Uncle Sam Earns C-minus Grade for PC Security 88
An anonymous reader writes "Twenty-four federal departments and agencies earned a collective grade of C-minus last year for their performance in meeting computer and network security requirements, according to marks handed out by a key congressional oversight committee today. The government-wide grade is up slightly from the 2005, when it earned an overall grade of D+. Eight agencies earned A grades, while as many warranted failing marks. '..the Department of Defense led a group of eight agencies that received failing marks for computer security. Also receiving that dubious distinction were the departments of Agriculture, Commerce, Education, Interior, State and Treasury, as well as the Nuclear Regulatory Commission. The Department of Homeland Security earned a D, although its overall performance improved since 2005. The Department of Veterans Affairs did not provide enough data to earn a grade. In 2005, it received an F.'"
But it was a strong improving "F" (Score:5, Funny)
But it's a strong improving "F"
I don't recall that ever working with mom "But Mom...it's an improved F over the last F I got"
Re: (Score:1)
Also take into account.. (Score:2, Informative)
Re: (Score:1)
Damn! Now where did we put the laptop with the launch codes?
of course D of VA didn't provide data (Score:4, Funny)
If it were only so simple (Score:3, Insightful)
I like how they think they have to kindergarten-up government to teach it to the people.
I've worked on a few different government 'nets. It's always just a little bit more complicated than that.
Re:If it were only so simple (Score:5, Interesting)
Re: (Score:3, Insightful)
Re: (Score:3)
Re: (Score:2)
Re:If it were only so simple (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Because the corporate world is more complicated? (Score:2)
Anyway, at work, on my performance review I get a "does not meet", "meets", "exceeds" or "far exceeds" expectations. That's even more simplistic than a letter grade.
I work at a defense contractor. The scores given for performance of a project are similar; very, very simple.
I'm sure that like both of those examples, the departments were given detailed descriptions of what was wrong and was right, probably with each area having a
Re: (Score:1)
Per Parent:
I like how they think they have to kindergarten-up government to teach it to the people.
Indeed.
The other side-effect of that is how the children can see how upside-down the government is without having it explained by their parents. Brilliant!
From TFA:
...the Department of Defense led a group of eight agencies that received failing marks for computer security.
Nice to know that the administrative branch of the Most Powerful Military in The World is using "passwordxx" for their passwords.
Wake me when they open-source the government; should have been GPL'd years ago. (right around 2000, I believe)
they're good at sharing (Score:3, Funny)
It sounds like their security is more "social" than they'd like!
Re: (Score:2)
left behind (Score:2, Funny)
Sad, very sad.
Re: (Score:1)
heh (Score:4, Funny)
Re: (Score:2)
Yeah, they aggregated a bunch of agencies, personnel and IT systems and then made them collectively less "secure". Let's call it the "Department of Homeland Exposure" or something.
Government to use Full Disk Encryption on computer (Score:5, Informative)
What a scam... (Score:4, Insightful)
For example, where I work, to get onto the corporate intranet you need to actually be physically connected to the corporate network, or you need to access it via a VPN. To get on the VPN, you need the group password and your individual password. The group password is static, but your own password is a combination of a PIN plus the sequence of digits on the RSA SecurID card you're issued, which change every sixty seconds. This is a really standard setup, and means that to get anywhere you would need to steal my laptop (to get the group password), know my PIN, _and_ steal my SecurID card. Actually, you would _also_ need my corporate username and passphrase, but if you're good enough to get all of the above I assume you can get those too.
If you want to secure email (or whatever), that's easy too. To get to the mail servers you need to be on the VPN, which is already a pretty good start. At that point all you need to do is make sure that all the really sensitive email accounts are local delivery only (i.e. no POP/Exchange/IMAP access). To read email you get a web based email solution or a shell account on the mail server. Either way you log in by connecting to the VPN and doing your normal Kerberos authentication. Obviously web mail presents a bit of a problem in the way of the browser cache, but it's fairly simple to lock down a shell account in such a way that users can't connect out from the account (or scp files).
Anyway, adding full disk encryption to this is a joke. It's a scam to let the companies that provide the disk encryption hardware/software make a lot of easy money. If you were doing things right in the first place it would be a _lot_ easier for someone to get the encryption password than it would be for them to get to your sensitive data. Instead of paying hundreds of thousands of dollars on a proprietary disk encryption solution, get some competent system administrators.
There is a place for disk encryption (Score:1)
Those passwords are on the laptops (Score:1, Informative)
It is usually non-trivial to break into a server that is in a data-center behind firewalls given zero-knowledge.
Fortunately for the bad-guys, laptops have been proven over and over to contain network information, passwords, and raw protected data:
Chicago Public Schools [theregister.co.uk]
FBI [cnn.com]
Boeing [nwsource.com]
Starbucks [usatoday.com]
Towers Perrin [wsj.com]
US Commerce Department [msn.com]
US Department of Transportation and Sovereign Bank, et al. [trustoncorp.com]
US Navy [securityfocus.com]
US Department of Veteran Affairs [securityfocus.com]
Federal Trade [washingtonpost.com]
Hacking the grades (Score:5, Funny)
1) Central Intelligence Agency
2) National Security Agency
3) Office of Naval Intelligence
4) National Reconnaissance Office
5) Defense Intelligence Agency
6) National Geospatial-Intelligence Agency
7) Army Intelligence
8) Air Intelligence Agency
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:1)
Re: (Score:2)
At least now we know which agencies are capable of hacking into the system to change their grades:
They were all Intelligence Agencies so they should be smart enough for that!
no wonder DoJ got an A (Score:4, Funny)
Re: (Score:1)
They think [gwu.edu] they deleted it, the same way you thought [arstechnica.com] you voted.
got backups?
Well... (Score:3, Interesting)
Re: (Score:2)
Perl scripts and default passwords? (Score:3, Interesting)
Just like in the control room for Springfield's reactor in Last Exit To Springfield (9F15).
The US has all the Get Smart like security, but then has the dilapidated MS door wide open for any and all.
Re: (Score:2)
Unfortunately it looks like I could just implement a polka dot day policy and it would sit there until someone took it down. No hacking necessary. :)
Re: (Score:1)
Turbo Tax vs. IRS (Score:3, Informative)
Yesterday, we have a story where Turbo Tax's online system exposed a few tax forms for returns with similar names.
Last Friday, it was reported [arstechnica.com] that the IRS lost 490 computers with potentially millions of taxpayer records. (The IRS is not sure what was lost.)
Tell me why the latter isn't a bigger story?
Answer: With TJ Max, Georgia CHIP, the CIA, and Los Alamos were all desensitized to the daily reports.
Not surprised (Score:2, Interesting)
Re: (Score:2)
I could make a list of 25 million of the richest Americans and despite it's large size it'd be fairly unrepresentative list.
The government too isn't a randomly chosen sample. They're obviously the most competent, smartest and generally rationally-minded amongst us. If they weren't they wouldn't get elected.
We should expect better behaviour from them than we expect from Joe six-pack. Hell, what does Joe have to worry about computer security for? To protect his game of solitaire
Re: (Score:2)
99% of people that work in 'the government' aren't elected.
Grades (Score:2)
I've had grades like that, you know where you just didn't show up or didn't do the homework, I kinda wonder what happened here.
Re: (Score:1)
Woohoo! (Score:1)
We're all the way up to average!
We (kind of) rock!
Re: (Score:2, Funny)
At least that was my motto when it came to grades...
I am not surprised (Score:5, Interesting)
A while back I use to be friends with someone who worked for one of these companies that do contract work for the government, for one of those agencies that require Secret or Top Secret clearance along with requiring routine polygraph tests.
I was told stories on occasion how IT jobs would come open and be filled not with individuals that had the technical qualifications but those that had the security clearance.
Heck, my friend who had a clearance and did clerical work was promoted to run the Help Desk and was giving a book to learn on the job. Then again a few years later to administer servers spread around the globe, with no formal training.
I was told the contracting companies would not hire individuals for the clearance jobs unless they already had the clearance. The clearance trumped any sort of job qualification.
If this has changed since 9/11 I don't know.
Re:I am not surprised (Score:4, Informative)
A couple friends of mine recently hired on with a growing government contract IT firm out here. The HR department didn't even really care about the resume, but rather the fact that two of them already had clearances. According to them, they work with some utter idiots, but they're qualified to see almost anything, so they keep them around.
Re:I am not surprised (Score:4, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Surprise! (Score:1)
Note sarcasm...
My 17 year old sister has better security on her ME box...
Don't believe it (Score:4, Interesting)
Damn auditors.
Re: (Score:1)
Lose points.
qz
Re: (Score:2)
Re: (Score:2)
And that's the point: the auditors are generally speaking. They don't consider the context. Ever.
Suppose you use telnet in a strictly switched network where the physical plant is secured and under your control, the destination MAC is locked to the port and an automated watcher drops any ports that incorrectly arp for a protected address? An analysis of that design would have to conclude that telnet i
F is for "Karl" (Score:2)
The answer starts with "F".
Well (Score:2)
SO...guess what. One of their clueless Sgts wanted to transfer files from one box to another. He goes into network neighborhood...where EVERY WINDOWS BOX IN THE ENTIRE STATE IS ON THE SAME LAN!!!! I was like "uh...
The grading seems skewed (Score:3, Informative)
And even legitimate reporting of FISMA requirements is damn near pointless. Q: "Do you have a firewall?" A: "yes! It's default allow with no rules but the requirement sais firewall." Q "Do you have an IDS?" A: "Yes! It has the default rule set, no one monitoring it, and we don't even know if you can access the logs but it's there." I have seen that answer, literally, on a system that people would simple assume had someone personally approving every packet.
In the end, it's damn near impossible to tell who's secure and who isn't without having a single team do unannounced pen tests on everything and reporting how they compare. And there are so many problems with that approach I don't know where to start. But you will always have teams that lock a system down so tight water doesn't get in yet fail requirements. You have people who meet the letter of requirements yet add no measurable security. And you will have the people who simply lie because they can't be bothered to hire someone competant to do the reporting.
Re: (Score:2, Interesting)
Doesn't matter... (Score:2)
Uncle Sam's Wife..... (Score:1)
Just so I get this straight (Score:2)
But at least I can sleep well again. An agency that well organized is no threat to my s
Wonderful.. (Score:1)
Bogus exercise in paper security (Score:2)
I agree with Richard Bejtlich's assessment: FISMA is a jobs program for unskilled "security consultants" who can not themselves 'operationally defend' system or network assets. That is to say, it's a boon for paper pushing drones wasting the time of the geeks at the sharp end who can actually make a difference if let alone.
Bejtlich writes
24 security breaches (Score:1)
This makes "24" even more credible. There are always some security breaches, moles, stolen keycards and laptops...
I really wonder why there still hasn't been a major terrorist attack on the USA except for 9/11.
Maybe they'll wait for the national internet reboot (yes, national, that's what slashdot said ^^) to exploit more security breaches.