Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

U.S. Gov't Sponsors InfoSec Defense Training 115

Posted by timothy from the good-bennies dept.
Anomolous Cow Herd writes: "CNN is reporting that the U.S. government is awarding scholarships to a select few computer science students to study information security, with the caveat that they must agree to work for a government agency for at least two years afterwards. This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority. Considering that a vast majority of government agencies run on Windows NT and derivatives, it's no wonder that they consider the eventual graduating class of 180 'doesn't have a chance.'"
This discussion has been archived. No new comments can be posted.

U.S. Gov't Sponsors InfoSec Defense Training More

U.S. Gov't Sponsors InfoSec Defense Training

Comments Filter:

  • The fact is (Score:1, Troll)

    by WildBeast ( 189336 )
    that usually, many of the most brilliant people aren't that interested in school.

    • Re:The fact is (Score:5, Insightful)

      by TheAJofOZ ( 215260 ) <adrian@symphonio[ ]net ['us.' in gap]> on Monday April 01, 2002 @07:19AM (#3264994) Homepage Journal
      that usually, many of the most brilliant people aren't that interested in school.

      On what basis do you make that statement? The most brilliant people almost always look for intellectual challenges and you are much more likely to find those challenges in an academic setting (because that's the point of them). Certainly some very intelligent people burn out and drop out of school but they generally do not live up to their potential intellectually, despite the fact that they may well have a much more satisfying life.

      In reality, most of the really brilliant people in this world are professors in universities (note that the reverse is not nessecarily true however).

      • Uh.. depends on your definition of "really brilliant". It reminds me of that popular example used for learning string manipulation: "If you're so smart, why aren't you rich like Bill Gates?"

        Cheers,
        Jake
        • Whatever the hell sates this greed of money, this implacable goal for power is far different than that which you get if you are for instance scientifically curious or motivated intellectually in the slightest. Bad scientists do it for the their own ego and the awe that laymen and lesser scientists percieve them with. Good scientists do it for something far more noble, the progress of one human against the great unknown with the knowledge that all is surmountable, this is the benchmark for all human progress not dollar bills.
    • I'd support this hypothesis. Where I go to college, the smartest people are bored out of their minds with their schoolwork because it's just so easy for them.

      Even I find the work to be too simple. Once, I skipped six consecutive weeks of a philosophy class and ended up with a B+.

      I think that this is less of a problem with IT, but the problem exists, even in reputable colleges.

      Steve
      • Your post reminds me of what I read in Bill Gates' biography (Hard Drive). Himself and others at Harvard would skip class all semester, and then spend the weekend before finals reading the book and studying to see who could get the best grade without ever going to class. I think he still did pretty good too.
        • When I was in college, I found that the overall grade for a course was usually about 50% exams and 50% coursework. The coursework usually invovled applying some basic elements of the class that were usually identifiable from the syllabus or the first day's class outline lecture.

          The exams were usually well over 80% based on the course lectures, which tended to be an overview of the reading. The better professors threw in some easy nuggets that were never discussed in class, only in the readings. The weaker ones lectured basically the books plus some fill-in material, but the fill in was just glue to give the course some coherency.

          I found that I could ace most classes if I wrote an A paper and scored an A on the exam. The work it took to do this involved light reading of research material and great class notes. The actual assigned reading I generally just skimmed to make sure there was no great deviation from the lectures. I seldom if ever actually "read" it, except for literature assignments. Just going to class, writing notes and doing the paper was all it took.

          I discussed this with a friend who is a history professor and he said that undergrad land its pretty difficult to have significant test material on assigned readings without 2/3s of the class getting Ds or Fs -- even if he announces on day 1 that 50% of the exams will be taken exclusively from readings not lectured in class. He thinks its legit to do this, but hes gotten flak from department people who say its beyond the scope of the average undergrad to assimilate meaning from academic readings.

          I would assume at serious classes at high-end academic places like Harvard would have lectures that didn't cover the readings AND readings not included in the lectures, making it impossible (without notes from somebody who WAS there) to get more than C if you skipped lectures.

          At other schools (mine was a big 10 university), skipping lectures was suicide but skipping the reading was not.

    • Re:The fact is (Score:4, Insightful)

      by mgv ( 198488 ) <Nospam.01.slash2dot@ v e ltman.org> on Monday April 01, 2002 @07:49AM (#3265041) Homepage Journal
      that usually, many of the most brilliant people aren't that interested in school

      Certainly, some intelligent people don't get formally trained. Alot more do.

      There is much less correlation between brilliance in the academic success and commercial success - alot of bright people have relatively ordinary jobs. It depends on what they want out of life.

      So I don't think that this would deter all the prospective applicants for such a scheme, even though I would value my freedom more than that. Then again, I didn't really have any financial problems through Uni.

      If it gives people an opportunity that they might not otherwise get, 2 years of work isn't a bad deal.

      My 2c worth

      Michael
    • Notice he said most brilliant. He's not referring to the 1% between the top 98-99%, who end up becoming professors. He's talking about the 1% who are smarter than these nitwits and can't pass any of their droll classes because of it.

  • Could be worse. (Score:5, Insightful)

    by Anonymous Coward on Monday April 01, 2002 @06:39AM (#3264933)
    I'd rather see people get scholarships for IT security than for the ability to run fast with an oblong ball.
    • Of course the colleges don't sell tickets, banners, and sweatshirts based on their it scholarships.

    • Don't discount the athletic ability of the CyberCorps!

      At the University of Tulsa, we made it to the finals for Intramural Flag Football. However, I don't believe TU's real football team could handle writing an Intrusion Detection System for a Signalling System Seven telecom network. Check us out! [utulsa.edu]

    • Insightful? Good football players bring in millions of dollars to universities. For their efforts they receive scholarships worth a fraction of that, and you begrudge them even that? I know you spoiled rich kids can't stand that a black kid from a poor family could get a break once in awhile, but this is pathetic.

  • Good for Linux? (Score:3, Interesting)

    by SecretMethod70 ( 569755 ) on Monday April 01, 2002 @06:39AM (#3264934)
    Granted, the US government runs mainly under Windows systems, but if these students are getting good educations in computer security and are supposedly going to be an influential voice in what the government buys as far as new equipment and such, do you think this will help Linux to be used more in government? I think if this were to happen, it would, consequently, generate great PR among other copmanies that are concerned with keeping their information secure.
    • you make a good point- my school by far is drowning in windows machines, with the occasional sprinkle of imacs. there are, however, 2 linux labs, which are the only 2 labs the CS/IS classes use after freshman year.

      imagine if you will, this conversation,

      boss: "hey, the dataserver needs to be rebooted again- hey new guy, go do it."
      newguy: "um, why does it have to be rebooted?"
      boss: "because it blue-screened and I can't get PCAnywhere to work."
      newguy: "well, my college has an operating system that never needs to be rebooted- there's very little downtime."
      boss: "well, fill out the 100,000 pages of paperwork and we'll look into changing things- where you go to school again?"
      newguy: "berkeley."

      then, as the boss retires and the newguy becomes the boss, his personal prefrences come into play.
      Don't believe me? go look at your local server room- you can tell what the favorite server was of former IT managers like rings on a tree.... one person buys hp, the next dell, the next compaq, etc.....

    • Re:Good for Linux? (Score:4, Informative)

      by nathanm ( 12287 ) <nathanm&engineer,com> on Monday April 01, 2002 @12:02PM (#3265713)
      Granted, the US government runs mainly under Windows systems
      No they don't. Maybe for desktops, some workstations, a few file servers, and the occasional public web server, but the US govt uses lots of different systems. There are still many systems running on old proprietary mainframes, plenty of Novell (even as old as version 3) networks, and a whole lot of Unix systems.

      Also, all classified systems run only on Trusted operating systems and software, which meet criteria for a specific level in the Orange Book from the NSA. According to this [ncsc.mil], the latest version of Windows that was certified is NT 4.0 with SP 6a and the C2 update, in Nov 1999.

  • NT (Score:1, Funny)

    by mAIsE ( 548 )
    could NT
    would NT
    should NT

    even in severely depressed times in the tech industry security guys can get sh*t loads more money in the private sector.

    • Re:NT (Score:1)

      by forkboy ( 8644 )
      even in severely depressed times in the tech industry security guys can get sh*t loads more money in the private sector.

      That's true, if there are jobs available. In Denver, in the last, oh, 4 months or so, there have been MAYBE 6 or 7 security jobs posted on monster.com.

      After I got laid off and before I went back to school, (about 8 months ago) the last full time job I applied for had over 300 reasonably qualified resumes. In some markets, it's nearly impossible to find a job in IT (let alone security) unless you're willing to preclude your talents to Windows. As annoying as the .com boom was, damn there were some sweet jobs and plenty of them.

      Work in the corporate sector just blows now, it's back to the olden days of kissing your boss's ass to make sure you keep your job because now, even if you're quite talented, you're very expendable.

  • FYI: Free COMPSEC training materials on CD (Score:5, Informative)

    by Anonymous Coward on Monday April 01, 2002 @06:45AM (#3264946)
    You can request free computer security training information (mostly on CD) from DISA.

    http://iase.disa.mil/eta/index.html [disa.mil]

  • This is old news (Score:3, Interesting)

    by chiaroscuro03 ( 411728 ) on Monday April 01, 2002 @06:49AM (#3264954) Homepage
    Old news.

    http://www.wired.com/news/politics/0,1283,46567, 00 .html

    • WTF is Wired smoking these days? Why the heck is 60% of the story comprised of some kid's battle with liver cancer and another's dreams of becoming a golf champion?

      I mean, really.

  • Bash boy, bash (Score:3, Interesting)

    by Anonymous Coward on Monday April 01, 2002 @06:54AM (#3264959)
    Yeah, because if they were running some UNIX flavor, their systems would be more secure ah? Just subscibe to some security mailing lists and try to filter out Windows*/UNIX vulnerabilities/exploits.

    Quite amazingly you will realise that most of them are UNIX (vast majority Linux, then some HPUX/Solaris/IRIX).

    Not a flamebait, but really disguss me all these creeps that try to bash Microsoft at the first chance.

    Kisses.

    • There are plenty of security issues on any platform, sure. But they have a vastly different character. Typically unix alerts are about obscure bugs that haven't been exploited, but could be, and the patches to fix them are usually very quick. With MS, the problems are pretty major, often have already been exploited, and the fixes, if they ever arrive, at the very least are not timely.

    • Re:Bash boy, bash (Score:4, Interesting)

      by Biolo ( 25082 ) on Monday April 01, 2002 @07:52AM (#3265047)
      The difference is that all of the Linux/BSD exploits are out in the open, and a large percentage come from people looking at the source code and going "oops!".

      Whilst I know the "many-eyes" theory isn't as good as many people think, I'm sure that the average line of code in an open source app gets more eye time that the average line of code in a proprietary, closed source one, so we find a higher percentage of our security problems. Now, just what percentage of security issues do you think that Microsoft et al actually openly admit to? I don't think there have been more than a couple of occasions where microsoft has said, without someone sticking the proverbial gun in their back, hey - security issue, we fess up, come and get the fix. Do you believe they don't find many more? Sure they do, they either just ignore them or quietly fix them and slip it in a servicepack.

      Quite clearly you can't compare the numbers just by taking them at face value. Filter out all those with "theoretical exploits" for a start. Next, take out all the duplicates - a patch released by RedHat may be for an identical issue to one released by SuSE and Mandrake - how many times did you count it? One? Three? Or do you just look at one distro? Which one? The one with the most patches - maybe they're really good at looking for problems and putting out fixes, on the other hand maybe they really screwed up the original release. The one with the least patches? Probably not paying attention.

      Now a more interesting exercise would be to have a couple of groups of security experts sit down for a few months with the complete source of a recent Linux system and that of WinXP and tot up the number of security issues they can come up with. How about an independent study, draw up a set of rules, have MS put up 50% of the money and one (or more ) linux companies put up the other 50.

      • Re:Bash boy, bash (Score:4, Insightful)

        by dirk ( 87083 ) <dirk@one.net> on Monday April 01, 2002 @08:03AM (#3265062) Homepage
        The difference is that all of the Linux/BSD exploits are out in the open, and a large percentage come from people looking at the source code and going "oops!".

        Whilst I know the "many-eyes" theory isn't as good as many people think, I'm sure that the average line of code in an open source app gets more eye time that the average line of code in a proprietary, closed source one, so we find a higher percentage of our security problems. Now, just what percentage of security issues do you think that Microsoft et al actually openly admit to? I don't think there have been more than a couple of occasions where microsoft has said, without someone sticking the proverbial gun in their back, hey - security issue, we fess up, come and get the fix. Do you believe they don't find many more? Sure they do, they either just ignore them or quietly fix them and slip it in a servicepack.

        Actually, a large portion of security holes in MS software are fixed before there is an exploit. The problem is the few that aren't get lots of press, and people don't install the patches, and MS still gets the blame. The CodeRed worm is a perfect example. There was a patch available months before CodeRed was even heard of, put people didn't install it, and now everyone points to CodeRed as the perfect example of MS vulnerability.

        I'm not saying MS is perfect by any stretch, but check out how many security fixes they offer and compare it to the amount of tools for exploiting them. You'll find most holes are fixed before there is an exploit for them available.
        • Actually, a large portion of security holes in MS software are fixed before there is an exploit. The problem is the few that aren't get lots of press, and people don't install the patches, and MS still gets the blame.

          I think you are kind of missing the point. A lot of people forget that the script kiddie warez and IRC bots is just one form of security risk.

          We assert that open source has less total security flaws, because more are discovered by the general public.

          A major security hole, unknown to the general public, could be considered a weapon, of vast power. It would allow you to break in to your enemy's and competitors computers, stealing sensitive information, etc.

          It is impossible to know how many secret security holes there are in Windows, that people may be keeping under their hat. Look at eEye. They are a company that regularly finds major security holes, because they beat on windows constantly looking for them. I'm sure their core talent isn't more than one or two people.

          Suppose a blackhat version of eEye, with a couple or few adept people, banging on windows in every possible way. It's likely that such an orginization would have found many previously unknown security holes, and/or combinations of little holes that can lead to system compromise.

          With open source, it's more likely that people in the normal course of debugging their problems will find problems, such as the zlib issue. That was just someone trying to get his project working, and that led him to discover the error in zlib that could be a security hole.

          It's not the holes we know about that matter, it's the ones we don't.

        • Re:Bash boy, bash (Score:3, Interesting)

          by JordanH ( 75307 )
          • There was a patch available months before CodeRed was even heard of, put people didn't install it, and now everyone points to CodeRed as the perfect example of MS vulnerability.

          Yes! A perfect example. A perfect example of how difficult it is to keep up with the dizzying array of patches from Microsoft. Why, Microsoft [com.com] can't even do it. Gartner advised customers to ditch IIS exactly because you can't patch fast enough [gartner.com].

          Further, the Microsoft patches, available for a long time, cause other problems [secadministrator.com], and I quote:

          Speaking of patches, I've read a couple of recent posts on the Bugtraq mailing list that indicate a problem might exist with the Microsoft patch listed in bulletin MS01-033. A few people have reported that after they installed the patch, their systems remain immune to Code Red infection. However, when an infected system attempts to connect to their system to infect it, several IIS services (e.g., FTP, the default Web site, the administrative Web site, and the proxy service) stop processing.

          • a "few people" report that a problem "might exist"? That is your grand evidence?

            Funny how people bash Microsoft for both a) not releasing patches and b) releasing too many patches.
              • Funny how people bash Microsoft for both a) not releasing patches and b) releasing too many patches.

              Yes, well, there's obviously a problem with both a) and b). Under a) the problems don't get fixed. Under b) not even MS can keep up with the dizzying array of patches.

    • Just a few factors to take into account:

      1. There are more UNIX variants then Windows
      2. UNIX systems have been around longer, so there may be more because of this.
      3. Traditionally, in much of the UNIX community, security problems are well publicized.

      And there's always the claim that OpenBSD hasn't had a remote root exploit in two years is it? Can Windows claim this?

      And when you throw out the extra services, and just compare services that Windows systems and UNIX systems have in common, are there still as many vulnerabilities?

      Josh

      • OpenBSD (Score:1, Offtopic)

        by bleckywelcky ( 518520 )

        It's:

        Four years without a remote hole in the default install!

        Which is rather awesome for anyone just trying to mess around with BSD or get into the UNIX-variant world. You can just shove in a boot disk, set up your system, install with the default config, and you have an up and secure system. Just add some ip forwarding and whatnot and you already have a personal gateway/firewall for your household.
      • We should not ask whether UNIX is or is not more or less secure than Windows NT, we should ask whether a specific derivate of UNIX can be made more secure than Windows NT can be made.

        You are all mainly talking about application level security.

        How many exploits are there on Windows NT - for IIS, for LANServer, for other NT services, for hacking the registry?
        How many exploits are there for Linux - for Sendmail, for BIND, for telnet and even for SSH?
        You mentioned OpenBSD, so let's take some look at OpenBSD. Its DEFAULT install is secure.
        What about adding third-party software? What happens, when you've got Sendmail installed, and someone manages to hack uid 0 by exploiting some vulnerability in the Sendmail daemon?

        All of these exploits are application level vulnerabilities.
        The real problem with operating systems is, that they highly depend on application level security. Even OpenBSD is NOT really a secure Operating System - it's just a really secure software distribution.
        OSes themselves may not be vulnerable - but their highly privileged application make them vulnerable.

        However, for some derivates of Unix and specific setups of Unices, this is no longer true, while for Windows NT/2000/XP it is still true - and that is, why some Unices actually are more secure than NT, because their OS Kernels offer really strong security below the application level (user space).

        Did you ever take a look at Trusted Solaris, at AIX/CMW, or at Argus' Pitbull for Solaris or AIX?

        Sure, if some application is vulnerable to being exploited, it will still be vulnerable when running on one of these OSes - but it doesn't matter that much, because these Operating Systems are locked up from inside the OS kernel.
        On 'normal' Unices, you simply attack some process, which has root privileges, and all system security is gone because of root's omnipotent superuser privileges.
        On the OSes mentioned above, you do not run any process with root-like privileges, because you simply don't need to - instead, you've got a large set of privileges to allow some very specific privileged operations (like using a restricted port or changing the root directory), so what do you want to attack in order to get access to the Operating system itself?

        On an Argus-enhanced Solaris box, for example, Sendmail would be running in its own compartment and with the PV_ASN_PORT privilege in it's effective privilege set.
        If someone would successfully attack Sendmail, he/she would...
        a) ...be locked down into sendmail's compartment
        b) ...probably lose all of sendmails privileges when exec()'ing another binary, because the other binary does not have these privileges in its proxy privilege set
        c) ...not be able to access configuration files, because they are probably protected by an integrity label
        d) ...not be able to read secret information, because MAC's sensivity label would not allow it
        e) ...not be able to gain any further privileges, even if he/she could exploit highly privileges binaries, because these privileges are not in the session's limiting privilege set

        Provided that these Trusted Operating Systems are correctly configured, the only way to hack into one of them is to attack the OS kernel itself.

        So, how many exploits can you find for the Pitbull-enhanced AIX kernel?

        More information:
        Trusted Solaris [sun.com]
        Argus Systems [argus-systems.com]

        kind regards from Austria,
        octogen
    • Do you really think that I put that last sentence in there? Here's a hint: I didn't.

      Blame the editors.
  • two years and one month after the first class graduates a new consulting firm will be organized because these programers will realize that they can make 100 times as much by getting hired as outside consultants doing the same job. I don't think that in two years the government is going to get their moneys worth. Are they tring to make life time employees of the state? It won't work. On the plus side their will be a few happy students with scholarships
    • There is a problem with this? Beats chipping paint, drinking bad coffee, and long deployments in the Navy. The Man has been doing this for a long time; they'll get their money's worth out of these people, trust me. New recruits will probably be sitting on blocks of ice sharing a smoke break with a moose outside of some non-descript warehouse near Prudhoe Bay, Alaska.
    • That always happens to the government, retention is more difficult than recruiting, so it's just a cost of doing business.
      Of course just about the time they're due to get out, there will be a sexy must-have course that will make their lives perfect on the outside just for a four year commitment. Then it's I'm one third of the way to a cushy government pension at age 40 ... of course along the way you realize that the college kids today get the same training minus the obsolete stuff you still have to maintain so now you worry about competeing with them etc.
  • Couldn't tell whether this was supposed to be an April Fool's joke or not...
    • No, this is most certainly NOT an April Fools'.
    • This isn't an april fool's joke. I am currently one of the students applying for said scholarships, as my lowly school is one of the chosen few to receive money (IUP - Indiana University of Pennsylvania [iup.edu]) Apparently there are going to be approximately 10 people from my school receiving the scholarship, which is to consist of full tuition, a personal computer, room and board (possibly in one centralized location for all of the scholarship winners) and the aforementioned two year job (quite probably with the NSA, as to the best of my knowledge they are the main agency associated with this program). Applications are due at my school on friday, so this is already being implemented.

  • Application (Score:3, Funny)

    by Alsee ( 515537 ) on Monday April 01, 2002 @07:16AM (#3264988) Homepage
    Hi!

    My name is Osama Ben Logan and I would like to apply for a scholarship and two years employment managing computer security in a sensitive government facility.

    -

  • Motivation (Score:5, Interesting)

    by _Sprocket_ ( 42527 ) on Monday April 01, 2002 @07:45AM (#3265029)
    Oddly enough the submission reads:

    This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority.

    While the VERY FIRST PARAGRAPH of the article reads:

    Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts to guard against cyberterrorism.

    Ya know what? Other than putting some additional paranoia in the public (and management) mind, infosec has little to do with terrorism. Sure, the politicians like the run around screaming "digital pearl harbor" [newsbytes.com]. But the general state of most organizations' infosec stance has been in shambles well before 9/11. And those vulnerabilities mean that these organizations are much more likely to be attacked by a random attack-of-opportunity than a coordinated terrorist activity.


    And that includes the US Government. It might go especially for the US Government where "security" is usually dealt with a Cold War mentality. One that has little to do with the current state of information security. Instead, government agencies tend to rely heavily on prosecution (which kicks in well after the damage has been done). Change to this mindset is hampered by limited budgets which make hiring experts (or retaining anyone with the appropriate skillset) difficult. A couple years ago, the FBI even complained to congress that they could not attract experts in the field due to their uncompetative pay.


    So to wrap it all up. Government computer systems tend to make suprisingly easy targets. This program is part of the awakening and catch-up the government is undergoing on this issue. It has very little to do with terrorism and 9/11. And even the very article referred to states that.

    • Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts [...]

      Oh come on, do you really beleive that? Or that freenet, anonymizer and all the other anonimizing services abruptly invoked "pre-9/11" decisions to cut their services? And RSA/NAI dropping PGP?

      Jeez, I'm not wearing my tinfoil hat right now, but you must have your head burried 4 feet in the sand...
      • Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts [...]
        Oh come on, do you really beleive that?
        Since I heard about these scholarships two years ago, yup. And here [fcw.com] and here [cdt.org] are articles from two years ago about the program. I'm sure you can find enough references, from enough different sources, on your own to satisfy all but the most devoted conspiracy theorist that these weren't all planted recently.
    • Long before September 11 and last year's virus-like attacks over the Internet, the United States government announced plans to train an elite corps of computer security experts to guard against cyberterrorism.

      Yeesh -- the melodrama is overwhelming. Sounds like 13-year-old script kiddies wrote the article. Why do I suddenly have visions of "an elite corps" of acne-ridden guardians "against cyberterrorism" wearing black jumpsuits with a Nike logo stiched just above the US flag on the sleeve?

  • NSA (Score:4, Informative)

    by Loki_1929 ( 550940 ) on Monday April 01, 2002 @07:46AM (#3265032) Journal
    Just thought I'd point out that the NSA [nsa.gov] has been running similar programs [nsa.gov] for a while. I actually looked into them when I was in college, but then I realized I was looking at Big Brother and asking for a part in the book 1984... on the wrong side.

    On a lighter note, after hearing that Intel is trying to claim the word 'inside' as its own, [slashdot.org] I decided to do a little investigating as to exactly what is inside. Take a look. [slashdot.org]

    • The Secret Service also does similar programs. One of my floormates in college was under agreement with them (to combat counterfitting and wire fraud eventually)

  • CIA, etc (Score:3, Informative)

    by Alien54 ( 180860 ) on Monday April 01, 2002 @08:11AM (#3265075) Journal
    I seems to me that the CIA [cia.gov] had this sort of deal going for a while. I know that this sort of thing has been routine for the military for a long while.

    Here in the link, for example, to the CIA College Intern Page [cia.gov].

    so basically, sounds like non news item.

    Maybe these are the guys who bugged a student press office at Quaker Campus [radiofreenation.net] a while back? Although i mention this with a something of a tongue in cheek spirit, to be serious, that incident does seem to be more of a local job using radio shack parts.

    • From their benefits page [cia.gov]
      The George Bush Center for Intelligence has a campus-like atmosphere with lovely grounds and well designed work areas. Artwork and displays from around the world add extra interest to the busy day. The Agency has a casual dress policy when appropriate. Employees have a choice of a variety of foods in the modern Food Court or can arrange to have an elegant lunch in the Agency Dining Room. To keep in shape, employees have access to fully-equipped fitness facilities, a jogging track, and walking paths. A company store, recreational and activity clubs, access to entertainment tickets, and on-site dry cleaners, film processing and barber shop add to our employees' quality of life.
      The George Bush Center for Intelligence?

      Yes I know this is likely a research facility.

      Is this something like the search for Intelligent life in the Universe?

  • Cyber Security, Cyber Mashurity... (Score:4, Insightful)

    by Blasto.Net ( 570119 ) on Monday April 01, 2002 @08:28AM (#3265105) Homepage
    /start tangent

    Yes, I do believe some terrorists use this so called "interweb" to communicate. I do not believe we are going to be having cyber terrorists hacking into the pentagon. If they hack into it via the web, well, shame on them for even putting any sort of outside access.

    If a cyber terrorist hacks into our missile control system and has it launch missiles at ourselves, we deserve it, because if there is anyway for a terrorist to log onto the missile launch programs from their terrorist hide out we should be bombed for our stupidity.

    /end tangent
    • Here is something I thought of. One should never have classified and unclassified (or 2 different classification levels) data or processes on the same system. The risk of covert channels and leaks is way too high.

      Every system should have one and only one classification level.


      • This is the way it's traditionally done in the military. You either have access to something based on your security level (plus need-to-know, see below), or you don't. And if you don't, well, you're not getting it. When you join the military, they do a background check on you to assess what your level of clearance will be. If you get a security clearance, it will be one of Secret, Confidential, and something else. ("something else" being the highest) If they decide you may be worthy of Confidential and above, the background check gets more in-depth; one friend of mine mentioned that the military interviewed his family, friends, and even high school teachers. Scary shite. Once you are assigned a clearance, it can never be increased (unless there is a very good reason). But your clearance can (and routinely is) taken away completely for something like a DUI.

        Need-to-know: Despite what Hollywood will tell you, just having the right clearance is not enough to gain access to something that is classified. You also need a reason to have access to it, which normally comes in the form of the approval of a superior.

        Wow, I just rambled a lot.

  • ROTC (Score:2)

    by redelm ( 54142 )
    This is conceptually identical to the Army/Navy ROTC program, replacing military discipline/law with serious non-disclosure "official secrets" obligations.

    • Not quite, it seems this program is just a scholarship to pay for a Master's degree with two years of obligated employment. ROTC is a program to commission officers in the military (mostly undergrads).

      ROTC includes classes, leadership laboratories, and summer field training during school. The service commitment time is usually 4 years (or 5 years if they pay for that many). Also, not all ROTC cadets get scholarships, some in the program just pay their own way through school but still get commissioned.
      • We have the security emphasis program in my school at Mississippi State Computer Science [msstate.edu] I don't know if they have information up about it or not, but your allowed to apply for it as a JUNIOR and it pays for two years of undergraduate if you want. Perhaps it's just different in other places though..

      • Re:ROTC (Score:2)

        by Eil ( 82413 )

        In the Air Foce, the service commitment for most programs is twice the amount of time the USAF paid for your education.

        There are literally dozens ways to become an officer, partly because the services are really hurting for members right now. And to anyone considering a commission: don't think of a commission as some nifty job you get to try out for a couple of years. You join the service for x amount of years and your life will be the service for those x years.
        • In the Air Foce, the service commitment for most programs is twice the amount of time the USAF paid for your education.
          No, the commitment is equal to the number of years they paid for, but the minimum is 4. Some majors can get 5 years paid for.

          There are literally dozens ways to become an officer, partly because the services are really hurting for members right now.
          No, besides doctors, lawyers, & chaplains (direct commissions with 2 or 4 weeks of training), there are exactly 3 ways to get commissioned into the Air Force: the Academy, ROTC, & OTS.

          • Re:ROTC (Score:2)

            by Eil ( 82413 )

            No, the commitment is equal to the number of years they paid for, but the minimum is 4. Some majors can get 5 years paid for.

            I can't bring up any specific ROTC programs, but I know that there is at least one that requires you to give back at least 2x the amount of time you're in school. Maybe there is another minimum x amount of years that get tacked on, but they don't advertise that.

            No, besides doctors, lawyers, & chaplains (direct commissions with 2 or 4 weeks of training), there are exactly 3 ways to get commissioned into the Air Force: the Academy, ROTC, & OTS.

            But there are different ways to get into those 3 different commissioning programs. I know because I'm active duty enlisted and they are constantly advertising them--they want more high-quality enlisted members to try for commissions, it's less training the AF has to do. And in the opinion of many enlisted and officers alike, it frequently results in better officers. If I had my way, all officers would have to have a minimum amount of time (say, a year or two) as enlisted before their commission starts. But that's just me.
            • I can't bring up any specific ROTC programs, but I know that there is at least one that requires you to give back at least 2x the amount of time you're in school.
              There are no ROTC programs that have a 2x yr commitment by themself. However, if you become a pilot you have a 10 yr commitment after training, & navigators have an 8 yr commitment after training.

              But there are different ways to get into those 3 different commissioning programs. I know because I'm active duty enlisted and they are constantly advertising them
              Right, just remember that they all funnel through the 3 programs. I was an active duty SSgt, now I'm in ROTC, through the ASCP.

              If I had my way, all officers would have to have a minimum amount of time (say, a year or two) as enlisted before their commission starts. But that's just me.
              I definitely agree! While many non-prior-enlisted officers were good, I believe on average the prior-enlisted ones make better officers. After going through ROTC field training and seeing what a joke it is, and how bad of a program ROTC is, they should at least send every officer candidate through basic training.

  • CS in the 21st Century (Score:3, Funny)

    by JamesOfTheDesert ( 188356 ) on Monday April 01, 2002 @10:16AM (#3265319) Journal
    I hope they're not recruiting at one of thoses schools where students study computer science by learning Java.

    "Machine code? Huh? Direct memory access? Programs can't do any of that!"

  • Purdue is one of the recipients (Score:3, Insightful)

    by cpfeifer ( 20941 ) on Monday April 01, 2002 @10:59AM (#3265468) Homepage
    The CERIAS [purdue.edu] program at Purdue University [purdue.edu] is one of the recipients of this NSF grant [nsf.gov]. Other recipients include: CMU [cmu.edu], and the Naval Post Graduate School [navy.mil]. But this isn't necessarily a slam dunk, you still have to be admitted to the program at the school you apply to.

    A free education is nothing to sneeze at. Talk to a current grad student who is either teaching a class or picking up his prof's dry cleaning to pay the bills and they will tell you how they wish they could find a funding source like this.

    The institutions that received this grant do cutting-edge research in security that will influence the field for years to come. Heck, I'd do it just to go and study w/Spaf [purdue.edu].
  • Considering the fact that the DOD is a monster beauracracy with more security holes that swiss cheese, the task of pinning down info sec is monumental. The manpower required to really get the job would be 10 fold the proposed graduating class. As a former member of Air Force communications squadron, I cringe when thinking about the lack of sophistication involved in managing their networks. NT is embraced as the desktop OS of choice but so is it amongst a majority of large corporations. The difference is the backend, also NT based couple with Novell, or so it was 5 years ago. Network outages were common place, I remember one time email and internet access being down the entire day! I wasn't behind the scenes to give actual specifics, but I was close enough to say it was a two bit operation. Take into account that this sort of operation is found in every squadron (20 or so) on each base and we at the communication squadron were supposed to be the experts. Now take this scenario and apply it to the rest of the bases throughout the world and don't forget to factor in the Army, Navy, Marines, and you end up with a nightmare of a situation.

  • Good Idea (Score:3, Insightful)

    by 4of12 ( 97621 ) on Monday April 01, 2002 @11:43AM (#3265647) Homepage Journal

    You can't realistically expect the government to be able to attract top of the line talent in IT security with their traditional job structure.

    You know: come in from 9 to 5, have a GS rating with plodding single digit percentage raises each year, put up with a few petty bureaucrats, slug it out for several decades and finally retire well off.

    The people they're after are young and don't care about retirement plans, but do care they get paid what they're worth on the open market and don't want supervisors having a cow if they come in 8:05 am.

    I think any plan, like this one, that helps to get those talented people into government service is just what the government desperately needs.

    It reminds me of people going to medical school on military scholarships and serving a while after their schooling is finished.

  • setting some things straight (Score:4, Informative)

    by ironleaf ( 560116 ) on Monday April 01, 2002 @11:46AM (#3265659)
    The program only accepts U.S. born applicants; more information on the Iowa State fellowships [iastate.edu] is available as is information on the program as a whole [nsf.gov]. Most of the core training at Iowa State is in Computer Engineering classes: CprE530(protocols), CprE531(security), CprE532(warfare/hacking), CprE533(crypto) and CprE534(ethics). If you take a look at the ISU fellowship specs, I think you'll agree that this is a decent way of paying for school and serving your country at the same time. I agree with the previous post that this is basically ROTC for geeks. ;-)

  • Here in Mississippi (Score:3, Interesting)

    by Traicovn ( 226034 ) on Monday April 01, 2002 @12:15PM (#3265770) Homepage
    We had the security emphasis full paid scholarship last spring BEFORE 9/11 happened. It's been available for about a year now, however after 9/11 happened the emphasis to get people interested in it increased. It's a brand new program nationwide and at Mississippi State, so I know that it's not entirely the 9/11 'experience' that started the program, since we began school in August and they announced the program in the spring... However 9/11 has definitely fueled the program, funneled more money into it, and increased interest. They give you a ton of money to be in the program, thousands of dollars, however you are required to do so much internship time with the gov't and then you have to go into a gov't security position WHEREVER THEY WANT TO PUT YOU when you graduate. I considered it at first, but I'm not sure it would have been the best route for me personally to take.
    At least the gov't is trying to get some better sysadmins into there workforce. Not to insult any gov't sysadmins out there, but it's obvious that they want more people checking each others work so that there are fewer holes, hopefully/theoretically.

  • Happening here (Score:3, Informative)

    by Lish ( 95509 ) on Monday April 01, 2002 @12:28PM (#3265893)
    I'm a grad student in CprE/Security at Iowa State, one of the schools administering this program; I was too far along in my studies to apply. Some notes:

    1. This started before 9/11. This is not in response to terrorist threats, but rather a real nderstanding that critical infrastructure is at risk.

    2. There are both 2-year fellowships for grad students and scholarships for undergraduates. They cover full tuition, room, board, books and fees, plus a stipend.

    3. It works a lot like a ROTC scholarship: we give you two years of support, you owe us two years of work after you graduate. Which in security isn't a bad tradeoff; guaranteed job plus very resume-boosting experience. Yeah, you can make more money elsewhere, but it's a good job.

    If you want more information about actually applying, you can look at the program webpage here [iastate.edu], or the ISU Information Assurance Program site here [issl.org].
  • "This is in response to the general state of paranoia that has ensued since 9/11, with 'cybersecurity' as a high priority."

    Yeah, there seems to be no end to the proposals the government has come up with since 9/11. The only problem is, none of them would have stopped the 9/11 terrorists. It's a bit like shutting the barn door after your car has been stolen from the garage.
  • This is so horribly inaccurate. Bill Clinton was trying to gather support for Government funded training schools for IT security that mandated Government service afterwards while he was still in office. I never could find substantiate information on it and I assumed it simply got lost at some point.

    I don't really see a big correlation to that tragic event and this program, at all. What, is learning how to properly firewall a system going to suddenly make INS and customs capable of keeping known terrorists out of our country? I don't think so. Not *everything* that happens in this country is related to that, you know.
    • Although you may not realize it, you've hit on the exact point of the program (at least from my perspective as a participant). Learning how to secure a firewall will not help the INS - or anyone else - from doing anything silly. Hopefully, the students trained and funded by this program will be able to help create intelligent information policy - including, but not limited to, the actual work of securing computers.
    • By their own admission, from literature I've seen, this program is exactly learning how to "properly firewall a system", because even CS students don't come out of college with that knowledge. Not even how to firewall a gov't system, since all of the critical systems are, as many have already pointed out, physically secure. (I know, that wasn't a sentence. I'm too lazy to fix it.) It is simply a program to use government funds to train people for corporate jobs, hence the paltry 2 year requirement. This is *yet* another instance of the facist tendency of US politicians to sell the fruits of publicly-funded research directly to the corporate establishment. Although, in this case, it at least benefits a few hard-working CS students also.
  • Look at the pic in the CNN article -- they look like my grandma and grandpa! Not exactly our typical college students, huh? =P
  • Aren't all the REALLY critical systems (defense, air traffic, etc) already air-gapped from public networks like the Internet?

  • It is, however worth noting that according to the scholarship program website [nsf.gov], the proposal deadline for this scholarship was December 19, 2001. Way to fuck with me on 01Apr, Slashfags.

Slashdot Top Deals

"The one charm of marriage is that it makes a life of deception a neccessity." - Oscar Wilde

Close