Army Buys Macs to Beef Up Security 342
agent_blue writes "The Army is integrating Macs into their IT network to thwart hack attempts. The Mac platform, they argue, is more secure because there are fewer attacks against OS X than Windows-based systems. 'Military procurement has long been driven by cost and availability of additional software--two measures where Macintosh computers have typically come up short against Windows-based PCs. Then there have been subtle but important barriers: For instance, Macintosh computers have long been incompatible with a security keycard-reading system known as Common Access Cards system, or CAC, which is heavily used by the military. The Army's Apple program, created [in 2005], is working to change that.'"
but (Score:4, Funny)
Re:but (Score:5, Funny)
Re:but (Score:5, Funny)
Don't ask, don't tell ... (Score:3, Funny)
They expect the computer to be running MS Office on an Intel CPU. They are not allowed to ask, and you are not supposed to volunteer, whether you are doing so under Windows or Mac OS X. It is a don't ask, don't tell policy, and it upsets a lot of people in the Bay area.
Re: (Score:2)
Don't ask, ... (Score:3, Funny)
US Army used Macs in/since 1999 for servers (Score:3, Interesting)
i always liked the idea...
from the article: "Until the Army's Web site was hacked in late June by a 19-year old Wisconsin man, the site had been using a Microsoft Windows NT-based Web server..."
How many times? (Score:4, Insightful)
Yes, Windows has vulnerabilities. Windows sucks as far as security goes. That goes for Vista, too. But waving around an OS like it was some magic bullet that's going to somehow fix your security problems is, well, insanity.
Re: (Score:2)
Re:How many times? (Score:5, Insightful)
"More about" is not the same as "entirely about." Sure, a good IT staff with a bad system will be more secure than a bad IT staff with a good system. But a good IT staff with a good system will be more secure than either. And Unix-based systems, including OS X, are demonstrably better in terms of security than Windows-based systems are.
Do you think the Army should go back to using bolt-action rifles? It's true that a good marksman with an M1903 is more useful on the battlefield than a bad marksman with an M16, but
It's about avoiding a computing monoculture (Score:5, Insightful)
If you read the article instead of the headline, you'll see that the Army is making the attack target more diversified, so that a single attack will not bring down all computers. What's wrong with that tactic?
Re:It's about avoiding a computing monoculture (Score:5, Insightful)
Sure, it's cute and cheap to run everything on any one platform, but like they always say "spread out or one grenade will get you all".
Re: (Score:2)
Serial, not parallel (Score:4, Insightful)
When protecting data, think "serial" and not "parallel". You won't get extra security by diversifying your OSs because hackers don't need to hack ALL of them, but just ONE of them, to compromise data. This is not a case of "redundant systems", but rather a case of "the weakest link". The more OSs are supported the more chances that AN OS will get hacked (as opposed to ALL OSs), but when it comes to protecting data, hacking that ONE OS is all it takes. Hackers are certainly more agile than the government, and the government should try to minimize its profile, together with hacking avenues, rather than build redundant systems where redundancy is not the solution for the problem at hand.
In other cases when the issue IS parallel, such as protecting a mission-critical system (think Space Shuttle), then yes, multiple OS's increase the chance that any one will survive. But this doesn't apply to data security. They should stick to one OS as well as one of everything else, preferably as secure as possible (NetBSD, some Linux distros, etc). But even JUST Windows is more secure than Windows and OTHER stuff together, because you keep all the risks of Windows while adding the extra (even if relatively smaller) risk of the other system on top of the original risk.
one point of failure (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
However, predictability poses a significant security risk. If I know exact
Re: (Score:3, Interesting)
Re:Serial, not parallel (Score:4, Insightful)
And your point is? That extra security costs money?
When protecting data, think "serial" and not "parallel". You won't get extra security by diversifying your OSs because hackers don't need to hack ALL of them, but just ONE of them, to compromise data.
In one instance you may be correct, but in other instances, you are not. Whether or not data are compromised depends upon how that data are partitioned and where the data reside.
You do get extra security by diversification, because you have the ability to continue to function while one OS's computers are struggling with a malware attack.
Note that the article is not saying that diversification of OS will make an installation 100% secure, just that it will improve the likelihood of continued operation albeit at reduced levels.
Re: (Score:2)
Re: (Score:2)
It is like securing your house. Having Locks on the door is better then not even though most anyone could with some effort break the door down to get in. A strong
Re: (Score:3, Funny)
Magic Bullets Kill... sometimes not who you think (Score:5, Insightful)
Not any more.
If the army is using it for that reason then you know the Chinese, Russians, and any other tech savvy nation will now point their hackers at Macs.
Re:Magic Bullets Kill... sometimes not who you thi (Score:3, Insightful)
Re: (Score:2)
On the other hand, securing a network means knowing how to secure each kind of host on it, so you don't want to have an unlimited number of platforms. You'd probably have a significant problems with them at any time.
If operating at all times, even under attack by a determined and wel
Re: (Score:2)
I don't see the Military switching to OS X for everything then wiping their hands and saying "we're done, it's secure now."
security by obscurity and evolution (Score:2)
waving around an OS like it was some magic bullet
The security partly comes from using an uncommon OS, not just a more secure one. It's a security by obscurity thing... and although obscurity may not be a perfect measure, it's good when it's coupled with a truly more secure OS.
This implies that the perfect obscurity would come from a homebrew computer system, designed and built in its entirety in one's home. And if it were designed to be secure by default and its creator was a perfect mathematician and engineer, then it would probably be the most sec
Re: (Score:2)
But waving around an OS like it was some magic bullet that's going to somehow fix your security problems is, well, insanity.
Google "sane defaults". Windows fails miserably in this regard, as does much commercial and free software. Apple usually gets sane defaults right, at least from a UI perspective, but the only group of people (as far as I am aware) who have put a lot of thought into sane defaults from a security perspective is the OpenBSD group. Making sure that things work securely, out-of-the-box is important, because IT shops are often in need of something quick-and-dirty. Often those quick-and-dirty implementations
Re: (Score:2)
How many times do I have to keep telling people that security is more about the skill of the IT staff than it is about the operating system it runs on?
I'd argue the skill of the IT staff includes choosing appropriately secure and securable OS's for your purpose. For example, in a university setting, choosing to supply all students with an laptop running OS X or Ubuntu, may well solve 90% of your security problems, whereas choosing laptops loaded with Windows to distribute, may well make securing your network with the resources available impossible.
But waving around an OS like it was some magic bullet that's going to somehow fix your security problems is, well, insanity.
In some cases, choosing the OS does solve most security problems, and that is just the way the malware
Re:How many times? (Score:5, Insightful)
Yeah. Totally not worth it.
Stop perpetuating simple-minded myths.
Re: (Score:2)
Re: (Score:2, Insightful)
"Security through obscurity" (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Re:How many times? (Score:4, Insightful)
Well, if they mix the OS-vendors like they (finally) mix aircraft-engine suppliers [aviation.com], it will be harder for an adversary to knock out all computers with the same (cyber-)attack. If a flow is found and/or exploited in some of the systems, they can be shut down and the same tasks performed on systems of (an)other type(s).
This argument — strength of diversity — floated here before...
Re: (Score:3, Interesting)
This presumes, the systems are always used in sequence (links in a chain), rather than in parallel (say, like a fishing net). This presumption is false.
For example, if half of a unit's desktops have to be shut down due to a particular flaw (in design or in implementation — does not matter) in their OS getting exploited by the enemy (or for some other reason, such as
Re: (Score:2)
By the time the knowledge is ported over the Army will have seen it coming. The fact t
Re:How many times? (Score:4, Insightful)
Money.
According to one of these links, a press release, on Google [google.com], ID thieving alone "costs more than $56 billion, or $6383 per victim, annually". That's US, obviously.
Social hacks (phishing) can be done to anyone clever enough to hold a conversation but stupid enough not to be even slightly cynical when strangers start asking certain questions. But many phishing techniques ask the hapless victim to download an attachment, or get access to the victim's computer using online foot-in-the-door tricks like eCards that are more than they appear [hexus.net].
What's the level of Mac penetration? 5%? 8%? Let's say it's the lowest number. Five percent of $56 billion is still $2.8 billion a year. If anyone manages to write malware that could spread in the way PC malware can multiply, especially with the average Mac user's attitude ("virus protection? Why should I save a PC user's arse when I send them Word documents? My iBook's fine..."), imagine the draw for crime syndicates. A guaranteed first shot at nearly three billion EVERY YEAR.
And yet it hasn't happened. An illegal industry that pays better than drugs, without the inherent violence on the streets, and Mac users steadfastly refuse to get fleeced.
Which means either the criminals either aren't really that hungry for this potential sector, or there's an easier way to get the money.
Just having the standard feature in a Mac that asks for your password for any new program being installed means you're put on guard. "Hey, I went to see this funny ReindeerYourself card and it's asking for my passowrd? No way..." and the keylogger software remains off your computer. It wouldn't matter if Mac penetration was 12%, 15%. If it's so much easier to hack the PC system for financial gain, it's not financially viable for anyone to write the keylogger software and then wait for enough Mac owners to be stupid enough to install the software to recopu their costs. Just let Windows users visit the page you mass-maile and enough will click the link with high speed connections. Ker-ching.
So this is finally put-up-or-shut-up for the Windows fanboyz. If the US Army puts its weight behind it, this shifts the whole landscape for writing malware. You see: before this announcement, any jihadist that wanted death to America would just do what all the other fanboys did: learn Visual Basic and send away. But now? Now they'll need to try and sneak through the Mac architecture. And unlike the Russian Mafia, cost isn't an issue. The 'enemy' will throw everything they have to bring the Army system down. Cost isn't an issue if money is not what you're after.
So if it turns out that a world full of hate-filled terrorists that care nowt for money can't hack their way in, what then for the Apple bashers?
Re:How many times? (Score:4, Insightful)
One small step (Score:5, Funny)
Re: (Score:2)
CAC on OS X has been working for a while... (Score:5, Informative)
Support is built into Safari, and it is possible to set it up to log into a Windows domain, I believe.
Re: (Score:2)
But you can use any number of a bunch of commodity USB smartcard readers and do just fine on the Mac. The drivers are all there; once enabled [apple.com], it's pretty slick actually. At least as of a while ago, Apple actually had at least one full-time employee working
According to Hollywood (Score:4, Funny)
Life imitating "art"?
Re: (Score:2)
That's far deeper and more profound than I think you meant it to be...
I'm stumped. (Score:4, Funny)
How will they know if the user prefers a Mac or PC with their "Don't ask, don't tell" policy?
Re: (Score:3, Funny)
Like flies to honey (Score:2)
Not that it's more secure because it's better, but because there are fewer attacks? Won't adopting give hackers more incentive to attack it? They shouldn't judge the OS based on how many attacks there are now, but on how secure it can be made since one would assume that anything the government runs is interesting to hackers.
Re: (Score:2)
Re: (Score:2)
Yes. But.
Attacks most often propagate from machine to machine via worms or botnets or whatever. The more homogeneous the network, the greater the transmission probability from one node to the next (if you have an all-Windows network, then something that penetrates one machine will penetrate the next one). Attackers generally have to choose an OS which they want
Re: (Score:2)
Ask just about any security expert which design philosophy they like better and I'll bet hands down UNIX wins over Windows.
No surprise (Score:3, Funny)
Wait a minute (Score:2)
Computer security specialists (Score:5, Interesting)
The clear majority of the really high end computer security people I know are driving Macs. On the military side Army and Marines seem to be tinkering more with Linux. The Marines less so because of NMCI, but there was a demo of battlefield information system that was Linux based. Navy and Marines have pretty much locked themselves into Windows desktops managed by EDS on the administrative side. A move I believe will go down as one of the great defeats in Naval history, with casualties of 250 million American taxpayers.
Don't know about the Air Force but the few AF people I've met at conferences seemed pretty on the ball and struck me as Linux curious if not outright supporters.
Re: (Score:2)
Re: (Score:2)
I've seen this before... (Score:4, Funny)
"Sir, I have the DOJ on line 2."
"Tell them to get Bill Gates in here."
"Yes sir."
(door opens an hour later)
"Bill Gates, you told us Windows Vista would be more secure!"
"It IS more secure, over five million...(BLAM)"
Military Intelligence (Score:5, Funny)
PC: and I'm a PC
Military Intelligence: And I'm no longer an oxymoron
Summary is Totally Misleading (Score:2)
I'm not trivializing the work that would need to be done to work in a DOD environment where most of the CAC-enabled apps need a osX port. The low-level strong authentication portion is done.
In true government contracting fashion, the bulk of the work is done by Axalto, with some DC-based project management middleman cashing the Fed's checks. Axalto is probably barely breaking even on the project despite the huge volume of cards in the field.
Story is a bit late (Score:2)
Can't compare Mac OS and Mac OS X (Score:2)
Bootcamp (Score:5, Funny)
So does that mean they will be cheaper soon? (Score:2)
Re: (Score:2)
While Apple systems have always been slightly higher priced (when compared to equal pc systems not home made random part systems) I figured this was mostly do to higher manufacturing costs.
Actually if you compare just hardware, from other vendors with similar reliability ratings, Macs are about the same price as other PC hardware. The last study I saw put them at about 20% above average in price, which is about the same as Sony (who also sells mostly mid and high end machines with top end reliability ratings). Apple systems are about the same cost as any other PC, assuming you're looking at all the hardware criteria, not just bullet points. And by all the criteria i.e. a system with a 120 G
The Black Mac (Score:2)
very short-term solution (Score:2)
No open ports (Score:3, Informative)
2) Bonjour is ZeroConf is Open Source. And included in Darwin...
You don't have to assume anything, you can see it right there on a stock install.
Aqua really is a lot more of a window manager, it's not there to handle things like Bonjour.
Hell is a bit colder today (Score:4, Interesting)
Bah, MI-5's been doing this for years (Score:3, Informative)
But on the more serious note:
Why not Linux?
A: http://www.openbsd.org/ [openbsd.org]
Which at one time was a DARPA funded project.
Re: (Score:2)
Re: (Score:2, Informative)
Navy Macs ran Yellow Dog Linux not Mac OS X (Score:2)
Are you thinking of the onboard sonar processing software used in submarines? Mac hardware was chosen because it was PowerPC based and PowerPC had a big computation advantage over Intel for this particular application. The PowerMacs were running Yellow Dog Linux not Max OS X, they were replacing Suns.
Re:OpenBSD??? (Score:4, Insightful)
I think they should use tools available cross-architecture for their software, and then have a multi-arch setup. For example:
30% Free/Net/Open BSD
30% Linux
25% Mac
15% Windows
This would alleviate the issues of an entire-network compromise from potentially overlooked vulnerabilities in any one system. Because you can get fairly simple general interaction for the operating systems listed (given modern desktop environments offered on Linux/BSD, Mac would be the most "different" and not terribly so even then), and applications That had cross-platform natures would be all that's used, there would be little difficulty for the end users to go between systems.
Re: (Score:2)
Diversifying the set ups would help, in the sense t
Re: (Score:2)
Actually, given that it is military and should have very fine grained security, nobody should have the rights to install a program, not even on their own space, except administrators. Such a system should be fairly user proof, except for the data the user can access, and at that point, password rule constraints in the software can get rid of the biggest problem for the standard user.
It's not something I would put on a home sy
Re:OpenBSD??? (Score:5, Insightful)
Files should be locked, So while the Admin's can see them, move/copy them, they can't actually open the file itself. security should extend to more than just the file system, but to the files themselves. Of course being open to all should also be a manual changed possibility.
I wonder how long it will take for someone who makes more money than I will ever see to figure that out.
Re:OpenBSD??? (Score:4, Insightful)
One of the biggest security problems is when security reduces usability to the point where users bypass the security for convenience, or simply because it is easier. I've even seen situations where no one had rights to install any software because of security policies, and the admins were then ordered to look the other way for security violations in general because a company still needed to get work done and make money. Good security does not reduce usability. If users don't have the ability to run the software they want to, you've greatly reduced usability and should not be surprised when users start rebooting from a flash drive or working on their home PCs with basically no security.
Re: (Score:2, Funny)
5% Gentoo
5% Slackware 5% !Suse 5% Red Hat 5% Ubuntu 5% SELinux
Re: (Score:2)
Re: (Score:2)
And as to your Redmond comment
Re: (Score:3, Insightful)
So I guess AIX [ibm.com], HP-UX [hp.com] and Solaris [sun.com] don't have large corporations backing them.
Always best to be careful what you say about who does back those three, they all seem to have blood thirsty ninja vampire lawyers to hand...
Corporate Backing? *Windows*?! Ha! ha! (Score:2)
*(even their 'patent protection' program allows them to say 'stop using that software/feature',, with impunity.
Re: (Score:2)
Re:OpenBSD??? (Score:4, Insightful)
Re:OpenBSD??? (Score:5, Insightful)
Re:OpenBSD??? (Score:4, Insightful)
Of course, even restricted to these choices, Solaris might have been a better choice. OSX is the sort of vendor lock in I would hope my taxpayer dollars wouldn't go toward supporting. Windows is bad enough, but with OSX you get lock-in of hardware and software. Recalling how skiddish the US government got about Thinkpads and the like when Lenovo bought those bits, I wonder what the contingency plan would be if Apple sold off their computing bits to an offshore company. Even in and of the software platform itself, despite the Darwin base, OSX software tends to require the proprietary Quartz/Cocoa underpinnings, so supporting third party software with new hardware without Apple's blessing would be challenging. Windows is a little better in terms of hardware support, but the software portion is bad enough, though at least there is an excuse of the market situation as to why they haven't thrown it out completely.
Meanwhile, Solaris has an equally reputable backer, doesn't implement many proprietary APIs that common applications would make use of (AIX goes this far as well), has an unlocked x86 implementation (no hardware vendor ties, unlike any other officially certified UNIX), and is also under an open source license. In terms of an official UNIX with options for contingency plans, it doesn't get better than that.
*BSD, Linux, et. al. may or may not be even better choices, but this was sticking strictly to the assumed criteria of being able to officially declare it a Unix system.
BTW:
Re: (Score:2)
Re: (Score:2)
Re:why not liunx it is free and runs on any x86 ha (Score:4, Insightful)
Re: (Score:2)
Re:why not liunx it is free and runs on any x86 ha (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Because Linux is for European communist queers who pirate music. Macs are all-american and manly (sort of).
Seriously though, its probably to do with letting Apple join in at the endless corporate trough that is the US military, in order to expand their domestic support. Geeks will be more likely to be in favour of an idiotic war if it generates tech jobs.
Also, the international, share-everything ethos associated with Linux is unlikely to be popular with the people who came up with ITAR.
Re:OMG Terrorists will attack Macs! (Score:4, Informative)
Beg to differ, OS X at install pretty secure (Score:5, Informative)
2) On install, OS X makes you chose a username so you have to log in to use the system.
3) OS X by default is suspicious of all content coming in from the web.
OS X already starts out with a high level of security, and doesn't do anything that would lead a user to weaken that without need (say opening a port for printer sharing).
Army buys BigMacs to Beef Up (Score:2)
Anyway, who else has a hard time imagining an army without right clicks?
Re:Army buys BigMacs to Beef Up (Score:5, Funny)
Re: (Score:2)
You're right, though. I sincerely hope they know about Leopard's "firewall" issues and can read man pages.