Slashdot Log In
US Government to Have Only 50 Gateways
Posted by
Soulskill
on Sun Apr 20, 2008 08:19 AM
from the e-downsizing dept.
from the e-downsizing dept.
Narrative Fallacy brings us a story about the US government's plan to reduce the roughly 4,000 active internet connections used by its civilian agencies to a mere 50 highly secure gateways. This comes as part of the government's response to a rise in attacks on its networks.
"Most security professionals agreed that the TIC security improvements and similar measures are long overdue. 'We should have done this five years ago, but there wasn't the heart or the will then like there is now,' said Howard Schmidt, a former White House cyber security adviser. 'The timetable is aggressive,' he said, but now there is a sense of urgency behind the program. Small agencies that won't qualify for their own connections under TIC must subcontract their Internet services to larger agencies."
Related Stories
[+]
IT: Chinese "Cyber-Attack" US Department of Commerce 161 comments
Kranfer writes "The register has an article about how the Chinese have recently launched an attack against the US Department of Commerce. From the article: '...attacks originating from computer crackers largely located in China's Guangdong province are aimed at extracting sensitive information from targets such as the Commerce Department's technology export office. Security consultants and US government officials reckon the assaults have at least the tacit support of the Chinese government...' This is not the first time Chinese hackers have attempted to gain access to US Government systems."
[+]
IT: Inside the Secret War Against Internet Spies 116 comments
ahess247 brings us a lengthy BusinessWeek story on the increasing amount of attacks against the US government's online presence as well as its contacts in the private sector. Hackers are gaining a greater awareness of where valuable data might reside, and that awareness is leading to more precise, more sophisticated attacks. Quoting:
"The U.S. government, and its sprawl of defense contractors, have been the victims of an unprecedented rash of similar cyber attacks over the last two years, say current and former U.S. government officials. 'It's espionage on a massive scale,' says Paul B. Kurtz, a former high-ranking national security official. Government agencies reported 12,986 cyber security incidents to the U.S. Homeland Security Dept. last fiscal year, triple the number from two years earlier. Incursions on the military's networks were up 55% last year, says Lieutenant General Charles E. Croom, head of the Pentagon's Joint Task Force for Global Network Operations. Private targets like Booz Allen are just as vulnerable and pose just as much potential security risk. 'They have our information on their networks. They're building our weapon systems. You wouldn't want that in enemy hands,' Croom says. Cyber attackers 'are not denying, disrupting, or destroying operations--yet. But that doesn't mean they don't have the capability.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Is it just me... (Score:2)
I mean, really. Perhaps ensuring the standards and procedures are actually adhered to would be a much cheaper and less drastic change.
Re:Is it just me... (Score:5, Insightful)
Trying to maintain standards and practices across 4,000 gateway points vs 50. Let alone the agency bureaucracy that would be involved in doing site checks and working across various agency boundaries would be a nightmare. It would take eons to get those things in place to do consistent auditing and management to ensure standards and procedures are followed, let alone actually do them. Might as well consolidate bandwidth costs and number of checkpoints down to 50 in the process.
Parent
Re: (Score:2)
I'm thinking two things:
1) You are concentrating access points (and thus increasing the likelihood of failure given concerted attacks [like DDoS for example])
2) With a small definable limit of access points you are decreasing (or eliminating) the possibility of honeypots (and counter-surveillance)
Re:Is it just me... (Score:5, Insightful)
Let me see...
With 50 gateways, if the internal network is built correctly (unlike say a how certain cable company does their's), then I can not think of any real net negatives except the complexity of the internal network now. But, given the serious issues the 4000 has, the complexity of the internal network is a relatively non-existent issue.
InnerWeb
Parent
Re: (Score:2)
Re:Is it just me... (Score:4, Insightful)
1) you assume that the 50 gateway points will be managed properly.
2) you assume that access to those gateway points will be managed effectively.
3) you assume that the underlying network design is intelligently put together.
Since this is government work, I would throw in an entirely different set of assumptions:
1) The contractor doing the work will be foreign.
2) The contractor doing the work will have less than solid training in putting together nationwide internet scale networks.
3) The underlying networks will mostly have already been compromised.
4) The project will take at least 2 times longer than predicted to complete.
5) The project will be considered complete before most of the network guru's here on slashdot would consider it complete.
6) The project will likely introduce a 2 or 3 point of failure potential rather than a 50 point of failure potential. If you have trouble imagining such a poor design, you haven't experience with government contracts.
I think the missing tag here is "whatcouldpossiblygowrong?". Knowing that something major WILL go wrong, as with all federal projects, you have to weigh the risk of moving forward against the risk of not moving forward. The realistic risk of moving forward is:
1) a significant portion of the networks will go down and leave several agencies without the capability of getting anything done.
2) a downtime in the network will present a very real and very dangerous national security issue.
The risk of not moving forward?
1) Data currently deemed secure is widely compromised. (in fact, this has probably already happened)
It's an arguably good idea on the surface. But really, shouldn't the nation that brought the world the internet have the most well thought out and effective network infrastructure in the world? A change to the underlying network is a solid idea. This change? This change is the result of small minded thinking and government work.
Parent
Re:Is it just me... (Score:5, Insightful)
I think the assumption is more along the lines of:
50 gateway points are more likely to be managed properly than 4000 points.
Those 50 points will have a great deal of attention and resources allocated to them, about 80 times the amount per point of the previous 4000 points.
When the government really cares about a project (read military) they can be very intelligent, just look at the stealth bomber. They are only haphazard when it is a project that exists only to please the public (read medi-care, or social security)
Parent
Re: (Score:2)
Re:Is it just me... (Score:4, Insightful)
Since we're supposed to be the government (of, by and for, you know) the more places we can interface with it the better.
We've been trained by 27 years of "Conservative" control of government and media to see "government" as some alien entity over which we have no control and which only acts to make our lives unpleasant. St. Ronald was the first to really market this erroneous notion, and it really disrespects the clever and elegant plan our founding fathers laid out for us.
This meme of "drowning government in a bathtub" is so ubiquitous that even some smart people are lazily spreading it, as you have done.
If you've recently driven on a US highway, or if you're one of the unlucky ones under whom a bridge recently collapsed in Minnesota, you know first-hand what happens when "the commons" are neglected.
The strangest thing about this whole story is that we are constantly told that the US is a "Christian Nation" yet the idea of "care in common" which is anathema to Republicans is a most Christian notion. But I guess it's to be expected when hypocrisy is the new black.
Parent
Re: (Score:3, Insightful)
Only the "projects" on American soil. Have you seen some of the plans for "projects" in Baghdad and Kosovo? Military bases the size of Disneyworld.
The "Fed" is us, smitty. The "State" is us. That was rule one of our Constitution. By demonizing the US Government, Ronald Reagan began setting up a "privatized" government that would benefit a very few. He also started
From lots of little contracts to BIG CONTRACTS! (Score:5, Insightful)
Parent
Re:From lots of little contracts to BIG CONTRACTS! (Score:5, Insightful)
And, as a taxpayer, is a legitimate question that should be addressed by our Government. Especially, when, not if, it comes to light that the project runs over budget by millions of dollars which they inevitably do. Disgustingly, fleecing of the taxpayer has become de rigeur.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
I think you misread. What they said is:
"Small agencies that won't qualify for their own connections under TIC must subcontract their Internet services to larger agencies."
I think that means they are keeping it in house so to speak and causing small agencies to contract with large agencies for
DoS??? (Score:5, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re:DoS??? (Score:5, Interesting)
Nothing new here really. Most of those 4,000 gateways are already at least several racks of hardware. I doubt that the vulnerability to distributed attacks will go up as a result of lowering the number of vectors. If anything, having 50 standardized and more carefully monitored gateways will probably further harden them against attacks. (is YOUR gateway patched?)
Of course the other viewpoint is if all 50 of them are being administrated by the same group or a group under central control, when a vulnerability DOES surface, (and they alway so) they will probably ALL be vulnerable since they are standardized.
Assuming they have their heads screwed on straight, they will at least be using somewhat of a variation of several hardware and software vendors to prevent this. As it is now, if a serious problem is discovered in a high end bit of router hardware, it may force downtime on maybe 300 gateways while traffic routes around them. If all 50 are using the same, what do you do then? Flip the kill switch and take down the entire country's internet whilst you fix it?
I want to hear that phonecall. "Hello, Cisco. We're calling in regard to this morning's zero-day bug 433-86b in regard to your model 822 enterprise gateways. We're down, we need a fix now. No, DOWN. The entire country. Yes, really."
I'd be interested to know how China handles their great firewall. Are there details posted anywhere? Somehow I don't think they'd terribly mind taking down the entire country's internet for a day or two for national security though. (and "for reasons of national security" is very loosely interpreted in China it would seem)
Parent
Re: (Score:3, Informative)
Re:DoS??? (Score:4, Funny)
A truly excellent idea. When (if) they finish this project, it should be pretty trivial to have an "Internet-free day" at Government agencies. No Dilbert! No Slashdot! Just actually do something!
On second thought, this may not be such a good idea. Carry on.
Parent
Re: (Score:3, Informative)
Sort of. While there would be fewer targets, in theory the gateways would have very high levels of connectivity, resources, and knowhow behind them that might not exist with smaller agencies doing their own thing.
More importantly, think in terms of what the attacker is trying to do with a DoS and what the US government is attempting to do with the network. DoS attacks are frequently used as an extortion technique. This obviously won't work against the US governme
Blocklists (Score:3, Funny)
Hopefully this will work out better (Score:5, Informative)
Netcraft [netcraft.com]
When the U.S. Justice Department stepped up its investigation of cybercrime, it found spam originating from an unexpected source: hundreds of powerful computers at the Department of Defense and the U.S. Senate. The machines were "zombies" that had been compromised by hackers and integrated into bot networks that can be remotely controlled to send spam or launch distributed denial of service attacks.
(this link also mentions the older Republican access of the Democrat fileserver)
Re: (Score:2, Funny)
So THAT explains all of the 'enlarge your gun' spam!
Newbie Mistake (Score:5, Funny)
Re:Newbie Mistake (Score:5, Insightful)
Parent
Everybody's so cynical here (Score:4, Funny)
One could lead to the other... (Score:5, Interesting)
After they do a project this large for their own network they'll have the experience necessary to do this across the board.
If they do that at the major trunks running in/out of the US that pretty much would be the end of unmonitored access for anybody on the 'net in the US. (Not like ISPs in a lot cases aren't logging stuff now but there's a big difference between that and a government run filter.)
Regardless it certainly bears keeping an eye on this to make sure it doesn't show signs of creep or expansion beyond government use.
Re: (Score:3, Interesting)
My country (Australia) has only a handful of international links (I think it is around five), and it is still improbable that a Government could monitor all that data. They can filter out everything but "persons of interest", but t
Some Generals Were Getting A Tour Of The Internet (Score:2)
At the time there were only seven connections between the Internet and the MilNet. One of the generals asked how they could be disconnected in times of war.
Before their guide could answer, another general piped up with "Explosive bolts".
Performance will be awful (Score:2)
Imagine if bittorrent decided to say "screw the distributed client model", we'll just host 50 giant sites with all the files stored on them. Yeah, that just wouldn't work....
Say what now? (Score:2)
Because the back-end databases contain proprietary information that could be private or even classified, the back-end networks need additional protection to fend off hacking attempts from outside. A separate layer of firewalls inside each agency's network will provide security by insulating the back-end systems from the rest of the network, Bradner said.
Since when was classified data allowed to be anywhere near an internet facing computer?
Are they abandoning the airgap policy or something?
There must be 50 ways to hax0r your server (Score:2)
Waivers. Lots of waivers. (Score:3, Interesting)
When the DOD did this, no new money was provided for the switch, vendor "H" was the only source of outside assistance, at their usual outrageous prices, and everyone who could waivered out.
Re:Great Wall of China (Score:4, Insightful)
Parent
Re: (Score:3, Informative)
Cheers
Re:Great Wall of China (Score:5, Insightful)
Parent
Re:Great Wall of China (Score:4, Insightful)
You'd have to be a dumbass to leak material via your workstation in a government facility. Actually, you wouldn't be a dumbass, you'd be a Guantanamo inmate.
Parent
Re: (Score:3, Interesting)
Re:Great Wall of China (Score:5, Funny)
As far as a practical implementation, I imagine that behind the network's regular firewall, one would just place a container of tigers (a "Tigerbox") that way. The firewall will work as a general security measure, but if a hacker were to break through into the network, he would be immediately eviscerated by tigers. I suppose that in theory, one could even get rid of the firewall entirely, like you suggest, and protect the network entirely with tigers. I'm not sure how practical this would be, due to the increased number of tigers required. However, it might be feasible in a few years once tigerboxes are more popular and the market begins to flood with cheap commodity tigers.
Parent
Re: (Score:3, Interesting)
Re:Great Wall of China (Score:4, Funny)
Parent
Re: (Score:2, Informative)
So...the Great Wall of San Diego (Score:2)
Re:Great Wall of China (Score:5, Insightful)
First, there is no consensus that the Great Wall was created to keep citizens in, as nice as a soundbyte as it makes. Second, history does not show what you claim it does. Off the top of my head, European castles, the Maginot Line, the fences around U.S. military bases in Vietnam, the fences Israel uses to restrict Palestinian access to Israel itself, and the fences that the U.S. attempts to use at the Mexican border to keep illegal immigrants out are all examples of fences designed to keep the "other" from coming in.
In fact, fences being used to keep _citizens_ in is relatively uncommon. They are most commonly used to keep the "other" out, to mark property lines, or to keep animals, livestock, or children within a certain area.
But in any case, what exactly is your point? That you can compare the actions of a feudal society's relationship to its people to basics of computer security in a pithy two sentence statement and be insightful? Would you also claim that the edifice of WSUS for patch management is another example of the man trying to keep the federal employees down? Your fence analogy doesn't even hold up - this is a _gate_ - designed for deliberate flow to and fro.
The article does specifically state that the monitoring systems are designed to keep certain information from leaving via the internet (whether intentionally or not) but that doesn't indicate that this is some feudal oppression system to choke the minds of federal employees. They are free to use whatever internet provider they wish when they get home, are they not? It's a firewall on steriods designed to protect government computers and data. Don't try to make it into something that it's not.
Parent
Re:What does gateway limiting *really* help? (Score:4, Interesting)
If the connections between different departments are also forced to go through only these 50 departments, that would ensure a further layer of protection.
It is *much* easier to defend a centralized infrastructure (like this) then to defend something random.
This is the same like in real life. Defending a castle is much simpler than defending the village. Yes castle failures are more spectacular and do more damage, but they occur so much less that it's worth to build them anyway. Breaches in the security of a "village" are constant, unfollowable and you cannot prevent them.
So from security standpoint
Parent
Re: (Score:2)
Suggesting that government contracts stifle innovation simply because of their size is also ridiculous. The government is a large entity, but by no means the only one. In fact, consolidating and centralising capacity
Re: (Score:2)
The "gateway" methodology is the basis for pretty much all security, physical and computer. How do you think security on a military base works? You keep out people who aren't supposed to be there. It doesn't mean that someone who is supposed to be there isn't working contrary to your best interest, but it eliminates a bunch of the low hanging fruit so you can focus your
Re: (Score:2)
Couple things. They don't have the technology to conquer the west. They don't. We know that. The leaders of the USA know that. We both out number and out gun them. If we really were as threatened by [the Muslims] as the media says, lets evaluate what would happen.
Navy Seals would be dispatched to seize every oil facility in Saudi Arabia. After that. We would carpet bomb and drop
Re: (Score:2)