Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Software Government IT Technology

DHS CyberSecurity Misses 1085 Holes On Own Network 86

Tootech writes "In a case of 'physician, heal thyself,' the agency — which forms the operational arm of DHS's National Cyber Security Division, or NCSD — failed to keep its own systems up to date with the latest software patches. Auditors working for the DHS inspector general ran a sweep of US-CERT using the vulnerability scanner Nessus and turned up 1,085 instances of 202 high-risk security holes. 'The majority of the high-risk vulnerabilities involved application and operating system and security software patches that had not been deployed on computer systems located in Virginia,' reads the report from assistant inspector general Frank Deffer."
This discussion has been archived. No new comments can be posted.

DHS CyberSecurity Misses 1085 Holes On Own Network

Comments Filter:
  • Idiots (Score:3, Informative)

    by Zeek40 ( 1017978 ) on Thursday September 09, 2010 @09:27AM (#33520178)
    This is why the government always ends up hiring contractors to do the jobs they already pay their own staff to do.
    • no this is what you get with outsourced IT The state of VA went with Northrop Grumman that did not work that good.

      • by erroneus ( 253617 ) on Thursday September 09, 2010 @09:51AM (#33520684) Homepage

        This is exactly correct. They would rather hire contractors who CLAIM they will do things so that they can fire them later when they don't do it. If they actually hire good people, they have additional egg on their faces when things don't go right and the blame game is even harder to sort out. This is all about blame shifting and the appearance of easy "correction." Having worked for DHS for a couple of years, I saw a lot of rather disgusting and disturbing things about the way they hire contractors and then don't oversee their activities. When security screeners were being hired, I witnessed an 18 year old girl being hired as a supervisor and this was her VERY FIRST JOB. She had absolutely zero employment experience and was hired on in a leadership role. Nothing explains this adequately. They had contractors doing the hiring and staffing for that operation and it didn't work out so well. I heard that somewhere between 20 and 25% of the people initially hired didn't pass the background check and were subsequently let go more than a year later so I got to see the process repeat itself AGAIN where they used contractors to do another round of mass hiring and staffing. They never learn.

        • Re: (Score:2, Informative)

          by Paracelcus ( 151056 )

          "18 year old girl being hired as a supervisor and this was her VERY FIRST JOB"

          I guess if I was getting my pole waxed by an 18 year old girl, I'd give her any job she wanted too!

          • Re: (Score:1, Interesting)

            by Anonymous Coward

            It could also have been a family member that got her the job. This being VA, the two might not be mutually exclusive.

        • Yup, I too was hired by DHS via a contractor. My UA was hot for Benzo (I was in the middle of a messy divorce, but had no script), I told the Dr at the physical and they passed me through. I left for the same reason you mention. No rhyme or reason for speciality hires. Myself and another highly qualified co-worker applied for a IED detection instructor position and it was awarded to a 55+ year old woman who had probably never seen an explosive in her life. I left a few weeks later. My co-worker lasted a few
        • "This is all about blame shifting and the appearance of easy 'correction.'"

          Congratulations! You just gave the best definition of what a bureaucracy is!
      • by Divide By Zero ( 70303 ) on Thursday September 09, 2010 @10:05AM (#33520982)
        Commonwealth of Virginia != Department of Homeland Security.

        This is an entirely different issue. The Virginia thing was a waste of money and an added frustration which, as anyone who's been to Virginia DMV can tell you, is NOT necessary.

        What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.

        While it's very difficult to keep out an experienced, dedicated attacker, you could at least shore up the defenses enough to keep the /b/tards and script kiddies out.

        • Re: (Score:2, Insightful)

          by Hylandr ( 813770 )
          I have done work with the government and had to participate in this scanning before bringing new hardware aboard a military facility.

          Their scanning software requires remote access to the registry from a central scanning computer and looks for every "recommended" patch, setting, or configuration and throws a flag for every non-compliant instance it finds. The list of recommended settings are often security theatre regimen or disastrously harmful to performance. But someone convinced congressman Y,Y,Z tha
          • I don't know that what you experienced is quite what the article's talking about.

            I'm not at DHS-OIG, but in reading their report, it looks to me like it's a pen test or internal vulnerability scan, not an inventory of what patches they have installed. Nessus exists to find actual holes, not just see what patches you had installed compared to FDCC. The report said a Nessus scan found 202 high-risk security holes (as well as 338 medium- and low-risk) in 1085 instances on 174 computers, not just missing

        • What we're looking at here is the one Cabinet-level department specifically charged with maintaining IT infrastructure getting nailed by their IG for having a security profile slightly better than your average baby's candy protection perimeter.

          ?!? Where are you getting this analogy from? ?!?

          Can't you think of an appropriate car-themed analogy?

    • More likely this is what happens an organization does not have processes for execution and validation. Regardless of whether they are contractors of FT's if no one audits their work this can happen.

      • Re:Idiots (Score:5, Insightful)

        by mcgrew ( 92797 ) * on Thursday September 09, 2010 @10:10AM (#33521078) Homepage Journal

        No, its that DHS has nothing to do with true security. Their job is security theater, as evidenced at any airport. The Armed Forces and National Guard are there for the real security.

        DHS is a waste of good tax money. It should be spent on infrastructure.

        • Re: (Score:3, Insightful)

          by Bigjeff5 ( 1143585 )

          It's almost like "The Ministry of Truth" in Orwell's 1984 - it was the propaganda machine for the government, and therefor was responsible for spreading lies far and wide.

          DHS is similar, though not exactly a polar opposite of what its Orwellian name would suggest. It spreads the feeling of security without securing anything. The guys who are actually doing anything to prevent terrorist attacks are folks like the CIA and FBI. DHS doesn't do shit.

          For example, I know a guy who accidentally brought a box cut

          • The folks who are actually collecting big paychecks are well certified, qualified, legitimized... and they got BM (business management) degrees.

            Also, DHS provides many more big paychecks for the DC, Virginia, and Maryland .gov+.mil+.com money pit.

            If you are unemployable, move to the DC, Virginia, and Maryland area where more .gov+.mil+.com easy-jobs move every year. They need janitors and maids. The other jobs are for family and friends of family; Hence, an 18yo woman can be a fully certified, qualified, l

        • by Locutus ( 9039 )
          The DHS was Bush's jobs program. I thought it should have been called the "New Central Central Intelligence Agency".

        • One correction. The DHS LOCAL affiliates, the county Emergency management agencies, usually do a pretty good job of mobilizing local resources (like the Red Cross, etc.) to respond to local situations like tornados and minor flooding. These are the LOCAL groups that are affiliated with FEMA, which is under DHS. They get overloaded when there is a major emergency and the federal people have to take over, but in a local situation these people do a tremendous job.
      • this is what happens an organization does not have processes for execution and validation

        They do, or this story wouldn't exist. The DHS audited its own systems and this is what they found. If they were a company, they would just quietly fix the problem (or not) and move on. Since it's government, they self-report and we get the daily anti-government whine.

        • Re: (Score:1, Troll)

          by NatasRevol ( 731260 )

          Dammit. I was here for the anti-MS whine.

          Cause I knew MS would be at fault just by the title :-)

    • They can transfer the risk all they want, but they are still ultimately responsible.
    • They should fire everyone IT related in Virginia for this offense, and replace them with more competent individuals.

    • The government always ends up hiring contractors, this is why the jobs are already contractors, because .Gov/.Mil/.Com C*O/management get to blame-storm the contractors, the contractors can blame-storm each other, and the public thinks civil servants can't do the job. I know a few .Gov IT/Services folks and they know security basics very well, but they cannot interfere with the contractors doing a questionable job, until post-audit or post-incident.

      Go discover how many contractors are on the .gov/.mil payro

    • Re: (Score:2, Interesting)

      by inanet ( 1033718 )
      I wonder how well the audit was done? I have seen really poor security audits done by professional auditing companies in the past that just showed the lack of ability with the auditors, as an example we got the following from an audit on a few unix boxes: "Security risk - High: Telnet not disabled" "Security risk - High: SSH passwords don't expire" "Security risk - High: FTP not disabled" our response? - no risk, telnet not installed. port not open. - no risk, ftp not installed. port not open. - ssh us
    • Hiring contractors by the government does not increase efficiency, competence or quality, it just pushes more money into different places and muddies things up even more. In my experience, the contractors (with whom I have had contact) hired by the various USGOV agencies and their departments are marginally competent leeches whose ability to acquire contracts has more to do with relationships that have little to do with actually accomplishing their stated mission. While I haven't worked in Washington since
  • by tsalmark ( 1265778 ) on Thursday September 09, 2010 @09:27AM (#33520200) Homepage
    It's shit like this that needs to make it to main stream media. To show how messed up the fear mongering side of the Government really is.
    • by slick7 ( 1703596 )

      It's shit like this that needs to make it to main stream media. To show how messed up the fear mongering side of the Government really is.

      Exposing the inadequacies of the government will just result in more "National Security" obfuscation. The more holes in security equates in more money to fill those holes. It's only a matter of time until Haliburton gets involved.
      The powers that be have no intention of letting their senior bosses know the truth. They will throw more money at it until some major incident occurs and it airs on "60 Minutes", at which time the incompetence will be swept under the rug. When the issue becomes so tangled with corp

  • ... not as I do.
  • Its possible that even IT drones that work in bureaucracy have to deal with the red tape. A good number of these holes might have been fixed by installing the "latest" version of software. At most of the companies i have worked with software installs have to be vetted by corporate suits that would rather play golf.

    Im not going to defend software that simply requires an update. Stuff that needs a fresh install or a new software package altogether can be a pain in the ass.
    • At some organizations it can take months to get schedule and get approval for patching. When someone claims the business needs a service to be available all of the time it's difficult to find a business level advocate for patching.

    • C*O/Business management is about the same in .com as in .gov/.mil? Limit to 0.6666... average for both suffering the technology peter-principle, then I agree.

  • Well, obviously they need to run some instances of Windows for research and testing purposes to protect the public, but you'd think the organization devoted to cybersecurity would run something with fewer targeted attacks designed especially for it.
    • by AHuxley ( 892839 )
      One big honeypot to see what is been used?
      If some new tool works well with 'secure' MS, the US can use them too around the world.
      The endless contractor cash supply is cute too.
  • by mrzaph0d ( 25646 ) <zaph0d AT curztech DOT com> on Thursday September 09, 2010 @09:49AM (#33520650) Homepage

    unless the people running the scans are experts in setting up and configuring nessus for scanning, i wouldn't assume every one of those is a true vulnerability.

    • Re: (Score:3, Interesting)

      Exactly. Just running Nessus does not a proper security audit make.

      • Yup. nessus isn't magical, unless you instruct it to use the vulnerability and attack the host (no suggested) then you can never be certain the vulnerability exists.
      • Very wise you are.
      • Re: (Score:3, Insightful)

        by qwijibo ( 101731 )

        Running Nessus produces numbers. Those numbers are then the metrics which management uses to judge how well people are doing their jobs. Lower numbers are always good and higher numbers are always bad.

        Comprehension of what the numbers represent, or if they're accurate, is not really relevant from a management perspective. If you show that your numbers are small and keep getting smaller, then any security vulnerability can't be your fault, because the magic number machine says your compliant. It's the sa

    • Well considering it was a failed audit, and not just a failed scan, I'm sure they know what they are doing.

    • It should be noted that there are various certifications which any company hiring vulnerability assessment should look for, many of them cover in depth how to properly use Nessus, Saint, etc.

  • by Lakitu ( 136170 ) on Thursday September 09, 2010 @10:02AM (#33520926)

    We need to create a Department of Department of Homeland Security Security immediately.

  • Managing configuration for one box is easy. Sometimes managing configuration for multiples of the same box is doable. But managing configuration for a large scale multi-vendor deployment is a headache that nobody solves particularly well, and the tools for checking the various things (patch level, logs, configuration scanning, etc) typically all come from different security vendors and those don't work together either.
    • Excuses are a major security problem.

      In fact, excuses cause major security problems.

      No, I am not saying fire the person, because shit happens. Unless the person is the problem looking for excuses for all the shit happening.

  • by MrTripps ( 1306469 ) on Thursday September 09, 2010 @10:11AM (#33521100)
    The article says most of the flaws were unpatched installations of Java, Acrobat, and Windows. When new patches for those come out every week it is easy to let that slip without some sort of patch management tool. I wonder what they used other then WSUS.
    • A thousand times this.

      But, then, I suppose the people who wrote TFA, or are commenting here, don't have a single unpatched copy of Acrobat Reader or JRE around. Am I right?

      Cluestick time: while there's problems in government IT, I can guarantee you that many, many large corporations would have fared worse on a similar audit.

    • by mcgrew ( 92797 ) *

      Indeed. I guess the day before yesterday was Patch Tuesday, because as soon as I got home from work and turned my netbook on it said there were "critical updates".

      Last night I got another one for Adobe's PDF viewer. Then BitTorrent asked me if I wanted to update it.

      I rebooted that thing more in the last two days than I have since I bought it in April. At least BT didn't need a reboot. It was annoying, because I'm trying to DL and try Kubantu with BT and seed my novel and Mandriva with it, and all that reboo

  • by setrops ( 101212 )

    The lack of details in the paper makes it so that it is impossible to know exactly what they found. Scanners such as Nessus, Foundstone, Languard are really noisy and can report normal system operation as a high vulnerability irregardless of system configuration.

    Something like telnet will be a high, but put the proper mitigation such as access list, 2 factor authentication and you can show it as a medium or low.

    It's all subjective.

    • Re: (Score:2, Insightful)

      by crypticwun ( 1735798 )
      Actually, reading the report tells me that the problems were almost certainly Windows desktop systems lacking a cohesive patch management solution. Also, if you read further the IG even states that as of the time this report was published all the problems were already remediated including acquisition and deployment of a "software management" solution. Further, the IG claims that NCSD is not following FISMA. NSCD is not a legally recognized entity (agency) under statute, so that means *DHS* is the respons
  • obvious (Score:3, Funny)

    by slick7 ( 1703596 ) on Thursday September 09, 2010 @10:27AM (#33521386)
    This looks like a job for Kevin Mitnick...naaah.
  • So the Department of Homeland Security's network security measures are approximately equivalent to the security measures on the border between Mexico and the United States.

    I am Jack's Complete Lack of Surprise.

    The Department of Homeland Security's primary mission is not "security." Its mission is "training the public to be properly responsive to idiotic demands from the Federal Government."

    • by flynns ( 639641 )

      Heh, that was the first thing I thought of when I read this: "I am Jack's complete lack of surprise."

      Which, of course, made me go here. [z31-ae.com]

  • Grain of salt (Score:5, Informative)

    by Spazmania ( 174582 ) on Thursday September 09, 2010 @10:55AM (#33521894) Homepage

    Take it with a grain of salt. The security scan was checklist-based, taking no account of the context. Worse, it's was based on version to database matches, utterly failing to account for backported security patches and similar protections that render specific vulnerabilities moot.

    I have no personal knowledge of this specific case. But I've seen it enough times to know what this report really means.

  • Imam Rauf is building mosques on 900 of these holes. Rev Bigot is burning Q`ran in 984 of these holes and Osama Bin Laden is hiding in the last one.
  • Several years ago I was working at a company hired to do a similar outside audit, who ... was in turn of course hired to fix the situation.

    I was handed a Nessus by the fellow who did the audit that pointed out several servers were missing critical windows patches in the audit the week before ... and to please go out and patch them. Small problem when I arrived on site ... servers were running Debian. So Nessus might be a great auditing tool, but any report is only as good as the people that ran the tool.

  • With Nessus, the "high" severity results are the only ones that really matter. And even then they sometimes don't. For example: "you are using a version of PHP with a security hole in one of the API calls your programs might use" is high, but it isn't a real vulnerability unless you actually use that specific call.

  • by Thyamine ( 531612 ) <thyamine.ofdragons@com> on Thursday September 09, 2010 @11:35AM (#33522610) Homepage Journal
    Something about the carpenter's house or the cobbler's kids have no shoes. I work for a computer support company, and this happens to us and everyone else. Backups/patches/etc don't get tended to unless someone up the chain knows how important they are and makes it get done. Even then it's hard to keep on top of _everything_ unless you really have people dedicated to it. It's no surprise, and I don't think it's any reason to be angry. It just shows that they need to get better organized about it like everyone does..
  • by realsilly ( 186931 ) on Thursday September 09, 2010 @11:36AM (#33522618)

    The Govt. runs security scans on all of their systesm all of the time. They are using tools that are designed to help them make their security tighter and more difficult to hack, and they are improving this all the time. As new security tools come to market they evaluate them just like any corporation. And before they let new applications on their networks, and before any releases upgrades are performed they check security on those applications. All security issues identified must be addressed before applications are put on their systems.

    I would have like to have seen a comparison of our Governments security run against some of the Banks and Wallstreet system that hold our financial data. I would suspect you'll find as many or more on the public sector as you will on Govt. sector systems.

  • across 174 MOE computers scanned of 202 unique vulnerabilities... which comes out to be about 6.2356 vulnerabilities per computer.
  • DHS CyberSecurity Misses 1085 Holes On Own Network

    In other news, bears found to shit in woods. News at eleven!

  • Not to be cynical here... well yes I am... what do you expect from a COFEE http://www.microsoft.com/industry/government/solutions/cofee/default.aspx [microsoft.com] drinking and Donuts eating https://www.dunkindonuts.com/ [dunkindonuts.com] lazy system admins. Some people who work for the DHS cannot be bothered and are still trying to figure out the FBI's Carnivore, swiftly changed to code named Magic Latern.... "You rub it and a Genie pops out with 3 wishes".

Nondeterminism means never having to say you are wrong.