Bush Wants an Unhackable Private Network 365
Slur points out an article at the New York Times which says that the "Bush administration is considering the creation of a secure new government communications network separate from the Internet that would be less vulnerable to attack and efforts to disrupt critical federal activities," writing "It seems to me money would be better spent getting the next-generation Internet going, for the government to fund more of the existing research and standards boards to create protocols that are invulnerable to the kinds of attacks the government seems to fear, namely massive DOS attacks. Or is there something else a 'net terrorist' could do to 'disrupt the vital flow of information'?" Isn't hard-to-disrupt communication the reason that DARPA got involved in this "Internet" business anyhow? Update: 11/19 22:48 GMT by T : This was mentioned before a little while ago when USA Today wrote about the same concept, but apparently a Digital Pearl Harbor is still being flogged.
GOVNET analysis from Bruce Schneier (Score:5, Informative)
Re:GOVNET analysis from Bruce Schneier (Score:5, Interesting)
the government already has several separate, secure internets, for various purposes, and they were still infected by Melissa and LoveLetter
Now that's something we didn't see on C|Net.
I worked in the aerospace industry from '86 to '92. Every big defence contractor had one or more classified IP networks. Unfortunately, the security measures imposed were sort of stupid: the ethernet cables of the classified net had to be at least so many feet from a phone line (they were worried that induced voltages from ethernet would allow someone on the phone to "tap" the classified net), keyboards attached to computers attached to the classified net couldn't be traded out to unclassified areas, and had to be elaborately destroyed when they broke. At the same time, you could walk through checkpoints with pockets full of floppies.
It was as if a Korean War Drill Instructor dreamed up ways to actually impede using the classified network, but at the same time allow (possibly) classified information in and out of the building.
Re:GOVNET analysis from Bruce Schneier (Score:2, Informative)
This is actually true. You could and do get enough crosstalk that a good sniffer in van could pull packets off your ethernet.
RE: keyboards attached to computers attached to the classified net couldn't be traded out to unclassified areas
Maybe they're worried about trojan hardware? A keyboard gets borrowed out, a small modification is made so that it logs every key pressed and then a week or two later gets "loaned" out again to extract the data.
remember these are people who get payed to be paranoid.
Re:GOVNET analysis from Bruce Schneier (Score:2)
This is actually true. You could and do get enough crosstalk that a good sniffer in van could pull packets off your ethernet.
You'd have to explain why the building where this classified network resided had offices with glass windows, and terminals ('92 remember?) facing the windows. The "security" people apparently didn't consider someone with a telescope a threat.
Maybe they're worried about trojan hardware? A keyboard gets borrowed out, a small modification is made so that it logs every key pressed and then a week or two later gets "loaned" out again to extract the data.
Let's see... keyboard gets used a maximum of 12 hours a day, and an engineer types 50, 5-letter words a minute. That's 12 x 60 x 50 x 5 = 180,000 bytes of info a day to store in the keyboard. Nope. Even in '92, we had 1.44 Megabyte floppies. It would have been much more efficient to move info via floppy. Security folks being dumb again.
remember these are people who get payed to be paranoid.
You make a correct statement, but "paranoid" doesn't mean "intelligent". It means "a variety of insanity". I'd rather have security people paid to be intelligent, than paid to be insane.
Re:GOVNET analysis from Bruce Schneier (Score:3, Informative)
Re:GOVNET analysis from Bruce Schneier (Score:2)
Unix - Windows Transition (Score:3, Informative)
I think it's a mistake personally, but I've never researched the reasoning behind the decision. The difficulty in finding unix admins shouldn't matter that much, since the military tends to grown their own anyhow.
Re:Unix - Windows Transition (Score:2)
in the past, they've trained people on UNIX, only to have them finish three years and get high paying gigs in private industry- they're tired of investing time and money in training only to have the soldier leave, so they are moving to NT/2k where admins are a dime a dozen.
God help them, and god help us when it goes down..
Re:GOVNET analysis from Bruce Schneier (Score:2)
But they'd have just as many problems finding NT/2K/XP admins of a sufficent level of competance.
their model calls for comprehensive and easy-to-implement auditing (which 2000 is great at)
Not exactly what NT (and derviatives) calls "auditing" only covers whatever activities Microsoft thing it should cover on the computers only. Not what goes over the wire. If you want to be able to audit the actual software then you need it to be open source.
Re:GOVNET analysis from Bruce Schneier (Score:2)
question (Score:2, Insightful)
Yup
Re:question (Score:2)
Re:question (Score:2, Insightful)
It was NOT designed to be secure to attack from the inside--and with the global Internet, everybody is inside now.
answer Re:question (Score:2, Informative)
Um, nope.
While some work had been done on using packet-switching to improve communication reliability after a nuclear attack, that work was purely theoretical and not directly tied to the origin of the ARPAnet. The ARPAnet was explicitly created to allow computer researchers to share files and resources, reducing unnecessary duplication of effort and resources. The nuclear war myth might be better copy, but it's just a myth.
Check out Where Wizards Stay Up Late for the real story.
Re:answer Re:question (Score:5, Interesting)
Re:question (Score:3, Informative)
But somehow that all went to hell when it got commercialized. How many people here remember the splash made by that first infamous piece of broadcast spam from that lawyer in Arizona?(or was it California?) Or the September that never ended with the advent of Internet access via AOL.
As soon as all these commercial interests got into it, wham. And this is the information superhighway invented by algore. The bloody mess of spam and commercial jerks. Not Darpa
Maybe he wants TCP/IP... old-style. (Score:2)
Think about it: when the Internet was restricted to non-commercial nodes, it was pretty secure. The first major security disaster was the Worm of 1988, which came from a university site.
If you maintained a separate TCP/IP network that only had physical connections on military bases and the like, I'd think it would be pretty secure. It's this business of giving everybody an Internet connection that gets all the script kiddies online.
Re:question (Score:2)
dave
Isn't this a repeat? (Score:2, Informative)
Already exist (Score:5, Informative)
SIPRNET
SECRET INTERNET PROTOCOL ROUTER NETWORK
SIPRNET will replace the DSNET-1 during the migration to DISN. It operates at the SECRET Collateral level and can interface with the TROJAN network. It provides higher and selectable data rates at a much lower O&M recurring cost. Inter-site data rates are 512 Kbps and in some cases T-1. Users can connect to the network at selectable data rates that meet the need.
INTELNET
NAVAL INTELLIGENCE COMMUNICATIONS SYSTEM
The NICS is designed to consolidate Naval Intelligence communications systems. The system has three parts. INTELCAST plan calls for each FOCIC or Facility to consolidate up to 12 different message traffic circuits, including OPINTEL, MUSIC, FIST, and DODIIS through INTELDATA extended in an SCI LAN Extension and Stand Alone capability configuration. The SCI LAN encompasses a full suite of SOCRATES equipment, including workstations, secondary imagery dissemination systems, and a mapping and graphics capability. The Stand Alone capability provides a workstation with tailored data bases specific to unit operational orientation. Stand Alone capabilities are being provided to Guard and Reserve units as well as to certain active, lower-echelon units.
NIPRNET
UNIFORM INTERNET PROTOCOL ROUTER NETWORK
The NIPRNET is the consolidation of several service/agencies networks (AFNET, NAVNET, MILNET) with common protocols and standards. It is a product of the DISN near Term Program, which sought a reduction in cost of operation through interoperability and standardization. Connectivity over high-speed trunking is supported by the NIPRNET. It operates at the unclassified level, while the SIPRNET supports classified networks in a similar manner.
Re:Already exist (Score:3, Funny)
It's definitely much safer to input and output if you're interfacing with TROJAN
Re:Already exist (Score:2)
Until part of it goes down again like it did last month (sept) and you have to use secure faxing right?
Re:Already exist (Score:2)
(Original all caps, lameness filter encountered)
Until an automated solution has been evaluated and approved for use in the USMC, classification markings will be done MANUALLY.
"Um Sarge, when can I clean all these ink stamps off my monitor"
Whoops... (Score:2)
Re:Already exist (Score:3, Funny)
>SIPRNET
>SECRET INTERNET PROTOCOL ROUTER NETWORK
Ok It's a secret, Shhhhh! only you and 2,000,000 more readers now knows about it
Re:Already exist, doubt it'll work (Score:4, Insightful)
Actualy it was a good system, not perfect but good, but it was murdered. They did this by teaching it. They didn't start with the easiest and work to the hardest, they tought the hardest first so the average pvt Joe Snuffy got hopelessly lost. They actualy tought me how to report the laying of a naval mine field, I was in an light infantry organisation at the time, that report was for Naval ships Captains. This happened because the middle management types realy didn't want to lose their turf. I think the same thing is going to happen here.
To us its easy, blow some fiber, install some routers between facilities, gateway to some secure sattalites and maybe change the networking code enough to make the civilian stuff incompatable. Add in an armor plated authetication, distr the software to authorized users and your done right? Well the Army won't like working with the Marines, DOD won't like working with DOJ, and Intell won't even like working with themselves.
The only good thing I see from this is sonner or later some of the reasearch is going to trickle down to us and be usefull.
In the beginning (Score:5, Insightful)
It seems to me this would evolve just the way the Internet did before; it would at first be used just by government agencies, next given to the large defense contractors, eventually adopted by the research universities, and then swallowed whole by Joe Public. This, IMHO, is the best way to get the next-gen Internet.
Re:In the beginning (Score:2)
This might well be the evolution of this new network, but it is not how the current Internet evolved. The Internet, as ARPAnet, was explicitly for the research universities from the get-go. The first nodes on were universities; the first "commercial" node was BBN, the consulting firm charged with building the net.
The government, in fact, was in general quite reluctant to get into something that was perceived, at best, as a convenience for computer researchers.
Grow up, Georgie (Score:2, Flamebait)
And I want Bambi's father to come back, but it ain't gonna happen. Sorry to disappoint you with this Real World stuff, Dubyuh, but there's no such thing....
Re:Grow up, Georgie (Score:3, Insightful)
Running drywire or some other method of lines as long as they are physically seperated from the rest of the internet (think of the way the bank systems do this via verifone boxes) does make it unhackable and private
Of course, it relies upon physical security and not so much bit-based security. Before flaming our president understand it is a real concept. And I'm sure he has quite a few people that know a lot more than you do on the matter; never try to know everything just know people who do.
Note, he didn't say an "internet based private unhackable network" but a private network. My guess in the private IP range. Considering all the secure channels (via satellite, or some other method of communication) I'm sure that this can easily be achieved. Granted all that, I do think it's a stupid idea... but realistic none-the-less.
Re:Grow up, Georgie (Score:4, Funny)
Alas, they don't seem to have any mp3s or warez that I don't already have. Bummer.
Re:Grow up, Georgie (Score:2)
Re:Grow up, Georgie (Score:4, Informative)
How wonderful, someone who still thinks NAT equals security!
I'm not going to spell it out to you, but I suggest you:
1. tighten up your firewall rules immediately. (You ARE running
a firewall, aren't you?)and
2. Start checking your IDS logs closely for the next few days.
(You ARE running an IDS, aren't you?)
OK, if you want further hints for your googling: firstly, look for `arp poisoning Dug Song MitM'. Then search the Bugtraq, and perhaps the sec-focus Pen-testing list archives, for info about how to own the OS/platform you're NATing with (ie if you're NATing thru Linux, I mean the Linux box.) Remember to check for known vulnerabilities in the services that show up when you nmap your external interface. Yeah, of course you're completely up to date with all current patches, but I bet that there was a window of vulnerability before you applied each one...
In general, boasting on Slashdot about how secure one's network is, is a BAD idea.
Re:Grow up, Georgie (Score:3, Insightful)
Re:Grow up, Georgie (Score:2)
Think about it: every employee could end up needing two separate computers on their desk, one for the local network and one for the government one. That employee would have to be vigilant about not ever transferring files from one to the other, either by wire, wireless, or disc. If the employee needs to transfer an email, it'll have to be a hard copy or a retype. If any personnel have laptops, they can't be brought out onto the internet, and laptops from home can't be plugged into the network. For that matter, pretty much any kind of wireless networking is out since none of it can be trusted not to accidentally send or receive anything that wasn't supposed to be sent or received.
The chief problem here is that it places a ridiculous emphasis on perimiter defence without paying any attention to internal defences. Kinda like missile defence. Kinda like a bad firewall product. Kinda like the Maginot Line. These kinds of systems are difficult to set up in the first place, difficult to maintain across any span of time, and once a chink in the armor is found you tend to have a complete collapse in defences, because you've placed all your resources into this one point of failure.
Again, read the Schneier article, and the points about viruses running rampant through military networks because some idiot plugged his laptop into both the public & private networks. If this proposed network is to be useful, again, it will have to be big -- because the utility of a network generally rises as the square of its node count -- but chances are the difficulty of defending it will rise at about the same rate. That's untenable in the long term.
You're right that I'm no expert, and maybe the people advising the moron in the white house are smarter than I am. Certainly they were pretty clever to get that Orwellian Patriot Act passed without anyone noticing in time. But my hunch is that if we want to have some sort of secure networking capabilities, the way to do it is not "vertically" by cutting off parts of the 'net & placing them behind a Maginot line, but "horizontally", with secure protocols, encryption, and the like. I'm not well versed enough to express this more coherently, but it seems to me that protocols like ssh are reasonably secure while being able to leverage the high utility of a large network, whereas this kind of isolated subnet can't guarantee any greater level of security and yet it loses out on that large network usefulness.
Re:Grow up, Georgie (Score:2)
Security could be implemented, say, with a one-time pad that is keyed to the workstation actual address (so if the key is stolen, it can't be used elsewhere to spy on the conversations).
Re:Grow up, Georgie (Score:2)
Re:Grow up, Georgie (Score:2)
Anyway, if you see a very tall fence that goes part of the way around the building, do you try to go over the fence, or do you try the gate? Hacking into this network from home may well be an exercise in futility, but that isn't to say that it'll be safe from malicious or incompetent insiders.
And key length really doesn't mean very much. A long key with a bad encoding algorithm is no better than a short key with a good algorithm, or put another way, if that 1024 key chain runs an algorithm that can only generate 32 bits of entropy, then you might as well just use a 32 bit key. Furthermore, keys of the same length aren't necessarily of equal quality. A clever algorithm might be able to get more use out of say 40 bits than a less clever algorithm does in 64, but then that's just the earlier idea expressed in reverse.
In any event, the main point is that key length looks good in marketing literature, but the best way to know for sure is to have a cryptographically established algorithm, and the more open that algorithm is the better you can trust that it's actually secure. Don't be impressed just because someone told you an algoritm can spit out lots of bits, since anyone can do that:
Hey look at that I just came up with a ten thousand key algorithm, I'm smarter than the NSA! Yeah right... :)
Re:Grow up, Georgie (Score:3, Insightful)
KG-84 [fas.org]
Secure telephones [tscm.com]
The NSA has some really smart people to rip this stuff apart and certify it to be secure before it goes into production. These products are usually designed to a higher standard than software programmed by people in their spare time or microsoft.
Re:Grow up, Georgie (Score:2)
Sign Says "Hack Here" (Score:4, Interesting)
I mean and spy/hacker who found a physical location to hack into it (i.e. tapping into a line on a phone pole or at a phone company switch) would find *everything* on that network to be of interest. In essence they would have hit the jackpot for illicit information. We're kind enough to organise it away for them.
True it would probably prevent 15 year old script kiddies from casually hacking in at home, but it would make any break into that 'other' network all the more catostrophic prospect.
Re:Sign Says "Hack Here" (Score:2, Interesting)
Re:Sign Says "Hack Here" (Score:2, Funny)
>The traffic between data centers is encrypted with
>proprietary DoD software.
mail president@securenet.gov -s "SuperSecret Stuff" `rot13 secrets`
:)
Re:Sign Says "Hack Here" (Score:2, Funny)
put all your eggs in one basket... and then WATCH THAT BASKET!!!
eudas
The public Net IS vital (Score:3, Insightful)
The problem is that much of the 'vital information' in today's society flows over the public internet - by definition. Sure, take military command and control comms out of band - that makes perfect sense anyway, which is probably why there are several separate, highly secure military and governmental IP internetworks that are supposed to be completely separate from the public Net. (Although, as Bruce Schnier points out in the latest Cryptogram [counterpane.com], ILoveYou made it onto the 'secure' network within 48 hours...
There are Always Inside Jobs (Score:5, Insightful)
The only concievable way to do this is to either:
a) Eliminate Government Data Access to All But the Highest Officials (which still poses the same problem, in theory) or
b) Eliminate the network altogether.
Bush is asking for something that isn't possible because social engineering and the "inside job" is the oldest way to hack any system of anything. Hacking didn't start with computers, bank vaults, locks, jewelry stashes... they were all done in the past with inside work.
It's impossible because of human error and human presence.
But is Jobs always inside the Net? (Score:2, Insightful)
a) Eliminate Government Data Access to All But the Highest Officials (which still poses the same problem, in theory) or
b) Eliminate the network altogether.
We already went down this path with the CIA and NSA. Turning to more hardware meant that we were less adapatable, and missed more things.
While people will always be the weak link of any network, and inside access the way to defeat security, this does not mean that it is unwise to trust people.
Instead, we should make security transparent and easy to use, and learn from our mistakes.
This is the lesson of open source - the security actually increases as the number of eyes peering at the code increases. Dependence on the technology ignores the fact that someone has to see the data at the beginning and end of the process.
-
Re:There are Always Inside Jobs (Score:2)
What Bush wants is not "poison-free food" but to make sure that the more egregious security problems of the Internet are solved. To extend your metaphor: if the ovens are unlocked, the food is never tested and the staff can't be trusted you're pretty much guaranteed a less-than-poison-free Thanksgiving feast.
Re:There are Always Inside Jobs (Score:2)
No system is perfect. That doesn't mean that it isn't worth it to build a secure network. A security officer once told me that any system could be cracked, it was just a question of time and resources. The art of security is to make the cost of breaking into the system higher than the value of the information being protected. He said that the government had tested all of our locks and safes, and knew how long it would take an expert to crack them. They didn't have to be perfect, just good enough to stall an attacker for a specified amount of time.
Mae West/East (Score:3, Interesting)
It seems to me that it wouldn't take a whole lot of bang to bring the internet to it's knees.
Funny how it was originally designed to be immune to this sort of stuff.
Re:Mae West/East (Score:4, Interesting)
The problem are all of the servers that are colocated there. Stupid stupid stupid.
Great opportunity (Score:5, Funny)
I want the opposite... (Score:2, Funny)
Bush administration is considering the creation of a secure new government communications network separate from the Internet that would be less vulnerable to attack and efforts to disrupt critical federal activities.
That's funny, I've always wanted the creation of an insecure anonymous non-government communications network separate (or on top of) the Internet that would be less vulnerable to efforts to regulate non-critical non-federal activities.
Why not demand IPv6? (Score:4, Insightful)
Re:Why not demand IPv6? (Score:3, Informative)
There are ZERO operational advantages to carrying classified information over the public network when you are an organization of this size. You get a lack of control over the availability and of the network as a whole, and a nonzero possibility of leaked information via covert channels. Strictly divorcing the government operations network, properly done and with appropriate physical security applied to end-user terminals, reduces the chance of information leakage to zero and gives the network operator absolute control over availability, reliability, and access.
If it were such a bad idea, then why do so many large corporations lease lines between offices?
-jhp
Gresham's Law (Score:2, Insightful)
Finally something not boneheaded (Score:2)
It might be a better idea to support research into strong encryption, good protocols, etc. Maybe. But this is a pretty good idea. Think of all the boneheaded things they could have done instead: outlawed tools that could potentially break encryption. Outlawed computers that don't pass a "security audit" which required that all security-related source code be closed (effectively killing off Linux). Or worse still, done nothing and left sensitive government data floating around on the Internet, weakly encrypted.
This isn't a half-bad idea. A private network is still of course vulnerable, but it's like putting a fence around your property. People might still end up on your property, but they'd have a lot harder time explaining why they're there, rather than just "uh, I just got lost".
Fear the Backhoe (Score:5, Funny)
Don't even start with "physical diversity blah blah blah". The fact that your physically diverse circuits aren't has been proven time and again by the mighty backhoe/flaming hazmat car/junior achiever.
Of course some improvements to BGP wouldn't hurt either.
Re:Fear the Backhoe (Score:2)
Trust no one, not even a sweetheart government contractor.
-jhp
Internet ist hard-to-disrupt, but... (Score:3, Insightful)
Yes. And the internet itself is hard-to-disrupt.
However, a single server can be the target of an attack, and this is what they want to secure against now. The idea of the internet was to be able to communicate even if lots of nodes failed (i.e. got physically destroyed). The idea was not to secure every single node against destruction. Also note that the internet was designed with physical rather than digital attacks in mind.
The government certainly does have a point here, but I think you can reach security for each individual node only by securing those nodes, not by simply seperating them. How will they make sure that, for example, no email can get in from the internet? Have two computers at each user's desk?
AUTODIN (Score:3, Informative)
AUTODIN is an ancient, circuit switched network. It's a real bear to operate (I spent four years operating it) but it is genuinely secure. AFAIK the whole "packet switched so it can't be decapitated" thing that the APRANET was supposed to solve was supposed to be an answer to AUTODIN.
I hope they get something going so they can retire AUTODIN.
-Peter
Re:AUTODIN (Score:2)
Are you a 74C/B by chance (I think that C has been collapsed into B, hasn't it?)
Anyway, I was a Chuck.
-Peter
It's not only the network (Score:2)
All it takes is one... (Score:3, Insightful)
Re:All it takes is one... (Score:2)
Eight years ago, I spent a few evenings on an air base outside of Detroit. I was providing medical care to a quadriplegic who had been invited their as a guest. We had a suite of rooms in some sort of officer's military hotel within the base.
There were notices on every phone about how the phones were not secure and to not discuss military operations on them. It also had a notice prohibiting modem calls.
I said to myself "flock() that, I'm a civilian, not my rules" and unplugged the phone on the desk and plugged my laptop in. Less than a minute later, there was a knock on the door.
Point of the story, it was an analog line on one hand, on the other hand, they knew what was connected to their lines somehow.
I wrote of my experiences in the comp.dcom.telecom newsgroup and an archive of the post is still online:
Date: Mon, 28 Jun 1993 07:51:33 -0400
Subject: Telecom Experience at a Military Base
To read it, go to Telecom Digest Archive [mit.edu] and do a page search for the above subject string.
Re:All it takes is one... (Score:2)
Morale of the story, don't fuck around inside a military base. And that was during peace time. I bet if I pulled a stunt like that these days, my ass would have been hauled out of the building and I'd have been sent somewhere...
Al Gore (Score:3, Funny)
Somehow this whole discussion would be a lot funnier if it was Al Gore saying that he wanted his own private internet.
The server they'll use. (Score:2)
The Bush Revenge (Score:2)
George Busth will never forgive the internet for allowing itself to be invented by Al Gore.
So he is going to redo the whole things and invent the BushNet, a secure unhackable network based on the ingenious idea of running the following script on all government machine:
Terrorist? WTF? (Score:2)
I thought this was the government's job, not the terrorist's job.
I think the net is probably more secure (Score:2, Interesting)
Airports thought about security a bit, but really serious measures generally weren't taken. However, security has been one of THE TOP issues for the Internet for a long time. Kerberos, ssh, bastille linux etc... there are a lot of tools out there to lock systems and networks down.
That said the government is probably getting hacked all the time now. Really critical systems probably should physically seperated from the net. One aspect of security that is the most difficult is human error. Sure a system can provide ssh and kerberized login, but if people use the same password for their yahoo games account, all the encryption in the world doesn't appear to do a lot of good.
Just some random musings.
But what about private coproations? (Score:3, Insightful)
Why would any terrorist waste their time and resources trying to take down the FBI when it could go after banks, airports, power grids, and a whole host of other things that are on the public Internet? All of those things are far more visible and have a far more significant immediate impact on the lives of US citizens. Remember, terrorism isn't about taking out strategic assets, but creating a sense of fear in the every day lives of normal unassuming people.
Now, one might say that the answer to this quandry is to put corporations on that network. Of course then you are expanding the base of users and increasing the likelyhood that a few terrorists (or those easily bribed or fooled by them) will be able to breach that network. I suspect that even putting large swaths of the government on that network already risks that compromise within the government itself but that just amplifies it.
Why don't we take that money and put it into developing policies and technologies that will make the current networks more secure? I know that this doesn't look as impressive to the public, but in the long run it will probably do more to prevent an Internet Perl Harbor.
Physical security (Score:3, Insightful)
None of this even begins to consider the physical local machine security... government workers shouldn't be alowed to bring any media from home, no incoming modem lines, etc.
Lots to think about. If GB wants to cut me a check, I'll begin the engineering work tomorrow.
Re:Physical security (Score:2)
Re:Physical security (Score:2, Insightful)
Exactly my point. Another way we would find to show that a room lacked physical security was the coffee break trick. We would be talking with someone next to the door when they went to coffee break. That person would then say they were heading there too, distracting them, while we defeated the door closure. Then we head off so they think there's no prob, go around the corner, and then head back and we're in the room.
Because they were "just going for coffee" they were still active. So we had defeated security.
Hence, it's not physical security that provides hack access, it's social engineering that defeats the network security.
Once you're in and trusted, you can build out the rest of the access, whether by dongle or other device or password captures and opening up other methods.
So, basically, it won't be unhackable. This is not to say we shouldn't be encouraging the Bush administration from building a Secure Linux setup with IPv6 and IPvSec. If nothing else, this would be better than the current situation.
-
newscast from the future (Score:2, Funny)
And in an ironic turn of events, an undisclosed number of people were arrested in nationwide raids following the most recent round of Unhack-a-Net testing, on charges of using illegal circumvention devices. Officials close to the case described the devices as 'Garmin eTrexes.' The official hinted at prosecution under the SSCA (Super-Secret Copyright Act), the details of which are still classified.
One detainee was overheard saying, "But...we're beta testers! You know, Unhack-a-Net!"
SSCA was signed into law in 2003, following the terrorist threats to the music and film industry. Those attacks came in the form of the thirteen year-old son of a record company exectuve, who crashed his father's Windows 2000 computer one night. Under the terms of the MASTA (Microsoft Antihacking, Security, and Terror Act), the child was sentenced to a prison term, but President Ashcroft felt greater protection was needed for America's vital interests.
Uhh, milnet? (Score:2, Informative)
Doesn't MILnet do this already? Isn't this why when the DoD gave up control of ARPAnet, they forked and created MILnet to retain a secure channel?
Bush needs to lay off the MSN. The U.S. government is already waaaaaaaaaay ahead on this one.
Already did this with milnet (Score:3, Insightful)
Re:Already did this with milnet (Score:2)
As for open vs. closed networks, who cares about evolution? If you've got the tools to do your job correctly, you don't need anymore.
-jhp
Reinventing the wheel (Score:3, Interesting)
As soon as the internet was working they built their own, secure network, and got the hell off of the publicly acessible one.
Maybe Colin won't let Georgie play with his toys, so Georgie wants his own....
It seems to me (Score:2)
Apples and Oranges.
False sense of security? (Score:3, Insightful)
Even with a private network that isn't connected to the Internet, there is still at least one big security issue: A false sense of security. Government employees may think that because their private network is so secure and separate from the big bad Internet, they can relax and give computer security a low priority. What most folks don't understand is that computers are like any machine: They require constant maintainence for reliable operation. Security is a large part of that maintainence, and cannot be set aside while other things take place. On the contrary, security must proactively be part of everything that goes on in a computer and network. This is partly why a false sense of security is dangerous.
Besides, intruders could still access the network through such techniques as war-dialing, to name one example off the top of my head.
I thought the government already had this? (Score:2, Interesting)
Whats Bush Talking about? The government has had independent secure private internets since before we even had the internet.
Why are they telling us what they are building unless its going to be a public government internet.
I mean really, if something is private and secure, the last thing to do is tell the world about it.
When the government wants to keep secrets they can, and they do so by not telling us anything about it,
Perhaps bush wants an internet seperate of the private government internets already in place so he can email his friends in various other countries on any computer (not just the secure private ones) without worrying about people reading his msgs.
Every government employee does NOT use it (Score:2)
Thats why bush wants to make a more public government internet for the common government employee.
The private internet Bush himself most likely cant even use is what you'd call, a military secret, only used for serious business by intelligence agencies to exchange information with the military, and people know about it on a need to know basis, its not common knowledge, and only a few people actually know how the whole thing works technology wise, so even if you've used it, 1 you wouldnt know how it worked, and 2 the people who do know how it works prolly have no clue what its being used for.
Nothing is unhackable (Score:2, Insightful)
Re:Nothing is unhackable (Score:2)
Secure Systems? Trusted Systems? (Score:2, Interesting)
Unfortunately, I think that there are also some very real problems. Some very old military systems (e.g.) SAGE - were secure. The customer (Government) could own and have all code reviewed. All end points were well controlled. The number of nodes and links, etc... were limited. The system was also special, and dedicated - purpose.
There are limits as to how secure any system will be if it will be built on off-the-shelf components, software and hardware components that the gov't can't fully inspect, networking protocols that are not provably secure, and the inevitable
Sam Nitzberg
sam@iamsam.com
http://www.iamsam.com
It shouldn't use TCP/IP (Score:2)
Now we have the public Internet, and Microsoft's virusware for applications. Firewalls help, but as many have noted, it's too easy for a laptop or floppy to inject something, and if an email gateway it provided, MSware will do the rest. Or any other mail client that follows their evil lead and executes email.
A serious fix is to create a new protocol suite that has security designed in. New stack code with no buffer overflows. A stack that doesn't invite address spoofing, flooding, or various other vulnerabilities of TCP/IP. Not that TCP/IP is all that bad for public use, but you just don't try to add security later and expect it to work! (It's a sieve: It should stand for Transmission Colander Protocol/Insecure Protocol.)
This new stack would have new, or at least modified, applications written for it, the way ARPAnet did back when it was young. And rules against insecure crap, so no Outlook ports! It might then catch on outside, but if the protocols have security handles in them, it's okay; there's no security through obscurity. This would help long-term stabilization of the public Internet, if it adopted more secure (and probably more efficient) protocols. Just as government funding for its own use led to TCP/IP.
Some people seem to think that TCP/IP was handed down to Moses on Sinai, and is thus sacred, Perfect, and should be inviolate. I don't buy that for a minute, and I was on the ARPAnet back in the NCP days. It was a nice experiment but it has ossified with widespread use, and clearly has trouble keeping up with current needs. IPv6 is not an improvement in any sense, efficiency or security; it is a distraction whose misbegotten presence, on balance, makes things worse.
Damn it (Score:3, Interesting)
Is it THAT IMPOSSIBLY HARD to use your OWN search tool before posting dupes?
And I want... (Score:2)
Wishing doesn't make it so, Mr. President. Networks are designed to let people share information. Even if you cut yourself entirely off from the Internet, you leave yourself wide open to moles, leaks, and all sorts of human error. A private network may make the human security holes even wider because it gives you a false sense of safety. I'd rather see my tax dollars spent on secure open protocols and sensible security policies. Security is a mindset, not a technology.
The real reason for this network. (Score:2)
Bush and co. want a new network because two states, California and Viriginia, are full of out-of-work techies, left jobless by the dotcom collapse. Virginia and California are also the top two states in regards to defense agencies, contracts, locations, dollars, etc.. Building a new government network would create a huge number of stable, high-paying jobs in Virginia and California as the agencies and contractors in those states were wired up; and even more jobs all across the country as the network spread out to all of the other states in between.
Not only does this have the effect of greatly boosting the economy without pissing too many people off (Which Congress has proven they cannot manage to do.), it also earns a lot of loyalty to the Republican party from all of the people who get those jobs, as well as the other people who benefit from those jobs as the money trickles outward.
Is this network needed, or even likely to work? I do not really know, and anyone who had nothing better to do than post to Slashdot about it really does either. But that does not matter, because right now America's economy needs to get going, the world needs our economy to get going, and the people making decisions in the White House realize that this is a good way to give a long term boost to the economy and their careers, without really earning much scorn, and they would be fools not to.
Re:Great (Score:3, Insightful)
Yeah. Too bad that any interesting technology would probably not be released to the public domain in the name (rather, under the guise) of national security. We can wave the FIA (Freedom of Information Act) in their face, but "our" government seems to have no problem overturning other legislation [loc.gov] under the guise of national security; I doubt this will be any different.
Re:one word.... HAHAHAHAHAHA (Score:3, Insightful)
Bad for MS, good for SELinux, bad for SSSCA (Score:2)
Now, I am not talking about vulnerabilities like those exploited by Code Red. I am talking abount internal security and differing levels of security classifications that would make implimenting such a network on NT or Windows 2000 based infrastructures a really daunting task.
Enter SELinux. SELinux uses a concept of MAC (Mandatory Access Control) rather than DAC (Discressionary Access Control) which allows one to actually enforce security access and localize the effects of security incidents. With SELinux, if I send you a file, you may not be able to access it if you don't have the relavent security classification and, if it is really secret, the mailer may not be able to read the file and hence I may not be able to send it at all!
To do this sort of thing with Windows 2000 or NT would require a large number of servers, and each server would have to have documents only of one security classification on them. Each of these servers would have to be carefully evaluated as to their suitability for their jobs but with MAC in SELinux, these can be combined onto a single system.
Re:Bad for MS, good for SELinux, bad for SSSCA (Score:2)
You are right about that, but I think that he would probably get some interesting feedback from the NSA, Air Force, Navy, et. al. NT/2k/XP simply does not meet the needs of such an organization in terms of internal security and security classifications...
Re:knowing the government (Score:2)
Hmm... actually, if the network itself had insane levels of physical (totally isolated) and human (good resistance to dumb-ass social engineering exploits) security, you could really run anything you want on it and be fine.
Of course, that said, there's no way in hell I'd want to admin a Windows network (err... again... I used to do that sort of thing a while back).
Web hosting by geeks, for geeks. Now starting at $4/month (USD)! [trilucid.com]
Yes, this is my protest to the sig char limit
The unhackability will last... (Score:2)
Unless you have physical access, which is a completely different matter.
Re:Security through obscurity. (Score:2)
I hope we don't make the same mistake the Russians did. Ever hear of Operation Ivy Bells? An underground cable from Murmansk to Vladvistok. All the conversations were unencrypted. The US sent a sub to snoop the line, and glean lots of information.
Re:should be .. (Score:2)
Looking to set up your own personal token ring network?
Re:Republicans Against Strong Federal Government? (Score:3, Funny)
Hahahahahahahahahahaha. That's rich. Oops, no pun intended.
-Legion