5 ms·

Governments take IT security very seriously, I don't see where you've seen they don't. The problem is that you just can't secure a whole infrastructure overnig

Governments take IT security very seriously, I don't see where you've seen they don't. The problem is that you just can't secure a whole infrastructure overnight and that security is very hard.

borism 16y ago
He doesn't mean governments' IT security (which is so-so overall), but the Internet as a whole. And he's right the stuff that will come out of it probably will not be very encouraging.
DuncanIdaho 16y ago
I would like to clarify on this issue a bit. 1. Declaratively the governments are indeed taking IT security seriously. Thus many guidelines, laws and other formal documents regarding IT security have been accepted. Unfortunately many of these are internally inconsistent or in conflict with others. The net result is that in the name of "security" the governmental IT systems are unnecessarily complicated and expensive. 2. In practice - prescribed security measures are mostly not enforced due to many reasons (eg.: The measures are so strict and rigid that enforcing them would prohibit various legitimate users from actually doing their work; The people in charge of implementation and administration of these systems are plain incompetent and/or disinterested). 3. Securing everything that is currently deemed necessary to the extent prescribed by relevant law will turn out to be prohibitively expensive due to various logistic problems (who will implement necessary auditing systems for legacy systems that nobody udnerstands and there are no funds to replace, where will you store all the auditing information, where will you get competent engineers that actually understand the infrastructure and are willing to work proactively to secure them - for a laughable wage?,...). So - as a matter of fact - I have to state that governments don't really take IT security seriously. They don't understand the issues and they don't even care. They care for scapegoats and thats it. Disclaimer: Most of my work is on government related IT projects/systems.
- shin_lao 16y ago
  Security is hard. Security on a large scale system is is very hard. Securing a legacy system is extremely hard. Securing a large legacy system is near impossible. Yes the government wants to cover its ass first and foremost. But that doesn't mean they don't take IT seriously, they just don't understand it to the point they cannot select people to work with that understand it correctly. disclaimer: I've designed COMSEC systems
  - tptacek 16y ago
    If they took IT security seriously, it wouldn't be a checkbox in a Lockheed or SAIC contract.
jrockway 16y ago
The problem is that you just can't secure a whole infrastructure overnight and that security is very hard. Actually, you can never completely defend against every possible attack. Any finite limit can be exceeded. As long as an attacker can use up some sort of finite resource on your box or network, you're toast. SYN floods don't happen anymore because SYN cookies make the size of your TCP half-open connection table infinitely large. So no DoS anymore. But other things are not that easy to fix; you can prevent 1 IP from opening a million slow connections to your server and filling up your state table and running your web server out of fds. But you can't prevent a million people from all opening up one connection without blocking legitimate users. DoS is very hard to defend against. I think in this case, there is probably something easy to fix (get rid of those Windows 95-based routers and app servers), but in the general case, there is nothing that can be done.
- Nrsolis 16y ago
  This is not true. I work for a major DDoS mitigation equipment company and we see SYN floods all the time. And you CAN block one million users from all opening up one connection. Our software/hardware makes this happen. There are MANY MANY ways that DDoS can be dealt with; the biggest hurdle in many cases is convincing a customer that they might be next. Until then, they often don't see the need to spend the money on sufficient capacity or properly test their system against the range of "probable" attack vectors. That's likely what you're seeing here. It /is/ true that attacks are becoming more sophisticated and targeting applications rather than just pure network resources (e.g. b/w). A big part of our efforts are trying to abstract away the potential attack vectors common to several application stacks rather than developing solutions for each one at a time. P.S. Paypal seems to work fine for me right now.
  - jrockway 16y ago
    Yeah, it's hard to speculate as to what's going on, because we are not Paypal or Mastercard. Maybe someone from Anonymous works there and changed their uplink media to 10BaseT :) So about the SYN floods you see in real life, how do those work? Do routers not do SYN proxying for the servers behind them? Do SYN cookies not work? Are sequence numbers being forged? Is the link saturated? Something else?
tptacek 16y ago
That has been the opposite of my experience. To a large extent, the government can't take IT security seriously, because they've outsourced it. There are smart people in and around the government but no coherent strategy. I don't want to get too specific but no DoD network I've seen or talked to people who ran ranks with the least of my financial services clients.
joebananas 16y ago
> Governments take IT security very seriously, I don't see where you've seen they don't. The very fact that this whole cablegate debacle even exists clearly demonstrates that parts of the US government do not.
- Retric 16y ago
  I take death seriously, that does not mean I get to live forever.
  - joebananas 16y ago
    You don't give some random army grunt access to your on/off switch.
    - Retric 16y ago
      Actually, I happen to work for the Army so I am often near well armed "grunts" with access to that off switch. It's a judgment call, but I assume walking around the Pentagon is probably safer than driving which I am also willing to do. More to the point, I think being respectful to well armed people is prudent, hiding under the bed is pointless. So, while I recognize the risk to life and limb at some point you need to focus on risk mitigation rather than avoidance. PS: To put this into perspective, one of the guys I work with was there for 9/11. He sustained significant injury while several people in the room with him died. Yet, he is also willing to work in the building and most people in the building where not harmed.
      - joebananas 16y ago
        Not interested. My original post was not about your completely-missing-the-point simile, but about the fact the the US government demonstrably sucked at IT security when they let the great unwashed have the kind of access they had to State Department cables.
        Retric 16y ago

Governments take IT security very seriously, I don't see where you've seen they don't. The problem is that you just can't secure a whole infrastructure overnight and that security is very hard.

borism 16y ago

He doesn't mean governments' IT security (which is so-so overall), but the Internet as a whole. And he's right the stuff that will come out of it probably will not be very encouraging.

DuncanIdaho 16y ago

I would like to clarify on this issue a bit. 1. Declaratively the governments are indeed taking IT security seriously. Thus many guidelines, laws and other formal documents regarding IT security have been accepted. Unfortunately many of these are internally inconsistent or in conflict with others. The net result is that in the name of "security" the governmental IT systems are unnecessarily complicated and expensive. 2. In practice - prescribed security measures are mostly not enforced due to many reasons (eg.: The measures are so strict and rigid that enforcing them would prohibit various legitimate users from actually doing their work; The people in charge of implementation and administration of these systems are plain incompetent and/or disinterested). 3. Securing everything that is currently deemed necessary to the extent prescribed by relevant law will turn out to be prohibitively expensive due to various logistic problems (who will implement necessary auditing systems for legacy systems that nobody udnerstands and there are no funds to replace, where will you store all the auditing information, where will you get competent engineers that actually understand the infrastructure and are willing to work proactively to secure them - for a laughable wage?,...). So - as a matter of fact - I have to state that governments don't really take IT security seriously. They don't understand the issues and they don't even care. They care for scapegoats and thats it. Disclaimer: Most of my work is on government related IT projects/systems.

shin_lao 16y ago
Security is hard. Security on a large scale system is is very hard. Securing a legacy system is extremely hard. Securing a large legacy system is near impossible. Yes the government wants to cover its ass first and foremost. But that doesn't mean they don't take IT seriously, they just don't understand it to the point they cannot select people to work with that understand it correctly. disclaimer: I've designed COMSEC systems
- tptacek 16y ago
  If they took IT security seriously, it wouldn't be a checkbox in a Lockheed or SAIC contract.

jrockway 16y ago

The problem is that you just can't secure a whole infrastructure overnight and that security is very hard. Actually, you can never completely defend against every possible attack. Any finite limit can be exceeded. As long as an attacker can use up some sort of finite resource on your box or network, you're toast. SYN floods don't happen anymore because SYN cookies make the size of your TCP half-open connection table infinitely large. So no DoS anymore. But other things are not that easy to fix; you can prevent 1 IP from opening a million slow connections to your server and filling up your state table and running your web server out of fds. But you can't prevent a million people from all opening up one connection without blocking legitimate users. DoS is very hard to defend against. I think in this case, there is probably something easy to fix (get rid of those Windows 95-based routers and app servers), but in the general case, there is nothing that can be done.

Nrsolis 16y ago
This is not true. I work for a major DDoS mitigation equipment company and we see SYN floods all the time. And you CAN block one million users from all opening up one connection. Our software/hardware makes this happen. There are MANY MANY ways that DDoS can be dealt with; the biggest hurdle in many cases is convincing a customer that they might be next. Until then, they often don't see the need to spend the money on sufficient capacity or properly test their system against the range of "probable" attack vectors. That's likely what you're seeing here. It /is/ true that attacks are becoming more sophisticated and targeting applications rather than just pure network resources (e.g. b/w). A big part of our efforts are trying to abstract away the potential attack vectors common to several application stacks rather than developing solutions for each one at a time. P.S. Paypal seems to work fine for me right now.
- jrockway 16y ago
  Yeah, it's hard to speculate as to what's going on, because we are not Paypal or Mastercard. Maybe someone from Anonymous works there and changed their uplink media to 10BaseT :) So about the SYN floods you see in real life, how do those work? Do routers not do SYN proxying for the servers behind them? Do SYN cookies not work? Are sequence numbers being forged? Is the link saturated? Something else?

tptacek 16y ago

That has been the opposite of my experience. To a large extent, the government can't take IT security seriously, because they've outsourced it. There are smart people in and around the government but no coherent strategy. I don't want to get too specific but no DoD network I've seen or talked to people who ran ranks with the least of my financial services clients.

joebananas 16y ago

> Governments take IT security very seriously, I don't see where you've seen they don't. The very fact that this whole cablegate debacle even exists clearly demonstrates that parts of the US government do not.

Retric 16y ago
I take death seriously, that does not mean I get to live forever.
- joebananas 16y ago
  You don't give some random army grunt access to your on/off switch.
  - Retric 16y ago
    Actually, I happen to work for the Army so I am often near well armed "grunts" with access to that off switch. It's a judgment call, but I assume walking around the Pentagon is probably safer than driving which I am also willing to do. More to the point, I think being respectful to well armed people is prudent, hiding under the bed is pointless. So, while I recognize the risk to life and limb at some point you need to focus on risk mitigation rather than avoidance. PS: To put this into perspective, one of the guys I work with was there for 9/11. He sustained significant injury while several people in the room with him died. Yet, he is also willing to work in the building and most people in the building where not harmed.
    - joebananas 16y ago
      Not interested. My original post was not about your completely-missing-the-point simile, but about the fact the the US government demonstrably sucked at IT security when they let the great unwashed have the kind of access they had to State Department cables.
      - Retric 16y ago