Slashdot Log In
Extent of Government Computers Infected By Bots Uncertain
Posted by
Zonk
on Fri Oct 06, 2006 08:54 AM
from the they're-looking-into-it dept.
from the they're-looking-into-it dept.
Krishna Dagli writes to mention findings by the company Trend Micro on the extent of bot infection in U.S. Government computers. The article by Information Week indicates that, while the 'original' findings were much harsher, the security vendor has since backed down from some of its claims. Still, the extent to which information-stealing software has penetrated our national infrastructure is enough to take note. From the article: "While it may be tempting to discount the warnings of security vendors as self serving--bot fever means more business for Trend Micro--there's unanimity about the growing risk of cybercrime. In its list of the top 10 computer security developments to watch for in 2007, released last week, the SANS Institute warns that targeted attacks will become more prevalent, particularly against government agencies. 'Targeted cyber attacks by nation states against U.S. government systems over the past three years have been enormously successful, demonstrating the failure of federal cyber security activities,' SANS director of research Alan Paller says in an e-mail. 'Other antagonistic nations and terrorist groups, aware of the vulnerabilities, will radically expand the number of attacks.'"
Related Stories
[+]
Technology: U.S. Government Crippled by Sex, Gaming Sites 283 comments
BobB writes "The U.S. Department of the Interior's inspector general has released a report that says department employees are wasting their taxpayer-funded work time going to prohibited web sites. Some of these sites relate to sex, computer games, gambling and auctions. The study found that almost $2 billion a year in productivity was being lost to these 'excessive indulgences.'" From the article: "Computer-use logs revealed more than 4,732 entries relating to sexually explicit Web sites and gambling sites. Some computers accessed sex sites for 30 to 60 minutes during the test period. More than 1 million log entries were discovered indicating 7,763 Department computer users spent 2,004-plus hours accessing game and auction sites. Extrapolated over the year, that could account for 100,000 lost work hours. Put another way, this would equal 50 full-time employees doing nothing but surfing online game and auction sites."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
No Problem... (Score:2, Funny)
Why, that means (Score:4, Insightful)
Re: (Score:3, Insightful)
Daily.
Wouldn't it be fitting... (Score:2)
Re: (Score:2, Insightful)
Granny != Uncle Sam (Score:3, Interesting)
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
Neither is yours.
I work for a Federal agency (see my post below) and we have a large number of skilled IT workers (some as contractors, some as Feds) that diligently keep our network up, running, as as safe as several million dollars a year can manage.
For your (and the parent poster's) information, it is not as easy to manage millions of computers spread over the entire globe and keep them as safe as your granny's PC. If you t
Re: (Score:3, Interesting)
The US government is a large, diverse entity with over a million people working for it in places all over the world. It takes a lot of money to make it work, and as with any government, that money has to be coerced out of the population by law; You don't pay for services, mostly, as you would from, say, your local air conditioning service company.
In a lot of ways, I agree that many of the people, especially in Congress, fit your characterization, as do a few government man
Re: (Score:3, Funny)
Bots accounting for questionable browser habits (Score:3, Insightful)
It's the bureaucracy that's the biggest problem (Score:5, Insightful)
-Eric
And Yet Still Windows (Score:5, Insightful)
Re: (Score:3, Interesting)
Government IT jobs are some of the lowest paying and have the absolutely lowest job satisfaction. Government does not want idea people, they want people that will do what they are told without question.
I know, I was there. Started my career as a Government IT employee. Hated it badly, and could not stand the supervisor that knew nothing about IT yet constantly micromanaged us, even telling us to do things that are insane-wrong t
Re: (Score:3, Insightful)
That may be an aggravating factor, but it's definitely not the main problem. Windows' biggest problem isn't just that it's proprietary software -- it's that it just plain sucks even within the realm of proprietary software. It's the one platform where
It's just the Patriot Act (Score:2, Interesting)
Budget cutbacks and incompetence (Score:5, Insightful)
Anyways, under their watch we had numerous security breaches. One of our servers was hosting a child porn collection and IRC channel. Another server had been crippled by viruses, and we had seen other signs of intrusion time after time. The child porn server was confiscated by the FBI when they tracked it down. They returned the server to the DOA when they had finished so that the DOA could learn from the breach and correct the security issue, but there was no one employed with the DOA who could identify the failure or what to do about it.
Anyways, my rough guess is that given what I've seen of state networks, I would think they are heavily botnetted. The other side of the public sector though, atleast the Marine Corps network, is a pretty impressive setup. I've seen those guys in action and I would be extremely suprised if there is a lick of traffic that escapes their pipes with out their express knowledge.
-Rick
Re: (Score:3, Funny)
I'm terrible with conversions, but isn't 1 lick approximately equal to 142 bytes?
Re:Don't bet on it (Score:4, Interesting)
Another notable environment I saw was one of the Office buildings in Quantico, VA. Each new building for the most part had it's own network design team that would configure the building prior to people moving in, and they would design and configure everything. Once the regular staff showed up, the design team would hand off control of the network to the local IT department. The guys at the Marsh Center had this down to a science. When I left Quantico, the only thing those networks would get out of their chairs for was to clear a printer jam or replace failed hardware. Everything else was locked down, automated, network pushed, and other whys control remotely. A truly beautiful environment for both the IT support team, and us developers.
-Rick
Parent
this takes $$$ time and energy (Score:4, Informative)
My agency uses a multi layered defense to protect us against these issues. There are network level protections, PC level protections and desk-side support level protections. We also regularly send out warnings about current threats as well as require personnel to undergo annual IT security awareness training.
Individual PCs that are found to be broadcasting unknown signals to unknown or unverifiable outside destinations are removed from the network and reimaged immediately.
If, from a complaint to the help line, we find that a PC is infected with spyware, we don't even try to remove it; it is immediately reimaged.
We have instituted a locked down desktop policy; users are NOT allowed admin access except through application to a special committee for good business cases, based upon the use of special software that requires such access to run. We bend over backwards to alter those situations to avoid that access whenever possible.
Laptops are imaged using an image that is encrypted using a good encryption program that encrypts the entire hard drive using a 512 bit key, and NO laptops are allowed to be bought without going through our recieving process where that image is installed.
We have spent millions of dollars of your tax money in the last five years bringing this system online, but now that we have, we believe that we have as safe a system that we can get without just unplugging it or spending twice as much.
We don't have classified material, but we do have information that is confidential by law and must be protected from public release. (proprietary information belonging to firms we regulate.) This limits the measures we need to use, since classified material requires a completely different level of protection.
If the VA had used a system like ours, they would never have been embarrassed by the recent theft. The theft may still have occurred, but the information would never have been at risk.
It is not a perfect system, and it takes constant dilligence to maintain and periodically upgrade, but I think we do a pretty good job.
Headline &/or summary should say WINDOWS (Score:2)
If it had been a Linux problem, the headline would have shouted it. Let's give Windows headline credit for its main features: Insecurity and wasted time and money.
Speaking of which (Score:3, Interesting)
Hard Break: Simple Solution (Score:2)
Okay ... tie this to the porn and gambling article (Score:2)
The observed porn and gambling surfing by govt employees becomes a national security risk.
Re: (Score:2)
I suspect those non-military, non-law-enforcement agencies are the biggest offenders of lax network security.