DHS CyberSecurity Misses 1085 Holes On Own Network 86
Tootech writes "In a case of 'physician, heal thyself,' the agency — which forms the operational arm of DHS's National Cyber Security Division, or NCSD — failed to keep its own systems up to date with the latest software patches. Auditors working for the DHS inspector general ran a sweep of US-CERT using the vulnerability scanner Nessus and turned up 1,085 instances of 202 high-risk security holes. 'The majority of the high-risk vulnerabilities involved application and operating system and security software patches that had not been deployed on computer systems located in Virginia,' reads the report from assistant inspector general Frank Deffer."
Idiots (Score:3, Informative)
Re: (Score:2)
"Adobe Acrobat, Sun’s Java and some Microsoft applications."
I think you did not read the article, but that is common isn't it ???
no this is what you get with outsourced IT VA (Score:2)
no this is what you get with outsourced IT The state of VA went with Northrop Grumman that did not work that good.
Re:no this is what you get with outsourced IT VA (Score:5, Informative)
This is exactly correct. They would rather hire contractors who CLAIM they will do things so that they can fire them later when they don't do it. If they actually hire good people, they have additional egg on their faces when things don't go right and the blame game is even harder to sort out. This is all about blame shifting and the appearance of easy "correction." Having worked for DHS for a couple of years, I saw a lot of rather disgusting and disturbing things about the way they hire contractors and then don't oversee their activities. When security screeners were being hired, I witnessed an 18 year old girl being hired as a supervisor and this was her VERY FIRST JOB. She had absolutely zero employment experience and was hired on in a leadership role. Nothing explains this adequately. They had contractors doing the hiring and staffing for that operation and it didn't work out so well. I heard that somewhere between 20 and 25% of the people initially hired didn't pass the background check and were subsequently let go more than a year later so I got to see the process repeat itself AGAIN where they used contractors to do another round of mass hiring and staffing. They never learn.
Re: (Score:2, Informative)
"18 year old girl being hired as a supervisor and this was her VERY FIRST JOB"
I guess if I was getting my pole waxed by an 18 year old girl, I'd give her any job she wanted too!
Re: (Score:1, Interesting)
It could also have been a family member that got her the job. This being VA, the two might not be mutually exclusive.
Re: (Score:2)
Re: (Score:2)
Congratulations! You just gave the best definition of what a bureaucracy is!
Re:no this is what you get with outsourced IT VA (Score:5, Informative)
This is an entirely different issue. The Virginia thing was a waste of money and an added frustration which, as anyone who's been to Virginia DMV can tell you, is NOT necessary.
What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.
While it's very difficult to keep out an experienced, dedicated attacker, you could at least shore up the defenses enough to keep the /b/tards and script kiddies out.
Re: (Score:2, Insightful)
Their scanning software requires remote access to the registry from a central scanning computer and looks for every "recommended" patch, setting, or configuration and throws a flag for every non-compliant instance it finds. The list of recommended settings are often security theatre regimen or disastrously harmful to performance. But someone convinced congressman Y,Y,Z tha
Re: (Score:2)
I don't know that what you experienced is quite what the article's talking about.
I'm not at DHS-OIG, but in reading their report, it looks to me like it's a pen test or internal vulnerability scan, not an inventory of what patches they have installed. Nessus exists to find actual holes, not just see what patches you had installed compared to FDCC. The report said a Nessus scan found 202 high-risk security holes (as well as 338 medium- and low-risk) in 1085 instances on 174 computers, not just missing
Re: (Score:1)
What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.
?!? Where are you getting this analogy from? ?!?
Can't you think of an appropriate car-themed analogy?
Re: (Score:2)
More likely this is what happens an organization does not have processes for execution and validation. Regardless of whether they are contractors of FT's if no one audits their work this can happen.
Re:Idiots (Score:5, Insightful)
No, its that DHS has nothing to do with true security. Their job is security theater, as evidenced at any airport. The Armed Forces and National Guard are there for the real security.
DHS is a waste of good tax money. It should be spent on infrastructure.
Re: (Score:3, Insightful)
It's almost like "The Ministry of Truth" in Orwell's 1984 - it was the propaganda machine for the government, and therefor was responsible for spreading lies far and wide.
DHS is similar, though not exactly a polar opposite of what its Orwellian name would suggest. It spreads the feeling of security without securing anything. The guys who are actually doing anything to prevent terrorist attacks are folks like the CIA and FBI. DHS doesn't do shit.
For example, I know a guy who accidentally brought a box cut
Re:Idiots - The guys who are actually.... (Score:2)
The folks who are actually collecting big paychecks are well certified, qualified, legitimized... and they got BM (business management) degrees.
Also, DHS provides many more big paychecks for the DC, Virginia, and Maryland .gov+.mil+.com money pit.
If you are unemployable, move to the DC, Virginia, and Maryland area where more .gov+.mil+.com easy-jobs move every year. They need janitors and maids. The other jobs are for family and friends of family; Hence, an 18yo woman can be a fully certified, qualified, l
Re: (Score:2)
LoB
Re: (Score:1)
Re: (Score:2)
They do, or this story wouldn't exist. The DHS audited its own systems and this is what they found. If they were a company, they would just quietly fix the problem (or not) and move on. Since it's government, they self-report and we get the daily anti-government whine.
Re: (Score:1, Troll)
Dammit. I was here for the anti-MS whine.
Cause I knew MS would be at fault just by the title :-)
Re: (Score:1)
Re: (Score:1)
They should fire everyone IT related in Virginia for this offense, and replace them with more competent individuals.
Re:Idiots and real Idiots, Reality Check! (Score:2)
The government always ends up hiring contractors, this is why the jobs are already contractors, because .Gov/.Mil/.Com C*O/management get to blame-storm the contractors, the contractors can blame-storm each other, and the public thinks civil servants can't do the job. I know a few .Gov IT/Services folks and they know security basics very well, but they cannot interfere with the contractors doing a questionable job, until post-audit or post-incident.
Go discover how many contractors are on the .gov/.mil payro
Re: (Score:2, Interesting)
Re: (Score:1)
It's shit like this (Score:3, Insightful)
Re: (Score:2)
It's shit like this that needs to make it to main stream media. To show how messed up the fear mongering side of the Government really is.
Exposing the inadequacies of the government will just result in more "National Security" obfuscation. The more holes in security equates in more money to fill those holes. It's only a matter of time until Haliburton gets involved.
The powers that be have no intention of letting their senior bosses know the truth. They will throw more money at it until some major incident occurs and it airs on "60 Minutes", at which time the incompetence will be swept under the rug. When the issue becomes so tangled with corp
Re:It's shit like this gooooooood (Score:2)
Gooooooood is either god or good with too many "o".
Haliburton can really help with obscurity security, I'm sure.
Do as I say... (Score:1)
bureaucracy maybe? (Score:2, Insightful)
Im not going to defend software that simply requires an update. Stuff that needs a fresh install or a new software package altogether can be a pain in the ass.
Re: (Score:2)
At some organizations it can take months to get schedule and get approval for patching. When someone claims the business needs a service to be available all of the time it's difficult to find a business level advocate for patching.
Re:bureaucracy maybe? So... (Score:2)
C*O/Business management is about the same in .com as in .gov/.mil? Limit to 0.6666... average for both suffering the technology peter-principle, then I agree.
DItch Windows (Score:1)
Re: (Score:2)
If some new tool works well with 'secure' MS, the US can use them too around the world.
The endless contractor cash supply is cute too.
Re: (Score:2)
Very true. I've seen auditors report that users default Umask was incorrectly set. When you try to explain that any user can set any Umask they want so why bother they stare at you like you just told them the Sun was blue.
Re: (Score:2)
I gave up on trying to educate auditors. They often have the logical reasoning capability of a brick, without the value of being a building material. Compliance auditing is about reducing a complex set of circumstances and requirements into simple numbers. Comprehension of the underlying issues is not a job requirement.
The reason why that's a checklist item is that 99+% of users are have access to, but not knowledge required to set a umask, therefore making your point moot.
My recent favorite audit vulner
Re: (Score:1)
The most ludicrous (on multiple levels) I have had to deal with was an audit by one of our customers flagging our software for SQL injection, simply because the 'Defects Addressed' section of the release notes contained the text of an ODBC error administrators may have seen in the server log in prior releases, that had now been fixed. They would absolutely not allow the software into production until this 'critical vulnerability' in the static HTML release notes had been fixed. The scripts that spell-chec
i've seen nessus reports (Score:4, Interesting)
unless the people running the scans are experts in setting up and configuring nessus for scanning, i wouldn't assume every one of those is a true vulnerability.
Re: (Score:3, Interesting)
Exactly. Just running Nessus does not a proper security audit make.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Running Nessus produces numbers. Those numbers are then the metrics which management uses to judge how well people are doing their jobs. Lower numbers are always good and higher numbers are always bad.
Comprehension of what the numbers represent, or if they're accurate, is not really relevant from a management perspective. If you show that your numbers are small and keep getting smaller, then any security vulnerability can't be your fault, because the magic number machine says your compliant. It's the sa
Re: (Score:2)
Well considering it was a failed audit, and not just a failed scan, I'm sure they know what they are doing.
Re: (Score:2)
It should be noted that there are various certifications which any company hiring vulnerability assessment should look for, many of them cover in depth how to properly use Nessus, Saint, etc.
Obvious solution to this.. (Score:5, Funny)
We need to create a Department of Department of Homeland Security Security immediately.
Re: (Score:2)
Listen! they're coming up the driveway, out the back door! ;-)...
I think it speaks more to the tools available (Score:2)
Re:I think, Excuses... (Score:2)
Excuses are a major security problem.
In fact, excuses cause major security problems.
No, I am not saying fire the person, because shit happens. Unless the person is the problem looking for excuses for all the shit happening.
Acrobat, Java, and Microsoft (Score:3, Informative)
Re: (Score:2)
A thousand times this.
But, then, I suppose the people who wrote TFA, or are commenting here, don't have a single unpatched copy of Acrobat Reader or JRE around. Am I right?
Cluestick time: while there's problems in government IT, I can guarantee you that many, many large corporations would have fared worse on a similar audit.
Re: (Score:2)
Indeed. I guess the day before yesterday was Patch Tuesday, because as soon as I got home from work and turned my netbook on it said there were "critical updates".
Last night I got another one for Adobe's PDF viewer. Then BitTorrent asked me if I wanted to update it.
I rebooted that thing more in the last two days than I have since I bought it in April. At least BT didn't need a reboot. It was annoying, because I'm trying to DL and try Kubantu with BT and seed my novel and Mandriva with it, and all that reboo
FUD (Score:1)
The lack of details in the paper makes it so that it is impossible to know exactly what they found. Scanners such as Nessus, Foundstone, Languard are really noisy and can report normal system operation as a high vulnerability irregardless of system configuration.
Something like telnet will be a high, but put the proper mitigation such as access list, 2 factor authentication and you can show it as a medium or low.
It's all subjective.
Re: (Score:2, Insightful)
Re: (Score:2)
you find the most grotesque microsoft powerpoint like data crap: a half page picture that is a pie chart with two sectons (figure 4, page 9 in the pdf)
Anyone who would put together such a bs piece of eye candy isn't competant to pound sand down a rathole, even if they do use their spellchecker
Have you ever briefed such a report to management? Management wants to see the 'bottom line' type of information, not piles of information packed into slides.
Pie charts are common on these types of high level reports... remember that managers are looking at this. To get into the nitty gritty and fix vulnerabilities (or invalidate scan findings if they're false positives) the Information Assurance techs would look at the actual Nessus scan findings, not the pretty pie chart (that's for management).
Re: (Score:2, Interesting)
Yes actually I do this quaterly.
We divide the vulnerabilities in 3 category.
OS patching.
OS Hardening.
Application Patching.
By doing this you can focus to the root cause of the issues. System owners, Application owners. It's a nice 2 page report with colours. they love it.
Administrators who care and are not tied up in red tape tend to really shine in these reports.
Another thing to realise is that in a corporate production environment, nothing will ever be 100% secure 100% of the time.
obvious (Score:3, Funny)
Security? (Score:2)
So the Department of Homeland Security's network security measures are approximately equivalent to the security measures on the border between Mexico and the United States.
I am Jack's Complete Lack of Surprise.
The Department of Homeland Security's primary mission is not "security." Its mission is "training the public to be properly responsive to idiotic demands from the Federal Government."
Re: (Score:2)
Heh, that was the first thing I thought of when I read this: "I am Jack's complete lack of surprise."
Which, of course, made me go here. [z31-ae.com]
Grain of salt (Score:5, Informative)
Take it with a grain of salt. The security scan was checklist-based, taking no account of the context. Worse, it's was based on version to database matches, utterly failing to account for backported security patches and similar protections that render specific vulnerabilities moot.
I have no personal knowledge of this specific case. But I've seen it enough times to know what this report really means.
It gets worse. (Score:1, Offtopic)
Taken with a grain of salt.... (Score:2)
Several years ago I was working at a company hired to do a similar outside audit, who ... was in turn of course hired to fix the situation.
I was handed a Nessus by the fellow who did the audit that pointed out several servers were missing critical windows patches in the audit the week before ... and to please go out and patch them. Small problem when I arrived on site ... servers were running Debian. So Nessus might be a great auditing tool, but any report is only as good as the people that ran the tool.
misleading (Score:2)
With Nessus, the "high" severity results are the only ones that really matter. And even then they sometimes don't. For example: "you are using a version of PHP with a security hole in one of the API calls your programs might use" is high, but it isn't a real vulnerability unless you actually use that specific call.
Just like the old saying (Score:3, Insightful)
DHS runs Security checks all the time (Score:3, Interesting)
The Govt. runs security scans on all of their systesm all of the time. They are using tools that are designed to help them make their security tighter and more difficult to hack, and they are improving this all the time. As new security tools come to market they evaluate them just like any corporation. And before they let new applications on their networks, and before any releases upgrades are performed they check security on those applications. All security issues identified must be addressed before applications are put on their systems.
I would have like to have seen a comparison of our Governments security run against some of the Banks and Wallstreet system that hold our financial data. I would suspect you'll find as many or more on the public sector as you will on Govt. sector systems.
1085 high vulnerabilities... (Score:1)
In other news... (Score:1)
DHS CyberSecurity Misses 1085 Holes On Own Network
In other news, bears found to shit in woods. News at eleven!
Dept of Holy Security (Score:1)