Congress Gives Federal Agencies Two Weeks To Tally Backdoored Juniper Kit (csoonline.com) 77
itwbennett writes: In an effort to gauge the impact of the recent Juniper ScreenOS backdoors on government organizations, the House of Representatives is questioning around two dozen U.S. government departments and federal agencies. The U.S. House of Representatives' Committee on Oversight and Government Reform sent letters to the agencies on Jan. 21, asking them to identify whether they used devices running the affected ScreenOS versions, to explain how they learned about the issues and whether they took any corrective actions before Juniper released patches and to specify when they applied the company's patches. The questioned organizations have until Feb. 4 to respond and deliver the appropriate documents, a very tight time frame giving that 'the time period covered by this request is from January 1, 2009 to the present.'
Re: (Score:1, Interesting)
In other words you oppose effective government oversight of government. Progressive? Or just a Democrat?
Re: (Score:3, Insightful)
republicans don't want effective oversight of government. that runs contradictory to small government.
you can't have oversight, and small it doesn't work. Oversight by definition makes things bigger.
Re: (Score:1)
While I am not (nor should I be confused with) a Republican - I think you'll find your logical fallacy is that of the excluded middle. Small does not mean absolute least amount. Those would be the minarchists. They are not generally Republicans. We have some in my party, however. I'm inclined to agree in principle - I'm just not certain that their ideal is reasonable or would be as effective as they like. They're usually proponents of a strong, very strong, but minimal government. Some are actually in favor
Re:In other words (Score:5, Funny)
I don't know what they're complaining about, I thought they wanted backdoors?
Re:In other words (Score:4, Interesting)
I was thinking the same. First they start lamenting how they need government backdoors, now they complain when they find some. Make up your fucking mind, people!
Re:In other words (Score:4, Insightful)
I know this might come as a shock to you, but the U.S. Government is very large. It does multiple things at one time. One part can have a policy contradicting another part. In some cases, the contradiction is mandated by Congress. Government is not a large company where getting out of line can get you fired. There is no line, there are fiefdoms. And you wouldn't want it any other way.
ScreenOS is dying anyways (Score:3, Insightful)
They should be phasing those out regardless. Netscreen devices are EOL. Too many people are still using them. I know I have actively encouraged clients to ditch them. Unfortunately the Juniper SRX firewalls are crap, at least the low end/branch ones. The big iron is alright but still doesn't compare feature wise to Check Point, Palo Alto, Fortinet, etc.
Re:ScreenOS is dying anyways (Score:5, Interesting)
Perhaps they should simply ask the NSA, they should know exactly when the backdoor stopped working on any particular site.
Re: (Score:2)
I was speaking in terms of firewall performance and features. I pretty much expect them all to be compromised in some way these days.
Proscecutions? (Score:5, Insightful)
Re:Proscecutions? (Score:5, Insightful)
Prosecuted? Somebody's probably going to get an award for thinking ahead. They had their kit backdoored before the government even made it a requirement! Whats good for the goose is good for the gander and all that.
Isnt this a good thing? (Score:5, Interesting)
I thought government security organisations of the three letter variety were busy trying to convince
us that security backdoors and 'special' access for government level players was a good thing?
Surely they should just be promoting this as a feature, that enables the rounding up of literally millions
of pedophiles, drug addicts, and terrorists Real Soon Now?
Oh, wait, they are not sure its only THEIR backdoors? Dont tell me other governments may also be
involved? But surely if its good for one government to have access, its better if more do - hell, they ALL
should, right? So they can enforce their own local views of What Is Right?
Are we being told only some governments are trustworthy? Can we please have a list? What happens when
governments change? This is all just too complicated!
It is a pity most police are now just too busy collecting revenue to do much police work, it all seemed a bit
simpler when they used to investigate actual crimes against the populace.
Re: (Score:3, Funny)
Re: (Score:1)
That's kinda the problem. There laws were passed to spy on suspicious people. Spying on politicians and their friends is treating them like criminals. That's a defamation of their good names and an insult to their lofty jobs. Important people don't hate mass surveillance because it's ineffective, abusive, or encourages treason; they hate it because it makes them look bad.
Don't underestimate a security audit (Score:2, Interesting)
I spent much of last year responding to a security audit that had to do with a leak of personal information through email. Very few people were affected . It was an honest mistake. The audit is exhaustive.
It is hard to provide every email *relevant* message for your colleagues for years. It is hard to document everything we ever said about securing information. It's hard in a short time to prove you are educating the whole staff again about what you told them all before.
We are better for it, and my group wa
Just try and stay out of my way. Just try! (Score:1)
Re: (Score:2)
I'll get you, my pretty, and your little dog, too!
Spoiler Alert: I know what happens next. The house falls on the bitch.
What did you know (Score:4, Insightful)
Q: "What did you know and when did you know it?"
A: We didn't know nothin' then, we don't know nothin' now, and we won't know nothin' next week either."
"Thank you, this meeting is adjourned."
Re: (Score:3)
Closed sessions (Score:2)
Juniper Jones to the rescue (Score:3)
Congress should just ask NSA and save everyone the trouble.
This is a drill (Score:1)
Dumb and Dumber (Score:2)
And, who's going to pay for it?
What a disgusting bunch of idiots pretend to run my country.
Re: (Score:2)
Complying with what is currently on the network shouldn't be difficult at all.
Re: (Score:2)
But the demand is for a historical report. Who knows if the data even exists.
Re: Dumb and Dumber (Score:2)
Many government IT folks only do what they're told to do. Often they can do those things well. And especially with contractors, there's nothing done that's not specified in lengthy contracts.
In the private sector, an IT worker will often see a need and implementation a solution to save his frustration - occasionally he'll even tell the boss about it.
This tends to attract different types of people to the two jobs. The same goes for Congress - very few people who are competent actually want to work there.
2009 time frame is bogus (Score:3, Informative)
Here's the letter to SSA:
There's no mention of getting information as far back as 2009 in the letter. That bit was from some attached boilerplate rules about how the committee wants the report formatted, media, etc. Other letters that have nothing to do with the Juniper firewall issue have the same boilerplate rules attached. The committee only wants the information at stated in their four items. I don't why the report for the TFA put in that bit about the 2009 timeframe other than to exaggerate the work each agency is going to have to do.
Re:2009 time frame is bogus (Score:4, Interesting)
Still, it's a pretty incompetent company that won't have at least some form of records of CapEx purchases going back six years, let alone a government agency, just because of financial and tax legislation requirements, albeit possibly not entirely digital and searchable. At my previous employer I could get a report with a complete list of assets from a given vendor complete with every logged change made to those assets from our ITIL CMDB system in a couple of minutes that would easily cover that timescale, although I suspect for many government agencies this is likely to involve some hapless interns digging through dusty paper boxes in a warehouse rather than someone running a report.
Re: (Score:2)
More government idiocy. Consider: (Score:2, Insightful)
the same morons who want to worry about THIS seem to have no problem with nearly the entire government running a combination of ancient, unmaintained and vulnerable old flavors of Windows and IE, or WORSE the newest flavors of windows that have a permanent, autonomous and continually-active "back-door" built right in. With the most-recent versions of Windows sucking-up all keystrokes and mouse moves and even, in some cases, audio from any built-in microphones, and sending stuff off to headquarters in Redmon
Hey! What's the hubbub? (Score:2)
I thought you wanted government backdoors, now you make a fuss. Make up your fucking mind!
Oh, the irony (Score:1)
A backdoor, likely added by a 3-letter US government agency, being used in another US government agency causing a security breach....