Scott McPherson's Web Presence

You know, you gotta love the Department of Homeland Security.

Anyone who has ever had intergovernmental dealings with Washington knows that the Federal government has a tendency to, well, to talk down to everyone.  I have had many, many dealings with "the Feds" over the years, from cybersecurity to the Census to you name it, and their collective attitude is astounding.  I don't know if it is endemic Washington culture, or some belief that the Federal fecal matter does not stink, but it is amazing that an entity that tells state and local governments how to run their business apparently cannot run its own business.

Two recent stories -- completely separate subjects -- collectively speak to this dysfunctionality in the agency charged with the responsibility of protecting We, the People.  First was the revelation that Mister Self-Important XDR-TB guy with the Hottie Wife actually was let back into the United States, despite every attempt to keep him out.  The DHS border guard who deliberately ignored the flashing computer screens (For God's Sake, Don't let This Guy In!) and waved him across, saying later "Duh, he didn't look sick!", shows that for all its hubris, DHS apparently can't guarantee we are intercepting important messages and acting on them quickly.

Then comes this juicy little ditty, listed below.  Whenever I attend IT conferences, the panelists always seem to include an array of Federal IT "geniuses," strolling onto the stage with supreme self-assurance, and I am reminded of the line from Bowie's classic line from China Girl, "I stumble into town, like some sacred cow."  Building a cult of personality and protecting turf are far more important, apparently, than protecting the public and the public interest.  The Feds are always quick to administer advice, but are the last to take it. 

PS, the only guy running for president who even addresses these issues is Fred Thompson.

Lawmakers assail DHS cybersecurity

The Homeland Security Department’s IT security posture came under fire from lawmakers after the Government Accountability Office found “systemic and pervasive” problems.

At a hearing yesterday, House Homeland Security Subcommittee on Emerging Threats, Cybersecurity and Science and Technology members grilled DHS chief information officer Scott Charbo about the state of the agency’s cybersecurity, including the U.S. Visitor and Immigrant Status Indicator Technology (US-Visit) program.

“[I]nformation provided by DHS suggests that the CIO is failing to engage in defensive best practices that would limit penetrations into DHS networks,” said Rep. Jim Langevin (D-R.I.), subcommittee chairman. “The department’s failure to implement the Einstein program, contracts with Sprint and MCI where the carrier has misconfigured the firewall, and other problems are quite disturbing.”

Charbo said the agency’s cybersecurity posture is getting better, but could not answer a lot of questions around the problematic configurations of DHS’ systems.

When Langevin questioned whether Sprint, MCI or even DHS’ National Cyber Security Division has audited the ISP providers, Charbo said while he is ultimately responsible for the security, the issue of auditing contractors is not a decision any CIO could make. Charbo said it needs to be addressed from a higher authority.

Charbo also couldn’t answer how long the vulnerabilities in the ISP have been open and when the last audit of the data network occurred.

Langevin once again called Charbo’s lack of response disturbing.

“It was a shock and a disappointment to learn that the Department of Homeland Security … has suffered so many significant security incidents on its networks,” the congressman said. “DHS reported to the committee that it experienced 844 cybersecurity incidents in fiscal 2005 and 2006.”

Langevin pointed out these included workstations infected with Trojans and viruses, a workstation infected with a Trojan scanning for port 137, which demonstrates that “individuals attempting to scan DHS systems through the Internet,” and PCs containing suspicious beaconing activity and a botnet that lets a hacker control the compromised computer.

GAO’s chief technologist Keith Rhodes said Charbo’s claim about auditing the ISP is incorrect.

“The Centers for Medicare and Medicaid audited their telecommunications contractor,” he told lawmakers. “We have reviewed the [ISP] at CMS, identified vulnerabilities and made recommendations.”

Charbo countered by saying just because there was an incident doesn’t mean there is success in breaking into DHS systems.

“We monitor routers on the edge,” he said. “If we find suspicious activities, we track it on our network and take care of it immediately. We do forensic analysis if we identify malware too.”

Rhodes said a lot of these problems could be fixed by improving DHS network configuration of specific hardware devices or software.

“There are zero cost fixes,” he said. “DHS has made some fixes, but there are others they could do.”

Rep. Bennie Thompson (D-Miss.), chairman of the full committee, asked Charbo whether the lack of cybersecurity for U.S. Visit made it vulnerable to hacking. Charbo said there was no evidence of any breaches.

But Rhodes said DHS does not have the controls in place to protect the system had there been an intrusion.

“If someone was smart enough to get in, they could get out and no one would know about it?” asked Rep. Bob Ethridge (D-N.C.)

Charbo said DHS has made some fixes to immediate problems, but they still are working with GAO. He said one example GAO recommended would be to encrypt their LAN, but he believes that wouldn’t be necessary.

“We encrypt the data going out of the network, but not while it is in the network,” Charbo said. “We will mitigate the risks and if there are easy controls we will sit down with GAO and discuss them.”

But Alan Paller, director of research for the Sans Institute, said Charbo’s rationale for not encrypting data on the LAN is faulty.

Paller, who attended the hearing, said one successful spear phishing attack would wreak havoc on the LAN.

“Spear phishing eliminates the perimeter defenses,” he said. “It could create a rogue tunnel out of the system through Port 80.”

GAO will issue a report on DHS cybersecurity problems in July, said Greg Wilshusen, the watchdog agency’s director of information security issues.

© 1996-2007 1105 Media, Inc. All Rights Reserved.