Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

DHS Gets Another "F" In Cyber Security 169

Posted by samzenpus from the good-job-team dept.
An anonymous reader writes "For the third straight year, the Department of Homeland Security -- which is charged with charting the federal government's cyber security agenda -- earned a grade of "F" for computer security from a key congressional oversight committee, according to a story at Washingtonpost.com. Not only did the overall government-wide computer security grade remain flat (at a barely-passing "D+" but several agencies -- mostly those on the "front lines in the war on terror" -- actually managed to fare worse this year."
This discussion has been archived. No new comments can be posted.

DHS Gets Another "F" In Cyber Security More

DHS Gets Another "F" In Cyber Security

Comments Filter:

  • Obviously... (Score:5, Insightful)

    by darnok ( 650458 ) on Thursday March 16, 2006 @06:29AM (#14931502)
    ...they're too busy ensuring the security of US citizens to worry about minor details like ... the security of US citizens.

  • Increased Demands? (Score:3, Insightful)

    by Mattygfunk1 ( 596840 ) * on Thursday March 16, 2006 @06:29AM (#14931506)
    several agencies -- mostly those on the "front lines in the war on terror" -- actually managed to fare worse this year.

    Considering that the findings are given back to the relevant departments to improve upon, going backwards requires that not only are services added but that their security efforts don't even improve or get worse with the new projects.

    Perhaps the demands of IT in these departments have increased significantly to account for these services. Anyone know?

    __
    Funny Adult Videos @ Laugh DAILY [laughdaily.com]

    • Funding (Score:5, Informative)

      by Detritus ( 11846 ) on Thursday March 16, 2006 @06:53AM (#14931567) Homepage
      Many departments are run on a shoe-string basis. While the agency, as a whole, may have received a budget increase. That may mean that 20% of the agency saw a major increase in funding, 40% saw their funding stay the same, and 40% saw a 10% cut in their budget, again. Year after year of budget cuts can be very corrosive. You lose all of your support people and the survivors get new tasks that they may not have the time or skills to do properly. The infrastructure becomes a collection of obsolete equipment held together with bubble gum and bailing wire.

      At one office that I worked in, we made regular trips to the agency's excess equipment warehouse to scrounge for parts that we used to build "new" (newer) computers. That was the only way that we could obtain computing hardware. There was no money in the budget for PCs, even though we were a software development group. We provided our own hardware and software support, by necessity.

    • Re:Increased Demands? (Score:5, Informative)

      by mgoodman ( 250332 ) on Thursday March 16, 2006 @11:51AM (#14933541)
      I work for the DHS Inspector General -- the agency that conducts the FISMA assessment.

      At least part of the reason that many agencies did worse this year than last can be attributed to:

      - A better DHS systems inventory, meaning a larger population of poor systems, as opposed to the big attention-whore systems that are inevitably going to have more money for security. Unfortunately, the systems inventory *still* isn't very good and is primarily based on what managers report as owning, rather than a combination of reporting and discovery via scanning

      - More information available to the Inspector General's office (and more information generally means more negative information, unfortunately). We could also more easily find exceptions/anomalies with the additional information

      - Better FISMA assessment methodologies/processes on the part of the OIG than previous years. The process has been much more streamlined so that more work could be conducted in a shorter period of time (i.e. more problems can be found).

      Those are just a few of the major reasons. There are other reasons that are more site specific, for example budget cuts, focus of efforts, etc.

  • Re: (Score:2, Funny)

    by account_deleted ( 4530225 )
    Comment removed based on user account deletion

    • Re:Bureacratic incompetence? (Score:4, Insightful)

      by asuffield ( 111848 ) <asuffield@suffields.me.uk> on Thursday March 16, 2006 @07:37AM (#14931687)
      Suggesting that makes you an anti-american terrorrist. The Department of Homeland Security will now investigate you at great expense, and if you happen to be a muslim, ship you off to a detainment camp to be held without trial.

      The sad part is that this isn't a joke.
    • Yes it can, and stop calling me Shirley :o

    • Re:Bureacratic incompetence? (Score:4, Insightful)

      by Anonymous Coward on Thursday March 16, 2006 @08:02AM (#14931760)
      In government, failure is typically rewarded with more revenue and/or power. You can observe this trend in basically any government program: welfare, education, national defense, all the way down to Amtrak and the postal service. If government actually did achieve its goals, then there would be no justification for more revenue or more power.

      As it stands, the US government of today dwarfs the US government of only 50 years ago, both in revenue and power over the people. This wasn't achieved through success; it was achieved through failure. When you're spending other people's money, and collecting that money through a special "right" to sell your product through coercion, things work a little differently than if you had to obtain your revenue voluntarily.
      • In the Air Force, shops are encouraged every budget cycle to go over budget. If you don't go over budget, then you must not need the money you're getting, and your funding gets cut. If you go over budget, you get more money. Multiply that exponentially and you have the whole government.
    • If it were political incompetence that would put the blame on us.

      In any organization (including a nation), there is a "rule of 2": someone must be twice removed from you to be a good scapegoat. Otherwise you're still associated with whatever the screwup was.

  • Do we live in a developed country? (Score:5, Interesting)

    by bogaboga ( 793279 ) on Thursday March 16, 2006 @06:38AM (#14931522)
    With all the incompetence being displayed in my government's administration, I many times wonder whether I live in a developed country. Should the meaning of "developed country" be re-defined? Remember, nothing seems to get done right in these United States of America these days.

    • Re:Do we live in a developed country? (Score:5, Interesting)

      by MichaelSmith ( 789609 ) on Thursday March 16, 2006 @06:45AM (#14931540) Homepage Journal
      I many times wonder whether I live in a developed country.

      Speaking as an outsider (I am an Australian) I think the USA does many things very well. But because the US is a very big country, there are always plenty of stories to tell about people being incompetent. You could put any 10 European countries together and get a similar picture.

      One problem, I think, is that homeland security (at least since 2001) is being built from scratch as an organisation. New outfits tend to get "business as usual" infrastructure much as would be used for an accounting firm or some such. If they went to an established agency like the FBI they might get less modern but more secure solutions.

      • heh [excite.com]. Bad example. Note the FBI modernization that has been completed: 30,000 new desktop computers for $600M

        • Re:Do we live in a developed country? (Score:5, Informative)

          by TubeSteak ( 669689 ) on Thursday March 16, 2006 @01:19PM (#14934550) Journal
          The first two phases of the "Trilogy" project - deployment of a high-speed, secure FBI computer network and 30,000 new desktop computers - have been completed at a cost of $600 million.
          That $600M doesn't break down into $20k per desktop, a good chunk of that money went into building a highspeed secure network. If it's secure, that means it has to conform to a laundry list of standards.

          Now, if those 30,000 desktops had to be tied into the FBI's secure networks, I can understand exactly how costs can go rediculously high.

          Essentially, everyone from the company you're buying these products from to the people physically moving and installing the hardware have to be cleared to handle the equipment.

          That costs a ton of money right there. Background checks and insurance aren't cheap and that jacks up the prices for everything. They aren't just buying computers, they're paying a contractor to do everything and then to provide support.

          If you don't think through the situation, it can easily seem like they're just wastefully burning up cash. Very few things are as straightforward as they seem at first glance.
          • There's also a cost associated with deciding on contractors and vendors in the first place; then on hammering out the details of the deal(s) with those companies. I wouldn't be surprised if a large portion of that quoted cost was paying the salaries of the people who are decision makers and negotiators.

            --Ender

      • Re:Do we live in a developed country? (Score:4, Insightful)

        by Halo- ( 175936 ) on Thursday March 16, 2006 @10:06AM (#14932391)
        I'm glad to see we (the US) haven't completely alienated everyone yet. That said, it is worth pointing out that the DHS isn't "being built from the ground up". DHS is basically a conglomeration of a bunch of existing Federal agencies with a bunch of new infrastructure added in.

        Of course, I'd argue that it's easier to build security in from scratch than to merge a bunch of government agencies in a clean and tidy fashion, so I agree that DHS has an especially hard task.

        The real question is how subjective these "grades" are. What does "cybersecurity" really mean? Attack from the outside? Compartementalization? (that has to be spelled wrong) Prevention of abuse from within? All of the above? Some these are easy to fix, and some are very hard. For obvious reasons the public can't be given a report listing what and where the weaknesses are, but an unpatched Windows machine is a lot more serious if it is on the perimeter than if it's behind three layers of well-managed firewalls.

    • Re:Do we live in a developed country? (Score:5, Insightful)

      by quarkscat ( 697644 ) on Thursday March 16, 2006 @07:21AM (#14931652)
      Of course this country has slipped backwards from being a "developed country" into merely
      a "developing country". That is a basic tenet of the neocon agenda - globalization of the
      economy. High tech and skilled labor jobs are shifted to the lowest labor cost country --
      whichever can barely "get the job done" and at the lowest price "wins the contract". USA
      employers who cannot shift their labor costs overseas are busy importing cheaper labor
      under increased numbers of L1-A and H1-B visas. That, or busy jumping on the neocon
      bandwagon to legalize the 28 million illegal aliens that are already in this country. Hand-in-
      hand with the influx of illegal alien labor is a massive spike in identity theft and fraudulent
      identity documents. The GWB administration favors hiring fellow neocons, regardless of
      either their real CV or their civil ethics. Helping to forward their neocon agenda by any means
      possible outweighs any concept of good governance, or even of the Constitutional balance
      of power, let alone the Bill of Rights.

      Why, considering the response to 9-11, to the illegal Iraq war, the "Pharmacutical Company
      Welfare Act of 2003", or the Gulf Coast-Katrina disaster, would any sentient being ever be
      surprised by what the GWB administration is incapable of doing right?

      The Department of Homeland Security is a non sequitor at best (oxymoronic?), and little more
      than a tool of the emerging National Corporate Socialist state's grab for absolute executive
      power, at worst.
      • That, or busy jumping on the neocon bandwagon to legalize the 28 million illegal aliens that are already in this country.

        Do you even pay attention to your own propaganda? I'm pretty sure Republicans aren't in favor of open borders.

        And what's with the xenophobia? Worried that a foreigner can do your job better than you?

        • I don't think it's about xenophobia... but, personally, it doesn't help my trust in the govenment knowing that they can't, or don't want to, even keep their borders secure.

          Why make it illegal and then let it happen? If you want it happen, why not legalise it? There's some discrepancy there, and it's unsettling.
        • Propaganda? Not at all like the pitchforkfulls of BS that this administration has dished out
          the the American people, the UN Security Council, and the rest of the world at large. The
          ONLY Republicans that are NOT in favor of GW Bush's amnesty/legalization of the virtual
          invasion of illegall aliens are the one's who, under pressure from their constituents, have
          split with the official plank of the neocon(artists). Generally, those are the ones whose
          own jobs are at risk in the midterm elections this fall. And

        • I'm pretty sure Republicans aren't in favor of open borders.

          Sure they are - somebody's got to mow their lawns.

    • Re:Do we live in a developed country? (Score:2, Insightful)

      by Anonymous Coward

      I many times wonder whether I live in a developed country.

      Okay, I'll bite.

      You act like Americans (or Republicans) have a corner on the incompetence market. Not hardly. Examine any other country and you will find the same crap, it's just not reported so widely in the news as it is here. Try working in an international nonprofit (as I do) working to improve healthcare delivery systems in other countries, and you will start to be very thankful you're an American. Blessed, or lucky, or fortunate; take your

      • It's not like the US is the only country in which one observes incompetance and inefficiency. I think the point is that there is good reason to think that the US government is a lot more incompetant and inefficient than it was say ten years ago. The secondary point is that this fits the Bush agenda in several ways. One is that, if you're a hard-core advocate of privatization and corporate welfare, it makes sense to run down government services so as to load the dice in favor of the view that private enterp

    • Re: (Score:3, Insightful)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion
    • With all the incompetence being displayed in my government's administration .......

      I'm from the UK and having lived in the US for a number of years I think the US can achieve anything it sets its collective mind to. But the electorate has a neat trick of getting what it wants. Goes like this: Congress passes a law to do XYZ. The electorate says great but then refuses to pay taxes to support it. It's not really incompetence.
      • Wait a minute...

        I've lived in the US my whole life, and I've been paying taxes for the past 20 years!

        I can refuse to pay taxes to support stuff I don't agree with (Without going to jail, or having my assets seized...)!? Tell me more!

    • That's the cost of running an empire. The more that the USA expands and tried to "heal the world, and make it safe for democracy," the more cutbacks are going to be felt back in the "homeland." The USA is borrowing far more money than ever, and it is using that money in foreign lands, not at home. You people are also paying for this. Your money leaves your country as fast as you make it. You live in an empire, but don't worry, it won't be an empire for too much longer. Empires never last.

  • Muhammed drawings (Score:5, Funny)

    by mixenmaxen ( 857917 ) <(max) (at) (maximise.dk)> on Thursday March 16, 2006 @06:39AM (#14931525) Homepage
    Well then, time to deface some .gov websites with drawings of the prophet Muhammed...
    • Keep in mind that Islam bans any depiction of the prophet. Doing so not only land you in the hot seat with the government, but also with the Muslims. On the run from the government and islamic extrimists probably won't be as funny as you initially thought.

  • Ofcourse (Score:3, Funny)

    by poeidon1 ( 767457 ) on Thursday March 16, 2006 @06:47AM (#14931546) Homepage
    Cracking child porno is much more important than these trivial issues. Why care when everything is available at/from google.

  • resembles department culture as a whole? (Score:5, Interesting)

    by pimpimpim ( 811140 ) on Thursday March 16, 2006 @07:00AM (#14931588)
    FTA: Most [agencies] are spending so much on the paperwork exercises that they don't have a lot of money left over to fix the problems they've identified.

    It figures. Institutions like the DHS are completely focused on administrative, paper-tiger, security. Which in the end doesn't end up in a real security for anyone, but instead a freedom-diminishing administrative load on everyone.

    The National Science Foundation and the General Services Administration each saw their scores rise from a C-plus in 2004 to an A last year. The Environmental Protection Agency and the Department of Labor earned A-plus grades in 2005, up from B and B-minus respectively.

    Good to see there are competent people out there, it should not be impossible. It's just sad that the more 'safety-critical' the organization is, the more sloppy they get on critical points in their organization.

    • Re:resembles department culture as a whole? (Score:4, Insightful)

      by argStyopa ( 232550 ) on Thursday March 16, 2006 @09:23AM (#14932087) Journal
      I'd say it has everything to do with the general age of the individuals running the depts, or if they have a particular 'understanding' of the internet beyond that of their peers.

      Look at businesses in the late 90s: you had young tyros running companies that understood both the opportunities and (more significantly in this context) the risks of the internet. They flourished. Then you had the bricks and mortaor companies that took FOREVER to get off the ground, with their hidebound executive and department managers who were all of a generation for whome VCRs were 'new' and the internet something between cable tv and the telephone but not really understood. There were some foresightful managers who 'got it' but most of their peers didn't

      I'm guessing, given the generally behind-the-curve nature of non-defense government agencies, that they are still just evolving out of this mindset. The departments with the occasional leader who 'gets it' are very clear on their understanding of what they need to do. The others? Well, until there's an administrative change, they're going to limp along, connecting to the web as ordered but not really understanding why they're doing it.
      • Hmm, how would you explain Ministry of Defense being one of the low scorers then? You'd think they would be pretty tech-minded.

        Other agencies whose failing marks went unchanged from 2004 include the departments of Agriculture, Defense, Energy, State, Health and Human Services, Transportation, and Veterans Affairs.

        • Hmm, how would you explain Ministry of Defense being one of the low scorers then? You'd think they would be pretty tech-minded.

          How do you get that? They make something state of the art, like an airplane. Then they use it for years. There are 40 year old U-2s still in service. They do believe in high-tech, but they believe in slow processes and tradition even more. An organization so based in tradition (necessary to convince people to kill and die without thinking about it until shipped back home - or

  • oh look! (Score:5, Informative)

    by lkcl ( 517947 ) <lkcl@lkcl.net> on Thursday March 16, 2006 @07:05AM (#14931607) Homepage
    the "environmental protection agency", which uses linux, got a "grade A"!

  • They want to be attacked (Score:5, Interesting)

    by Jeppe Salvesen ( 101622 ) on Thursday March 16, 2006 @07:13AM (#14931629)
    The departments are just waiting to be comprehensively attacked by some knuckleheads, so that their military industry sponsors can make money on further upgrading the war machine.

  • Perhaps they are (Score:2, Insightful)

    by metricmusic ( 766303 )
    Perhaps they are purposely performing badly so they can get more funding?

  • Childish nonsense (Score:4, Insightful)

    by Anonymous Coward on Thursday March 16, 2006 @07:15AM (#14931638)
    I suspect these people are accountable to nobody, least of all the people. So what's with the infantile school grading?
    B minus? D minus? Who cares. It's not like these institutions are going to go home and blub because they got bad school grades. Another propaganda stunt to make you believe your incompetent and unaccountable institutions are actually answerable to anybody imho.
    • How else would you suggest the relative success or failure of each department be described?

      Colors?

      Some arbitrary scale?

      At least "grades" are almost universally understood in the US. A department which received an "F" is obviously not a success story when it comes to computer security...
    • Its definately for PR. But its meant to be something most people have dealt with. Just about every American can relate "A" with doing a good job, "C" with barely passying, and "F" with, "what the hell is wrong with you?"

      And besides, the government *is* accountable to someone: its citizens, and we need to be reminded of that as of late.

  • Perhaps they are using (Score:5, Funny)

    by LarsWestergren ( 9033 ) on Thursday March 16, 2006 @07:15AM (#14931640) Homepage Journal
    prayer based security [evolvefish.com]?

  • ...this is because there is NO threat. (Score:5, Insightful)

    by pixelone ( 912427 ) on Thursday March 16, 2006 @07:36AM (#14931684)
    ..other than the consequences of Bush's actions in the mid east. If the country was under a legitimate threat, then a lot of funding would go into many processes.. Bush is simply artificially exacerbating the threat by stepping on an ant's nest. Why ? they are far from stupid. This keeps them in power, and to the masses justifies their actions. Iraq was terrorist free, now it is creating 100s every day. It is this artificially created threat that is BUSH's masterplan,

    • It is this artificially created threat that is BUSH's masterplan

      Sorry to disappoint you, but it is Osama's masterplan. His organization wasn't as attractive anymore to youngsters as it was when then were fighting the Russians in Afghanistan. He needed some western armies around, to have an enemy to fight, to attract new blood.

      So, one of his goals with the planes flying into these buildings, was to engage the west in a war in Afghanistan (which they did, and a lot more successfull then Osama would have g

  • lawnmower racing (Score:2, Interesting)

    by ActionAL ( 260721 )
    DHS got in trouble for using taxpayer money to buy lawnmowers and having lawnmower races. What a waste of our tax money. They're probably slack on fixing their computer security so that they can ask the president for more tax payer money and he'll probably say yes, and then they'll go spend some more money buying more lawnmowers for more lawnmower races. What kinda homeland security is this?
    • Your post causes me to imagine a scene of 100 people wearing black suits, racing lawn mowers across the white house lawn...

      On the other hand, do these races allow the public to enjoy their freedoms?
  • Maybe they outsourced their IT-department to India?

  • Get some facts (Score:2, Interesting)

    by Anonymous Coward
    You know, DHS has many sub-organizations within it. There are different groups responsible for IT Security within the different organizations and there is nothing that says "You will do this..." because there are different requirements for each location. When you say that there is no security, are you talking about a network that is intentionally exposed to facilite ease of use for particular tasks or one that is harboring vital information? Are you knocking the techs for the network being vunerable or the

    • Re:Get some facts (Score:2, Insightful)

      by Mo Bedda ( 888796 )
      You know, DHS has many sub-organizations within it. There are different groups responsible for IT Security within the different organizations and there is nothing that says "You will do this..." because there are different requirements for each location.

      Well, that is part of the problem isn't it. DHS has now had a couple of years to come up with a coherent security plan. While I could understand if they were having problem implementing it over all the different sub-organizations, I think they most cert

      • Re:Get some facts (Score:3, Interesting)

        by Pii ( 1955 )
        Some agencies seem to be able to manage secure thanselves without cutting themselves of from the world. From TFA, "The National Science Foundation and the General Services Administration each saw their scores rise from a C-plus in 2004 to an A last year. The Environmental Protection Agency and the Department of Labor earned A-plus grades in 2005, up from B and B-minus respectively."

        You obviously don't understand what this OMB report is all about... It's a report card on FISMA compliance, not on the level

    • Trust me, most systems in DHS are not as locked down as you specify -- I've visited too many to recall as part of my job with the Inspector General. And in the event we find something that is locked down one way, they screw it up in too many other ways to count. This shit ain't hard, people.

      And token-ring? Ugh. You ever been on a large token-ring network? I get your point, but I hope you mean a nice star-based closed-LAN environment.

  • If only... (Score:2, Funny)

    by datadriven ( 699893 )
    We had elected Al Gore. I hear he invented the internet. We'd be in much better shape then.

  • Cat and Mouse? (Score:5, Insightful)

    by martyb ( 196687 ) on Thursday March 16, 2006 @08:51AM (#14931929)

    What if the government put out a bid for someone to undertake cyber attacks against them as well as provide funding for the repair/protection of these systems?

    Offer, say, $1M to an organization to start cyber attacks on a specified date. These agencies would know full well that such an attack was coming. Do *YOU* want to be the one to try and explain why *YOUR* system was able to be broken into? Just as there was a huge effort to counterract the Y2K "bug", and we survived it relatively unscathed, I'm thinking a scheduled attack would do wonders in getting things secured, ASAP.

    We could have nearly impenetrable systems by year's end.

  • This is to be expected. After all, when the feds are so busy watching us, how can we expect them to take care of themselves? Same goes for their network security. If they're so goddamn busy cracking into our E-mails and our home and corporate networks, they can't possibly be expected to secure their own, can they?

    All of this, after they discover China's been operating a massive hacking campaign over here in the United States. You have to wonder if they're not just trying to screw up.

  • Reminds me of the Spanish Inquisition sketch (Score:5, Insightful)

    by hey! ( 33014 ) on Thursday March 16, 2006 @09:46AM (#14932242) Homepage Journal
    which is a fairly accurate portrait of organizational incompetence, or would be if the cardinals were a bit more apathetic.

    I think, as a rule, governments can effectively only do one hard thing at a time. By "Hard" I mean something that in a organizational sense is like computational "hardness": you can't really do a perfect job of it, and you can exhaust all your resources trying to. You can walk and chew gum at the same time because both things are routine and use well trained motor programs. But if I gave you a marionnette, you could probably get it to walk or chew gum, but not both at the same time until by practice you managed to combine the two into a single action.

    Governments can run a national park system and regulate food additives at the same time, because these are routine things like walking, well, walking and chewing gum. But organizating DHS at the time we did was, in my opinion, a bit of disasterous overconfidence.

    DHS was established in January 2003, at the same time the administration was planning an invasion of Iraq in March. Homeland security is a "hard" problem. War and nation building -- in fact region building, are also "hard" problems. The only way you can do this is to find some way to combine the two into a single priority. The administration has done this rhetorically -- e.g. the well known "mushroom cloud" threat -- but on a practical day to day basis these efforts are completely separate. DHS so far as I know doesn't have anything to say about is happening in Iraq, and neither does the Iraq effort consider things like infrastructure security. The only point of contact between the two I can see is that they'd both like to have more of the Coast Guard's bandwidth.
  • I know lets name it the Central Intelligence Agency. Wait we already have such an agency. We should disseminate the other operations that the CIA currently manages to appropriate agencies. Foreign clandestine operations go to the state department...etc. Obviously we would have to maintain security standards across agencies. If the CIA has the mandate they can set standards. If we had one agency that mandated data storage, security and dissemination across government branches we may have been abl

  • My story... (Score:5, Informative)

    by TomorrowPlusX ( 571956 ) on Thursday March 16, 2006 @10:23AM (#14932567)
    So, a friend who will remain unnamed, and works for an unnamed contractor called me one day a few months ago and asked me to scope out a ( unnamed ) Navy website. He said he saw something suspicious -- looking like a subtle defacement by a 3rd party. So, I went there and took a look and yes, in fact, there was a *tiny* javascript insertion in the page calling a javascript file from some random IP. I tracked it down -- several indirections later -- to a chinese website which was causing the insertion of an active x control. It was all very obfuscated and suspicious.

    So, my friend contacts the webmaster of the navy site and explains what he saw, how it was tracked down ( he left my name out -- thank god -- since my name is very islamic and happens to be shared with an at-large eastern european islamic terrorist. Bad enough that it's a disaster whenever I *try* to fly. Thanks, dad. ) and what did my friend get in return? Thanks? A "We'll look into that, good job, citizen". No, he was accused of hacking the site, and they informed the secret service of him and his "actions".

    Fortunately, the SS ( lol ) realized he'd done the right thing and was innocent.

    But, seriously folks, how fucked up is this?
    • Being an upstanding citizen and reporting errors like this no longer welcome by those in power, apparently. It happens in more than just the governemnt. An example that hit close to home for me was at my own college. The Northeastern News reported a little while ago that the president and vp of the student governemtn (SGA) had reported a leak of information on the computer system regarding student information like grades, social security numbers, and so on. Instead of being thanked for their information

  • Here's how it works... (Score:5, Insightful)

    by Morrigu ( 29432 ) on Thursday March 16, 2006 @10:44AM (#14932780) Homepage Journal
    The House Government Reform committee [house.gov] does some investigation and gives an agency a poor grade.

    The Secretary for the agency gets grilled by Congress-critters on why their agency is failing, again. The Secretary doesn't really care about IT security, but (s)he does care about not getting grilled by Congress-critters.

    The secretary authorizes some obscene amount of dollars to go towards "improving IT security" and signs off on some plans that purport to do this. Often these are bundled together with initiatives for IT centralization, better management practices, the yearly re-org plan, etc. If you're lucky, some fair portion of the obscene dollar amount actually goes towards something that might really help IT security.

    Various political appointees (Deputy Secretaries, Assistant Deputy Secretaries, Associate Deputy Assistant Secretaries, etc.) get shuffled around in the post-Congressional-snitfit era and engage in vicious political battles that make Imperial ascension politics in the Roman Empire look like a shuffleboard tournament. This of course immensely helps the prospects of improving IT security.

    Meanwhile, various Beltway contractors propose all sorts of interesting things the agency can do with the money. The ones who are already working with the agency make recommendations to steer the dollars towards projects they can successfully bid on and ways they can increase their headcount, and the outsiders try to weasel their way in. Vendors make extravagent promises about their gear and generously distribute dinners, trips, tickets and job offers in desperate attempts to land a multi-million dollar sale.

    Somebody (no one ever admits to this later) actually buys off on some subset of these promises and signs a PO to Make This Happen.

    The money eventually filters down to the GS-15s and 14s (career employees) and contractors who Actually Do Something instead of going to meetings all day and answering email. They often emulate the successful political appointees above them by holding lots of meetings and sending lots of email. However, they get to Actually Do Something as well. Lucky them.

    Some random collection of program managers, unwitting new subcontractor hires, and government support employees are thrown together to Make This Work. If they're lucky, enough of the people on the task have worked together before to know how to navigate through the bureaucratic, corporate and technical obstacles to have something to show for their efforts after 6 months. If not, well, the government paid for Yet Another Jobs Program.

    3 times out of 10, the proposed solution fails so miserably that they can't even convince the other contractors and govvies to put it into production.

    6 times out of 10, it works just well enough to shoehorn the "solution" into production, as long as the duct tape holds and they can hire enough bodies for the Mongolian Horde approach to IT ("quick, get more people for the overnight shift, the ticket count's escalating again!"). But that's okay, 'cause the same contractors and govvies will get to fix it again next year when the problem still isn't solved.

    1 time out of 10, they actually Make It Work. Wow. People stumble around in shock, awe and amazement at what they have created. Users are happy, management is off their backs. But don't worry. Something will change in another 6 months to bring completely new requirements into the picture, and you get to roll the dice again.

    • Psha. (Score:3, Insightful)

      by mgoodman ( 250332 )
      I don't know many GS-14's or -15's that actually do anything...and I've met a LOT.

      The government needs to eliminate this bullshit job security and make people work for a living. If people don't work and meet performance standards, they should get fired.

      But no, that's much too logical. Instead, we allow people to put in a good couple years when they're young (and want to work) and then support them through the rest of their life while they slack off and can't be fired. Most people need some sort of fear for

    • 1 time out of 10, they actually Make It Work. Wow. People stumble around in shock, awe and amazement at what they have created. Users are happy, management is off their backs. But don't worry. Something will change in another 6 months to bring completely new requirements into the picture, and you get to roll the dice again.

      Reminds me of one of the /. Quotes that shows up at the bottom of the page

      Conway's Law: In any organization there will always be one person who knows what is going on. This person must be

  • Is Bush Working for the Terrorists? (Score:4, Insightful)

    by Doc Ruby ( 173196 ) on Thursday March 16, 2006 @11:08AM (#14933036) Homepage Journal
    If the 9/11/2001 planebombs (including direct hit on the Pentagon) and the ever-increasing terrorism rate since we invaded Iraq aren't enough for Bush to get even a passing grade in Homeland Security, he never will. Even the Katrina flood disaster, in which an entire American city was destroyed while Homeland Security's FEMA agency flailed, wasn't enough to get their asses in gear. Meanwhile, that vast catastophic failure of DHS is used to justify spying on Americans. Including spying on completely peaceful pacifists, just because they peacefully oppose Bush's war policies.

    We have never been weaker or more unsafe. Our union is divided everywhere, persecuted by our government, churning our experienced national security personnel (including our military) into a useless, expensive albatross around our neck. If someone actually attacked us, we'd be worse off than before we got all these "warnings", many of which are already killing thousands of Americans.

    These clowns have got to go.
  • I know, it's so easy (and fun!) to slam the gov't when they mess up. Lately, they seem to be messing up an awful lot (which translates into an awful lot of fun for folks like me!).

    Only a few agencies improved and those agencies aren't even as significantly correlated to security as the likes of DHS, etc.

    It feels a lot like hypocrisy to me, when the gov't continuously appears to be able to fail and get away with it but we normal, everyday citizens cannot "officially" get away with much at all.

    I wish there w

  • I work for DHS, help grade them, and... (Score:3, Insightful)

    by mgoodman ( 250332 ) on Thursday March 16, 2006 @11:22AM (#14933162)
    ...I wanted to reiterate that this is ONLY based on Federal Information Security Management Act (FISMA) reporting. Essentially, FISMA reporting is a basic assessment of system vulnerabilities and policies/procedures. Additionally, reporting is inaccurate, as the system being evaluated must be in the DHS systems inventory -- most systems are not because DHS has a poor inventory. Therefore, most systems are not even evaluated.

    So, if this "report card" were properly reported, more systems would be in the population (and sample, since I feel sample size is too low). And if better, more in-depth security assessments were done, DHS would probably do even worse. I just wanted to give you the warm fuzzies...

    Anyhow, people the under the CISO (Bob West) are working to get a better inventory and to improve FISMA reporting, but the processes are painfully slow due to growing pains, political battles and the typical laziness that consumes government workers.

    We should get some more guys from the casino and porn industries in here to whip system security into shape...seriously...
  • according to this story [harpers.org], which is a kind of "Greatest Hits" for DHS that will curl your toes.
  • One wonders how they manage to keep failing at this. I mean, it's the DHS. You'd think they'd be on top of this kind of thing.

    Then one wonders, what if they really are? I mean, it's the DHS. A tempting target for any terrorist hackers. What if they're really more secure than they've made themselves out to be? Could it be that the DHS network is just a giant honeypot?

    You have to admit, it would be an interesting idea, and not exactly stupid. But then again, this goverment isn't on the ball as far as "no

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close