier, when they created the department, named it, and put Ridge in charge. Apparently he is well atuned to the media though...
I was going to pull out some quotes, but the fact that it came out 6 days before their 'F' says quite a bit already.
Re:How did (Score:5, Insightful)
I think you nailed it on the head. I work at a large company that is very bureaucratic and it is absolutely soul crushing. No matter what you want to do or what needs to be done, there is always someone who will undermined you, attack you or make you jump through hoops. You can gain ground, but you will never win.
I completely understand why government agencies never have good computer systems or security. It is just not possible.
Re:How did (Score:3, Interesting)
It's a political game. You gotta play it to get ahead or get things changed.
(It really wasn't as bad as it sounds. I'm not a bad person, I don't think.)
Bad person, probably not (Score:3, Interesting)
I have worked in several different companies in the IT field from small to very large. One trend that I have noticed is that a knowledgable "technical" manager is a rarity. Some may argue that this is not true, I apologize to those managers that are 'actually' hands on at least a little with their admins. I have been lucky and have had a couple of these rare species, to learn from
From what I have seen, most ma
No, best bosses are not technical! (Score:3, Insightful)
The best boss I ever had was not technical. He had only technical people working for him, and understood enough of the technology that his nods weren't trying to stay away. What he did though wasn't understand the technology, he translated the technical talk into managerese, and vise versa. He made sure we got the resources we needed, work to do, fair raises, and most of the time wasn't in our way.
Technical managers are better than average, but they suffer from wanting to be engineers. So they try to f
Re:How did (Score:2)
Consistent with this idea is the possibility that the top dogs want it to appear that the people in charge of security are largely inept. That could provide the "evidence" for demanding more fundage from the Administration. Just look at the so-called war on drugs....
Please remember: Just because I might sound para
Re:How did (Score:3, Informative)
I'm a govt network admin... (Score:3, Insightful)
Not a federal govt IT guy, but I work for a state govt organization. The bureaucracy is a BIG PROBLEM. My fellow IT workers and myself are definitely not complete idiots. If we had our way, we'd ditch all the unsecure technology (i.e. MS stuff) in a heartbeat. The problem centers around our upper management *ordering* us to
Re:I'm a govt network admin... (Score:5, Interesting)
I wanted to replace TELNET access with SSH to our most important server (manages all budgets, accounting, payroll, and also contains a LOT of data that would be considered a privacy breach if released.) I was informed that this could not be done because a hand full of people use an app from the vendor which requires telnet access to work. This server is on a LAN which is accessed by several hundred members of the public daily.
So I ran ettercap and showing how trivial it was to capture my boss's password and capture the whole telnet session including root password. I was again told that "Yeah, that is a risk, however, you still can't disable TELNET. It is required."
Of course, the right thing for my boss to have done would have been to pressure the vendor to move to SSH on their app. But that would have cost money after all. I couldn't even filter telnet from the public access systems because it was some of them which actually needed to run the application. In the end all I could do was send a memo detailing the risk to my boss so I could cover my own ass if something happened.
Re:I'm a govt network admin... (Score:5, Informative)
I was in a similar situation, and I modified the telnet daemon so that a password wasn't required and put the telnet app on a different port and tcp wrappered that port. Granted this wasn't financial info, but I could not have a plaintext password going to a mission critical system.
Re:How did (Score:5, Interesting)
The report would be much be much more creditable if an independent inspector general or analyst audited the agencies and probed their defences. Perhaps someone who knows can describe how the report is produced and how likely it is to be a meaningful assessment of real security,
I Fought the Idiots and the Idiots Won (Score:4, Insightful)
Patriot Act (Score:3, Interesting)
The sad thing is that instead of fixing these things, they go on and take away liberties from the citizens to prevent ' terrorism '. Patriot Act anyone? So, for their ineptitude, we lose our rights.
Re:How did (Score:3, Interesting)
A) Homeland Security E-mail is NOT encrypted and it is regularly sent to hotmail and other "webmail" based accounts. What IDIOT would allow that? (note: They are taking step to get rid of the webmail accounts)
B) The bunch of folks I've been working with in regards to other homeland security stuff don't know the difference between a passive and active FTP session.
I'm not saying they are all idiots... but toss a few idiots in with the PHBs and don't expect anything grace
Re:How did (Score:5, Funny)
Yeah, they're right on top of it.
Re:How did (Score:2, Informative)
govt IT (Score:5, Insightful)
I'm in a general research facility (nothing classified, etc.) with about 70 people, most of whom have one or more computers. We have 30% of one person's time as IT staff because our agency will not give us funding to hire anyone else. This person has little or no training in computer security. I worked as a unix sysadmin for a few years, and know more about the nuts & bolts of IT security than our IT person. Given the way the govt determines pay grade, we couldn't hire a compenent IT person even if we had the money, because we couldn't offer enough money.
Anyway, what this boils down to is that everyone is responsible for the security on their own computer. With no training, and no time allocated for doing so, since everyone has a full slate of tasks of their own (yes, despite being federal employees we do work pretty hard). My location doesn't have an enforced security policy, even on things so definitely hazardous as enforcing the use of antivirus, not using un-passworded windows shares, etc.
Even worse, the agency in question requires admin staff to use custom-written and obsolete administrative programs that won't run on an OS newer than Windows 98. The people dealing with payroll and personnel data have the least securable computers. Nice, no?
Our regional IT staff don't seem to have much formal security training, and have made some decisions I consider questionable. The agency IT staff have also done some odd things, like recently forcing us all to switch our email to GroupWise.
From my perspective, yes, we deserved our failing grade. It's primarily due to lack of support for creating and maintaining a coherent security policy. There's no substantive training, and very little awareness among the higher-ups of the needs of facilities like mine, where everyone has different technology requirements to perform their duties. The administrative legacy software issues don't help either.
just sign me... not admitting to anything.
Again, not a surprise (Score:5, Insightful)
Frankly, I wouldn't be surprised if the USG turns around and tries to pass additional "information security protection" legislation in response to this study, just like software vendors now do for reviewers. You can't say anything about USG systems under the rubric of anti-terrorism.
Sigh.
Re:Again, not a surprise (Score:5, Insightful)
What makes you think that its the fault of contractors? Nothing in the articles say this. In fact one of them blames internal, highlevel staff.
From the ZDNet article;
"We must get those at the very top, the decision makers, the ones accountable to the shareholders, the customers or the electorate, to recognize that lack of network security in an organization is a material weakness and one that deserves necessary resources and immediate action." "
Comment removed (Score:5, Interesting)
Re:Again, not a surprise (Score:5, Informative)
I have seen the contractor system work very well in the past... however, it took multiple redundant contractors to complete one system.
For example, we recently setup a system in a clinic that deals with medical records. One contractor brought in the boxes, networked them, and left. Then we brought in our security contractors that locked down the boxes as tight as possible. After that, we had our internal security guru try to pick apart their security... and they came back and corrected the problems they left.
The security guys are not the general installation guys.
Save your energy... and get seperate contractors.
Davak
Re: (Score:2)
Re:Again, not a surprise (Score:5, Interesting)
Now, should they have been canned? Absolutely. Were they? No. Is that the government's fault? Only partially, in the sense that the government didn't have any way of verifying whether the work we were doing met the standards they specified. Management at the government and at the contractor simply agreed that things looked good, and that was that.
Hence my comment.
Re:Again, not a surprise (Score:2)
Wait... so you KNEW that coders working on government contracts were failing to provide adequate implementations of required security measures?
While I'm not one to use the word "treason", if you failed to alert anyone to this behavior, that could certainly be construed as a failure to fulfill your civic duties.
Re:Again, not a surprise (Score:2, Interesting)
The government's responsibility in IT is project management - at least in the agency I work for. You wouldn't expect your CIO or any other manager to be 100% up to speed on latest IA trends - that's what we have contractors for. Government IT professionals make decisions based on input from the people who actually do the work.
I've worked both sides of the fence. I spent four years in this agency as a contractor heading up
Re:Again, not a surprise (Score:2)
Re:Again, not a surprise (Score:4, Informative)
But - when something falls outside the realm of normal IT operations the contractor can ask for more money - as an example we bought about a hundred firewalls to deploy to satellite offices. The contract we have with IT support staff allows X number of billable hours per job description. Installing and maintaining those firewalls was not factored into the contract so the contract was modified and IA staff increased by four people.
"This needs to be done" doesn't necessarily obligate the contractor. It does if it's part of the normal duties outlined in the contract, but if it exceeds time and materials outlined in the contract the contractor has the right to ask for more money.
Re:Again, not a surprise (Score:4, Interesting)
Frankly I'm not surprised. The whole "lowest bidder" framework is crap in most cases. Here is the process for building our last new school (from a tech standpoint anyhow) if anybody is intersted:
With the "lowest bidder" mentality, your specs better be PERFECT and include EVERY little detail on the setup and configuration. You can't assume ANYTHING. You had better include all the details or at least reference standards which do. The vendors who care to do a good job won't get the contract because they'll come in with a higher bid.
The ones who don't care usually win because they bid exactly what is in the specs... no more, no less. If there is a mistake, they'll build it with the mistake in place. If there is a security hole, guess what.. it goes into the system. And if you aren't writing the specs yourself, watch out. You might get an architech like we had who in one meeting finally admitted, "Well, I really don't know much about this computer cabling stuff."
Re:Again, not a surprise (Score:2, Informative)
Re:Again, not a surprise (Score:5, Informative)
Yes there are a lot of contractors and Government employees who don't have a clue. The bigger problem is what guidance is given to people who have to secure those systems (particularly Unix). All Information Assurance personnel want to hear is whether the machines are C2 or not (never mind TCSEC was declared dead March 11, 1999). And this only covers auditing, so they are concerned about trust, not security.
The last project I worked on we had to use the Defense Informations Systems Agency STIG as if it was the bible of Unix security. Here is the mentality of DISA, the Solaris section covered 2.5.1, the AIX section covered 4.3 (but not 5L) and for the most part only was concerned about auditing. Check it out for yourself at:
http://csrc.nist.gov/pcig/cig.htmlIf you have administrators who are limited by inept guidance, what do you expect!
Re:Again, not a surprise (Score:3, Insightful)
From my observations, I have conculded the following two reasons ,being responcible for security breaches in computer systems.
One:- Not knowing your priorities. Even if you hire the best security personels in the industry, If you don't know what is THE MOST important aspect of your business you want to guard, you are destined to be owned. People talk about security without implying what exactly are they securing, this leads to lots of holes in your security .
This leads to common mistakes li
Re:Again, not a surprise (Score:2, Interesting)
Being a federal employee and a sysadmin I expect the contractor to inform his government.
I just used the DoD Wireless STIG to draft an 802.11 policy for the agency I work for. It actually wasn't a bad piece of work :)
DISA is still trying to make 802.11 impossible in DoD - but we're working out the kinks now.
Re:Again, not a surprise (Score:5, Interesting)
There comes a point of accountability when contractors should stand up and say, "I won't do this project if you won't fund the proper security design issues."
You wouldn't knowingly make cuts that would effect whether a system actually operates or not. Security shouldn't be any different.
I have turned down jobs before when I knew that what they asked was completely at odds with the client's best interest. I told them that and they understood.
Equally should agencies and companies be held liable if they knowingly deploy a system that is fundamentally insecure in the interest of just "getting it done." A bank would be held liable if they left their front doors wide open and their vault unlocked overnight. Leaving security unconsidered in computer and software systems should be treated equally if not more harshly.
Re:Again, not a surprise (Score:2)
Not that this scenario is likely, but it _could_ happen. I would honestly laugh and then tell them they needed to find someone else willing to do something that was a monumentally bad idea.
Re:Again, not a surprise (Score:2, Informative)
Unfortunately measuring security is difficult. One may conduct an extensive (and expensive) study like this report card. Alternatively, most measure security by what *doesn't happen* (viz. successful attacks), which is insufficient.
Re:Again, not a surprise (Score:2)
This is not an issue with contractors or subcontractors. This is an issue of money, plane and simple, you try to hire enough personel.. buy the right equipment, when there is no money to do so.
We work with what we have, and do our best, until those people in the position to fund security departments better, security will always be adhoc
news alert: not shocking (Score:5, Insightful)
Actually its indifference. (Score:2)
Hold their jobs on the line, that is if you can get pass the miles of red tape and union rules.
A private organization could have their board taken to the cleaners by their stockholders, let alone various "Government" regulating bodies.
Remember, rules don't apply to those who enforce them.
let me get this straight (Score:5, Interesting)
so let me get this straight, if all those failed security provisions are hacked, you'd get:
1) hacked into the place that controls whether or not you go to prison(funny they're also the ones that investigate election fraud if I recall, I could be wrong, I'm Canadian)
2) hacked into the place that controls nuclear power plants
3) hacked into debt(identity theft) through the place that controls employment, etc...
4) hacked into the place that determines if there is war or not
(agriculture, interior, and "housing and urban development weren't good targets)
*notices how Canada doesn't announce that kind of thing, I think they're embarassed at how badly they do*
Re:let me get this straight (Score:4, Funny)
Phew!!! One shudders to think what would have happened if Saddam Hussein had known this back in March, "Operation Canadian freedom" ????
Re:let me get this straight (Score:5, Informative)
Actually, DHHS controls medicare and related programs, not unemployment. Unemployment details are left at the state level down here. Though if the IRS (part of the Treasury deparment) were hacked, you would get completely screwed. (DHHS is also the office of the Surgeon General, so maybe tobacco companies could use this to get a ringing endorsement.)
Also, the State Department controls things like visas, so hacking in there could be a step to getting into the country in the first place.
Hacking the Interior and Agriculture departments could be useful to get yourself some free money. They both have pretty large budgets for either grants or subsidies. I believe the Indian Bureau is part of the Interior, too, so maybe some random tribe could use it to get more money.
Housing and Urban Development gives money to poor people in the inner city, so someone could easily use them to embezzle obscene amounts of money.
The one I'm most scared of is the Department of Energy. They're responsible for keeping nuclear weapons from being smuggled into the country. If someone tried to float a nuke up the Chesapeake, for instance, the boys in the Energy Department have the tools to notice it and alert the Navy and Coast Guard. So getting root there means you can wave your fingers and tell everyone "this is not the tanker you're looking for."
Re:let me get this straight (Score:2)
It's unfair to say that any of these agencies "control" anything. They may establish macro-level policies, but it's not as if by hacking the Justice Dept. you can get a friend released from prison, or by hacking the Dept. of Energy you can initiate a core meltdown in one of the nation's (privately-owned) nuclear power plants.
Our government doesn't make all of our decisions for us. (Yet...?)
High Expectations. (Score:4, Insightful)
Here's the score and grade breakdown (Score:5, Informative)
AID 70.5 C-
Commerce72.5 C-
DOD* 65.5 D
Education77 C+
Energy 59.5 F
EPA 74.5 C
GSA 65 D
HHS 54 F
DHS 34 F
HUD 40 F
Interior43 F
Justice 55.5 F
Labor 86.5 B
NASA 60.5 D-
NRC 94.5 A
NSF 90.5 A-
OPM 61.5 D-
SBA 71 C-
SSA 88 B+
State 39.5 F
Transportation 69 D+
Treasury* 64 D
VA* 76.5 C
Government-wide Average 65 D
Re:Here's the score and grade breakdown (Score:5, Funny)
Re:Here's the score and grade breakdown (Score:2)
Re:Here's the score and grade breakdown (Score:3, Funny)
Re:Here's the score and grade breakdown (Score:5, Funny)
Re:Here's the score and grade breakdown (Score:3, Interesting)
Who's surprised that the department charged with protecting our nation's infrastructure got the lowest score?
Tell me again that government is the answer to all life's problems.
Re:Here's the score and grade breakdown (Score:3, Funny)
Who needs the Department of Agriculture anyway? It's not like crops will stop growing if the compuers are hacked, right?
As for the DOD getting a D, well it already has two D's so how much could a third D hurt?
The EPA got a C. So what if they are hacked. It's not like all of a sudden I can't see the mountains in California,
Re:Here's the score and grade breakdown (Score:5, Insightful)
NASA passed a directive over 5 years ago that all machines were to be behind a firewall, and that public webservers were to be accessed via proxies. In practice, a lot of servers stayed outside of the firewall and security procedures are often ignored.
Probably the worst cases are servers that are accessed by rsh (not ssh - just plain rsh) with
Why are skript kiddies so successful? Because their code is any good? Don't make me laugh. They're successful because the rules and regulations any organization needs to be successful are wantonly abused, preventing essential maintenance, often because reloading from backup tape is a cost that can be written off, whereas paying for decent security might hurt the balance sheet.
In the case of Government, cost is usually not the reason. Power politics, computer-illiterate officials and self-preservation are far more common. Hackers can be passed off as inevitable. Finding gross failures in the system, though - that would be embarassing and potentially fatal to a career.
It's time to wake up. It's time forn Government departments to realize that the rules are intended to promote security, by ensuring that buggy code is prevented from being used. The rules were never intended to impose buggy code! Nor were they intended to encourage faulty practices.
I do not consider it acceptable that an organization that has taken on the responsibility of running the country cannot be relied upon to even run a server properly. If you cannot be trusted with something minor, how can you be trusted with something major?
This will never happen, but I believe that any Government agency that scores below a "B" on any task that it performs should be relieved of that task. I would like to see something similar in the private sector, with shareholders actively enforcing high standards (and thereby raising the value of the stock) rather than relying on the price to magically rise of its own accord.
These are the kinds of standards an employee would be held to, for designated work. Why, then, should implicit work be held to a lesser standard?
Re:Here's the score and grade breakdown (Score:5, Funny)
NSF got A (Score:5, Insightful)
Possible reasons (Score:4, Interesting)
Look how much is spent on 'physical' security and you will see why. A Government agency that is physically attacked (eg bomb, chemical, bio) usually results in human casualties/lives...and is very hard to cover up.
Now look at attacks on computer security (eg cyber attacks, worms, compromised systems). A Government agency that is 'electronically' attacked 'APPEARS' to not result in human casualties/lives.
Notice I stressed the word 'appears' in my last comment. I say this because it may be the real situation OR it maybe we don't know as previous cases have been covered up...as it is easier for an organisation to cover up these types of attacks.
I'm surprised it wasn't an 'F' Overall (Score:3, Interesting)
Needless to say, this does not lend itself to a centralized, comprehensive security plan.
Sad.. (Score:5, Interesting)
Added Chairman Davis, "I'm deeply concerned that too many agencies have not yet responded to FISMA's requirements; for example, the fact that 79 percent of agencies don't even have accurate system inventories casts doubt over the entire reporting process."
I work in IT for a govt. agency here in Canada, and to not have an accurate inventory of our hardware is absolutely unthinkable. 79% of agencies having no idea where their systems are (and arent) is a recipe for disaster.
This whole thing reminds me of a couple of years back, when a CSIS (Canada's spy agency) agent went to an Ottawa Senators hockey game, leaving her laptop in her car, only to have it stolen when the car was broken into.
Ugh. (Score:3, Interesting)
here's how bad it is... (Score:5, Funny)
This report card was supposed to be classified.
Take it with a grain of salt (Score:2, Interesting)
Physical Access (Score:4, Informative)
Your security is only as strong as your weakest link
Rus
errata yadda yadda (Score:5, Informative)
Compsec... and they had so called mapped out plans for years now too... (NATIONAL PLAN FOR INFORMATION SYSTEMS PROTECTION EXECUTIVE SUMMARY [politrix.org]). One quote I will always remember is something to the extent of "the feds are good at carrying guns not locking down machines."
There are so many variables involved with government, that they are the ones shooting themselves in the foot. Considering if you're using a machine right, and you know it's insecure, if you took it upon yourself to fix it, you could be charged with a crime. Hell slightly off topic but look at what the gov did with the so called chaplain spy [cnn.com] (charged with downloading porn).
I'm sure gov's IT staff throughout the branches are overwhelmed with things, so it's a bit unfair to call them all clueless gimps or similar. However, and I will throw this out as a `story` someone stated they worked for a gov agency. Person stated the procedures for daily wipes to ensure things are wiped, etc., ... According to person he had never seen it done, because they never bothered with it.' Now imagine if one of these machines were thrown out and the machine had material on it that was highly sensitive. It happens more often than some think.
How long before a wakeup call? (Score:4, Insightful)
As an employee (Score:5, Informative)
In addition, those of you who sound surprised, try reading The Myth of Homeland Security by Marcus Ranum (here [amazon.com]. It is surprisingly accurate, and not just another 'chicken little' diatribe.
Re:As an employee (Score:2, Interesting)
Kyoya
Re:As an employee (Score:2)
Is it really the user? (Score:2)
Is that really user related in all cases, though? Or can it me MS products simply don't lend themselves of a deep level of understanding because of their bloat and sometimes deliberate seeming obfuscation of even the simplest tasks?
The PCs around my work regularly do wacky things for no reason anyone can fathom. Just people using them normally and no mucking about with anything sensitive, and sometimes
Link to the Actual Report Card (Score:5, Informative)
Bad? Yes. Surprise? No. (Score:3, Funny)
So, here's what we need: A government office that is responsible for the electronic welfare of the country. Not merely a minor department in some other place, but a significant entity of its own. It would be able to stop all these government technological blunders before they happen, being comprised of tech-savvy individuals. Or at least, it would have some people who specialized in the field. Yes, it may sound Orwellian, but it wouldn't be much more so than what we have now: Now, several government agencies work completely apart from one another to regulate electronics, and each government department is responsible for its own security. This would simply take this task out of the hands of the overworked and unknowledgable, and might actually boost those grades.
Re:Bad? Yes. Surprise? No. (Score:3, Insightful)
Orwellian isn't the only problem with that answer. I'll grant you, it's one of them.
If you notice a systemic problem, you should presume that there is a basic design flaw in the system. I'm sure that one could create models that would display similar characteristics, and then compare them to see what characteristics of the system cause the problems. What would fix them. And what the expectable side effects of the fix would be. This should be a proj
Terrorist threat. (Score:2)
Then I see this news.
I dont think people realize how big of a threat poor computer security can truly be. I hope that this is fixed before a "wakeup call."
Yikes.
Another computer "security" planted story (Score:2, Interesting)
Sure, non-locked hardware won't be illegal right away, but it'll get a lot more expensive when it isn't mass-produced because it can't run Longhorn.
Butting your head against a wall (Score:5, Insightful)
Winding Up for the Throw (Score:3, Interesting)
All of these security problems at Federal Agencies, with Blaster, Welchia, spam, "piracy" etc. are going into a big hopper, where they will be used as reasons to justify TCPA [cam.ac.uk], aka the Death of My Computer.
In a nutshell,
Yeah, right.Security is bad all around. (Score:2)
There's this nasty "kill the messenger" syndrome that makes (good) security specialists unpopular in corporations--and probably in the government as well. They are inevitably required to point out things that make other people look bad, and insecure managers are great at getting them
So here's how it worked for us (Score:5, Interesting)
So several years ago our Lab got handed an ultimatum that we had to come up with a security plan; our computing folks wrote up a proposal, it got sent back with issues needing clarification, there was another round, etc. This went on for about a year. Finally we get one of the drafts back, and we're told, in so many words, "this one's good, you have 6 months to have it in place".
So now we have 6 months to redo every system on site, with no added budget to do so and no relaxation of other goals. To have any appearance of complying we basically had to set up a system for granting exemptions where each system exempted had to present a timeline for when it would be completed, etc. So at the end of the 6 months we were able to say that everything was either under the security plan, or had an exemption on file saying when it would be under the plan, or how it would be put behind a firewall, etc.
But the real problem was that the proposal should have been met with discussion of a reasoned, planned schedule, and sufficient resources to implement it, rather than pretending a major security rework could be rolled out for free in 6 months. This goes all the way up to Congress, who passed this law about having agencies report on computer security, but so far as I know didn't designate any funds to pay anyone to do anything about it.
Bureaucracy is the reason (Score:5, Interesting)
This is an unwinnable war. (Score:2, Informative)
Why not see this as an opportunity to do good? (Score:3, Interesting)
Okay, I know, I know - - I'm the soft-hearted liberal who still thinks government does some good and stops some evil. Anyway, with such lousy marks coming out, why don't some of the Slashdot geniuses who are not yet employed go into consulting, get some security contracts, and make some dough while improving things for all of western society?
Just a thought . . .
On the other hand, we could just go on talking about how lousy the government is in every aspect and wait for the whole thing to implode like a cow patty.
The actual survey filled out... (Score:3, Funny)
Survey Questions
(1) Name of your government agency:
(2) Number of computers installed:
(3)Do any of your computers run Windows and/or other software from Microsoft?
Scoring: Use the following chart to score your agency's computer security:
Do NOT use Microsoft products: A.
Use Microsoft products: F.
Thank you for taking the time to fill out this survey.
Re:Grades (Score:3, Informative)
Re: (Score:2)
Re:This is no surprise! (Score:2)
However, to redo the systems right now, and have them made secure by professional people would probably cost even more, so... Not necessarily so. Trusted Solaris meets gov C2 security specs out of the box. It would cost a slight bit more as opposed to normal Solaris, but the TCO in the long run is better than using normal Solaris.
Security breaches are pretty rare because physical security people are everywhere in these places, (james bond stuff aside). Unsure of what's been going on nowadays since I sta
True to form, though, you have to say (Score:2, Insightful)
Welcome to the new America, where the "Forest Service" has finally completed its transformation into a lumber industry-owned and -operated body, the "Immigration and Naturalization Se
You keep using that word... (Score:5, Insightful)
You keep using that word... I do not think it means what you think it means...
Whatever you may think about the Department of Homeland Security, it has, in point of fact, the most honestly descriptive of almost any of the department names. That is to say, whether it does a good job or not, it is here to secure the American homeland.
Now, if you want to talk about `Orwellian' names, meaning names like 1984's Ministry of Truth (which handled propaganda), Ministry of Peace (which handled war), and Ministry of Love (which handled torture and brainwashing), let's look at some of the big social-program departments which you seem more fond of:
- The Department of Agriculture -- which pays farmers not to grow crops
- The Department of the Interior -- which mainly handles subsidies for Indian casinos
- The Department of Labor -- which pays the unemployed not to work
just to pick a few examples.Of course, since the rest of your post is at least as confused as your use of the work ``Orwellian'', right down to your last example (the `Peacemaker', of course, was a famous Colt firearm, as used by the sherrif in just about any old western -- though if you want to wax philosophical, even Gorbachev has admitted that it was the inability to keep up with American defense spending that brought about the Soviet Union's collapse, so the missile made peace in a very literal sense as well), and the general tendentiousness of your claims shows that your looking for political points more than accuracy anyhow...
Re:The test is biased!!! (Score:3, Interesting)
We can't have this much failure in the US Govenment!!!
These security grades are obviously created by the MAN to keep their security grades up while making everybody else look BAAAAAAD.
We need a newer test that encompases more to make it fair. I sugues we measure the following to determine if their security grades.
Are their packet-filter inclusive?
Do they secure Appletack, Tokenring or just Ethernet?
To the set aside special days and allow special packets in?
To they support 2 letter passwords, and not just