Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Politics Government IT

US Government IT Security 'Outstandingly Mediocre' 86

Posted by Zonk from the c-minus-for-the-lose dept.
mrneutron2004 writes wrote with a link to an article on The Register, discussing an annual IT security report card handed out to the federal government. The results this year were mixed. The good news is that they graded higher than last year. The bad news? They still just rate a C-". Individual departments did better than others, but overall the results were quite poor. "Although overall security procedures improved the Department of Defense (DoD) recorded a failing F grade. Meanwhile the Department of Veterans Affairs - whose loss of laptops containing veterans' confidential data triggered a huge security breach - failed to submit a report. The Nuclear Regulatory Commission, another agency that has trouble keeping track of its PCs, flunked."
This discussion has been archived. No new comments can be posted.

US Government IT Security 'Outstandingly Mediocre' More

US Government IT Security 'Outstandingly Mediocre'

Comments Filter:

  • I assume... (Score:1, Informative)

    by Jck_Strw ( 35674 )
    that this is completely different than yesterday's article on the same subject?

    http://it.slashdot.org/article.pl?sid=07/04/12/232 3232 [slashdot.org]

    • Re: (Score:1)

      by RedElf ( 249078 )

      that this is completely different than yesterday's article on the same subject?
      You must be new here...

      • Re: (Score:1)

        by hostyle ( 773991 )
        sig quote: "The Aliens came, and..." ... you're still posting! :( Did you already explain female to them ? You moro^ALIEN_INTER(VENTION|COURSE) # what? stop introducing random new variables just cause you're on tag, muppet! I are pant!!!
    • "The bad news? They still just rate a C-."

      They are letting us know that nothing has gotten better in the last 22 hours..........

      C'mon guys at least read the front page (and the little box in the corner where it clearly shows the c- story, it even has c- in headline)

      I wonder if any of the /. editors will soon be appearing on: Are you smarter than a fifth grader?
  • DHS for example, is heavy into Windows.

    Any exceptions?

    • Re: (Score:1)

      by denobug ( 753200 )
      DHS for example, is heavy into Windows.
      Any exceptions?
      It has nothing to do with Heavy Windows usage. Plenty of Corporations uses Windows heavily for their end users and are still much more secure than the government does. It's the "company" culture and the management style that should be credited for lack of security while slow to improve its current standing.
      It may help also if they learn how to keep the real talent happily working for the government agencies and not pissing them off to the privat

    • Re: (Score:3, Interesting)

      by zerkon ( 838861 )
      As far as I've seen in my military career, the AF at least uses windows exclusively. I don't think that they have anything against Linux, maybe there are just too few nerds among the top brass to even consider a change.

      My degree is in IT, and I can tell you a lot of what /.ers would consider horror stories about standing AF computer policies. As an example, my password is something like 15 characters long, has non-alphanumerics, numbers, capitals, and changes every 60 days or something like that.

      I reall
    • Ah, yes. Because it is the presence of Windows on the laptop which causes it to fall into the wrong hands... the fact that the asset tracking label is stuck underneath one of those Windows licence stickers and caught its evil influence...

      And who can forget that Linux never suffers this kind of poor auditing (Do you know how to generate a unique hardware hash and centrally audit it over a secure network?), and nobody wants to steal one of those nice, shiny, expensive MacBook Pros.

  • Dupe (Score:1, Redundant)

    by SuperBanana ( 662181 )
    Tada [slashdot.org].

  • What might help (Score:1, Insightful)

    by Anonymous Coward
    It would probably help if most of the security measures weren't "Unfunded mandates"... There's quite a lot that could and should be done, and plenty of items which must be met, but as long as budgets are shrinking IT will continue to get a smaller piece of the pie with which to work.
    • Honestly now, am I the only one who see's that the DoD is vulnerable to attacks from outside the net, as a good thing?

      This provides the best oversight by the civilians, not purely agents of a government.

      This would limit the size and capability of our government and put it as similar to individual power.

      The other hand is what happens if a script kiddie takes control where a civil oversight member cannot. Who would you rather your information be held by, the government or some 15 year old?
  • Did anyone stop to think that the Microshit monoculture just MIGHT be contributing to this problem?

    Question the status quo, people. (In Soviet Russia, the status quo questions YOU.)
    • I don't love MS, especially not the way in which their company operates, but it is certainly possible to have secure network running mostly MS software. The fact that some people can't do it is just a sign that they are not competent enough to do their jobs. No different than if someone running a Linux network that doesn't know what iptables is. Regardless of what tools they use, people need to be knowledgeable in them. Stupid people will make stupid decisions that will compromise security - whether the

      • but it is certainly possible to have secure network running mostly MS software. ..... Regardless of what tools they use, people need to be knowledgeable in them. Stupid people will make stupid decisions that will compromise security - whether they're using Windows, Linux, OS X, or OpenVMS.

        I'll agree that a secure Windows centric network is certainly possible, but I believe that Windows makes it much easier to make an insecure network. Take for example the autorun capability, first on CDs, now also on fl

      • ...it is certainly possible to have secure network running mostly MS software. The fact that some people can't do it is just a sign that they are not competent enough to do their jobs.

        But Microsoft sells itself as the software for dumb people who have no technical expertise. You have seen the adverts on TV with the ordinary schlebs in an office environment all happier than a pig in mud puddle. They are happy because they can use computers with Microsoft software even though they do not know jack.

    • Question the status quo, people. (In Soviet Russia, the status quo questions YOU.)
      Ok, here goes, questioning the status quo: So, just maybe, Soviet Russia jokes aren't trite, and are actually really funny!

      Nah....
    • Question the status quo, people.

      Okay. Where's your your next stop [statusquo.co.uk]?

    • Re: (Score:1)

      by kantier ( 993472 )

      In Soviet Russia, the status quo questions YOU

      Actually, the status quo questions YOU in corporate america too.

  • One person capable of edits edited new submissions.

  • FISMA is not security (Score:3, Interesting)

    by brennz ( 715237 ) on Friday April 13, 2007 @05:33PM (#18725769)
    The grades are on FISMA compliance which is not really the same thing as computer security. This is more about documentation than anything else.......

    It is about having documented down to the letter networks, configurations, policies and procedures for everything.

    Another weakness is how "controls" are rated. Basically, missing one little policy or procedure is rated as bad as missing something as critical as secure configurations...

    Every agency IG has a vested interest in scoring down agency efforts.

    If you look too, the ratings are biased because small agencies & independents have inordinately high ratings, while the bigger agencies/departments have far worse ratings.

    • Re: (Score:3, Interesting)

      by Blakey Rat ( 99501 )
      The article I read had a great quote from the Congressman who initiated this program (whose name I can't remember, unfortunately.) He said that you can't possibly secure a system you don't know about, which is why the first metric is whether all networks/servers in use by the agency are documented in a centralized manner. It seems like a great first step to me.

      • Re: (Score:2)

        by jotok ( 728554 )
        Mod parent up! This is true on so many levels.

        First off, there's the whole Sun Tzu thing. I find quoting Sun Tzu and the applications of "The Art of War" to network security tiresome but in this case he's right.

        Second, there are so many newfangled correlation engines on the horizon that can make Security's job a lot easier, but which require tons of metadata. You have to tell it which IP is your webserver so it will adjust its weightings. Of course before that you need to know where and what the webserv

  • No Department Left Behind? (Score:3, Funny)

    by Wyzard ( 110714 ) on Friday April 13, 2007 @05:38PM (#18725835) Homepage

    Clearly the White House should launch a "No Department Left Behind" initiative to improve the government's IT security grades.

    It could begin with routine penetration testing to assess how well-defended systems are against known and common attacks -- one could call this "standardized testing" to establish a minimum level of security, with budget cuts for departments that fail to keep their networks secure. The results should be reported to the taxpayers, so that we know which systems are secure and which are not, and can put public pressure on departments that aren't keeping their grades up. And of course, all IT managers should have MCSE, CCNA, RHCE, and A+ certifications, to prove that they're qualified for their jobs.

    • Since the recent news tells us the White House can't even keep it's own email under control I can't imagine that they could defend against even an eleven-year-old script kiddie with a TRS-80.
      • Allow the NSA to deputize the USMC to respond to break-ins. That will be one script-kiddie with a story to tell the next day at school. (or at his 45 year class reunion when he finally gets released). Both of those organizations are generally considered highly competent in their area of expertise. (electronic security and blowing things up, respectively)
  • Is it too much to ask that the "editors" read their own site?
    • Is it too much to ask that the "editors" read their own site?

      Let's be realistic here - if you were them, would you want to? Staring failure in the face every day is not for the faint of heart...

    • And for the readers to do the same (firehose)...
  • ...from malicious hacking than Slashdot is at defending itself from malicious duping.

    At least I pray to God it is. Otherwise, we're all in deep, deep trouble.

    Now you'll have to excuse me. I need to go update my will.

    Crow T. Trollbot

  • Only in government could mediocre be considered outstanding. :/

    • Re: (Score:1)

      by Tablizer ( 95088 )
      Only in government could mediocre be considered outstanding.

      Indeed. I would be more shocked if they got an "A". Now that would warrant an investigation. If the gov't get's an A, it means one of:

      1. They have way too big a budget
      2. Somebody bribed the graders
      3. Somebody is trying to hide something else or compensate for a separate weakness or screw-up by making another section do really well.
                   
  • Meanwhile, the government goons over at the FBI are still trying to figure out email working..

  • Windows (Score:3, Interesting)

    by slayermet420 ( 1053520 ) on Friday April 13, 2007 @06:28PM (#18726483) Journal
    As an active duty US Marine, I honestly feel that the big problem is the Windows culture, including the fact that the majority of the Marine Corps is using Windows 2000, with IE 6. Of course, it's viewed as too difficult to use XP, or at least that's the excuse. And until then, IE 7 will never be seen by the Marine Corps. And of course, user training is incredibly low. The majority of users know very little about computers, and don't get much training, if any at all. I'm definitely not surprised that the DoD got an "F" on security.

    • Re:Windows (Score:4, Interesting)

      by Bios_Hakr ( 68586 ) <xptical.gmail@com> on Friday April 13, 2007 @07:29PM (#18727069)
      That's kind of a cop-out. Just saying that a platform leads to insecurity is missing a big part of the problem.

      I've worked with USMC, USAF, and NATO workstations and servers. Both CLASS and UNCLASS.

      The first thing the DoD does right is to remove desktop admin rights. I love the fact that we lock workstations pretty hard. If your shop follows the NSA guidelines for Win2k, it's pretty solid. Ideally, the user cannot WRITE to any part of the drive other than his home folders. Of course, a rights-elevating script can destroy that.

      The USMC started enforcing standard text emails. They also push cryptographic signing and public-key encryption. Fery few civilian companies do that.

      The second thing the DoD does right is in user training. We (used to) regularly call people and ask for their password. If they gave it out, their commander got bitched at. He usually ensured that everyone came in on Saturday to practice not giving out passwords...

      The DoD also tends to filter out web sites. There are some places that only allow .mil/gov access. More common is blocking of Asian and Eastern-European IP addresses at the gateway routers. If a phishing site is identified, we usually block entire Class-Cs without a second thought. If the users have a problem, we whitelist on an as-needed basis.

      The DoD also filters email attachments. Sometimes this is strange. I can send a Word document with 9000 macros, but a basic Visio diagram gets blocked. Zipping, Raring, or Taring a file isn't usually enough to get through the filters.

      The DoD also segregates their critical communications. Everyone loves email and Google, but we can still deploy bombs and bullets without Wikipedia. All our *good stuff* is completely inaccessible from the internets.

      The biggest flaw is, as you said, using outdated software. However, there is no easy way around this. Once MS releases a patch, the DoD has to decide if it's needed. Then they have to decide if it will break anything. Form there, they filter it to the USMC. They decide if they need it and if it will break anything. This continues to happen all the way down to the Base communication support people. By that time, the exploit has been in the wild for a few months.

      The only real alternative is to *cowboy* your way through the patches and hope that nothing breaks.
      • You do make a lot of great points. Up until recently the workstations being locked wasn't true, at least with the Marine Corps. With the change-over to the Navy-Marine Corps Intranet (NMCI), that all changed. New computers, new restrictions. With my old computer, I had it cracked, and was running Firefox, and was an Admin on every computer in my shop. It's always good to get in good with the tech guys. But like I said, this is all gone. And yes, everything is encrypted now. We're even using crypto logins.

  • Relative to what? (Score:2, Insightful)

    by djpretzel ( 891427 )
    While from my experience a lot of fed workstations and servers are indeed running Windows, they have it so locked down and neutered that it's almost secure by virtue of being unusable. I've witnessed some pretty Draconian measures for locking down machines, red tape up the wazoo for change management, and detailed Certification & Accreditation procedures for moving IT systems into production and changing them. Relative to quite a bit of what I've seen in private industry, there's actually better secur
  • Hey, thats better than just regular ol' Mediocre isn't it?
  • outstandingly supple [washingtonpost.com], but not too many people are getting very excited about it.
  • Outstandingly Mediocre is such a great-sounding phrase. It makes me think of a documentary that would play with dramatic music and an overly serious narrator.
  • I bet everyone is breathing easier now, huh?
  • Outstandingly mediocre IT security? Sounds a lot like U.S National Security and Social Security :)
  • As a DoD Network Specialist, I can say that the DoD has one of the most secure networks in the world. As it has been said, our users have to go through training before they are allowed to use Classed and Unclassed terminals, regular refresher training, and annual reviews. Most military bases have larger network infrastructures that a lot of international corporations and we maintain a staff that monitors network activity 24/7. As far as our use of Microsoft products, those have to be certified by DoD sta

Slashdot Top Deals

Ummm, well, OK. The network's the network, the computer's the computer. Sorry for the confusion. -- Sun Microsystems

Close