4 ms·

This raises so many questions. The 3 major ones that come to my mind are; 1. How is security on a police server so bad it can be infected with malware in the f

This raises so many questions. The 3 major ones that come to my mind are; 1. How is security on a police server so bad it can be infected with malware in the first place 2. It sounds like they didnt have (good enough) backups, where they could just format the server and restore the data 3. Doesnt this mean that all the data on the police server is effectively compromised? i.e. the hackers could have made a copy before encrypting - so it is likely the data is breached?

fletchowns 12y ago
It's a small town police department. They just don't have the resources to properly address those aspects of IT. I worked IT helpdesk for an affluent city of 70,000, you would be surprised at all the ancient equipment they were still using.
- icebraining 12y ago
  Which raises the question: why are they handling their own servers? Can't it be centralized within the county or state?
  - fletchowns 12y ago
    In theory, maybe. In practice, not even close. The current state of information sharing between different levels of government is really, really bad.
- Spearchucker 12y ago
  Can't they sell one of their armoured personnel carriers or assault vehicles to pay for modern IT equipment? Decent opsec and backups strike me as more useful than militarizing the police.
  - lmm 12y ago
    No, they get those on a "loan" from the agency that actually needs them, mainly as a way to shunt maintenance costs onto the police. But they can't sell them because they don't actually own them.
- kbart 12y ago
  It's not that costly to hire a smart highschool kid to handle the basic security, such as backups and virus/malware prevention. It probably would have been enough in this case. Of course, such means won't protect against targeted attacks, but I doubt small town police departments are in a high risk of that anyway.
  - thaumaturgy 12y ago
    Yeah, but they don't operate that way, and that's part of the problem. From their point of view, if anything goes wrong with whoever they hire to work on their infrastructure, they get excoriated by the public. That smart high school kid turns out to be fond of child porn? The department ends up in the state newspaper. So, they publish RFPs and select for established companies. The RFP publishing process isn't that great, so generally speaking there's a subset of companies that monitor for RFPs at various governmental levels, and those companies don't tend to be supplying the most cutting edge technology at the lowest prices. Then, to cover themselves, the departments require a stupid amount of paperwork and a carefully-prepared proposal that's supposed to establish firm costs on vague requirements, like, "cost per computer to provide hardware support for offices in the county". So, the businesses writing the proposals stuff pork all over the place so that they don't end up upside-down on the deal, and besides, they have to pay somebody just to sit and write up reports like these and fill out paperwork and supply background information and client references and attend social mixers and so on and so forth just to get the work in the first place. The entire process is not great, and it's the direct result of everyone just trying to watch out for their own best interests.
  - MichaelGG 12y ago
    Do these programs lay in wait, hoping to wipe out all backups? Otherwise a weekly USB-drive backup would probably have been enough protection.
    - thaumaturgy 12y ago
      Please, don't call "manually copying files to a USB drive once a week" a "backup", that's something we have to educate people on and it's frustrating. I know you didn't mean it that way, I'm just trying to combat the spread of a bad idea. CryptoLocker doesn't lay in wait or try specifically to target backups. However, it will hit shared network drives; basically, anything that Windows has mounted as a drive letter at the time of infection can end up getting its files encrypted. (And I'm betting that's how the police department's file server was affected -- it wasn't the point of infection, it was just a shared network drive.) CryptoLocker bets on most Windows users not having reliable backups, and it's usually right. This is one area where Mac users often have no idea how good they have it; there is simply nothing in the Windows ecosystem that is as simple, reliable, and complete as Time Machine, at any price.
- pbhjpbhj 12y ago
  Isn't this why you have centralised government. Every town doesn't need to do a procurement process for basic logical infrastructure. The government acquires personnel and skill sufficient to implement the infrastructure and does so in all areas vs. private companies it has to be more cost-effective as there is no need to pay out profits. With logical infrastructure there is no overhead for equipment retention and maintenance. In short why doesn't the gov offer IT support to ensure that government services have properly configured networks, backups, and such - a police department doesn't need freedom to not make backups or to have no firewall. Private companies would still be involved in filling procurement orders for hardware needed to implement the logical infrastructure. It's like having 10,000 offices write their own dress-code, you only need a central standard gov dress-code for office workers; individual locations could overload or enforce the code as they see fit but you reduce the workload using scale. A police department should be more like a fast food restaurant [or at least a UK one], you come along with a pre-built infrastructure and implement it, rather like "apt-get police-department", bang there you have it cookie cutter infrastructure.
  - thaumaturgy 12y ago
    All bureaucratic and personnel issues aside, it wouldn't do enough to address the simple fact that a lot of government services are under-funded right now. As a trivial example, a local fire department just enacted "rolling brown-outs", periods of the week during which they will not have any fire personnel available, and any calls to the fire department will have to be handled by a nearby agency instead. Local citizens are still refusing to accept any tax increases or new fees of any kind to keep the fire department 100% open. It's really that bad. Centralizing services can get you some gains in efficiency -- sometimes! -- but I doubt there'd still be enough to go around.
pjc50 12y ago
Public sector IT is nearly always terrible. Why? It's a slow-change environment. Salaries are low. Morale is often low. Sometimes it's contracted out to the lowest bidder. It's a procedure-orientated environment.

fletchowns 12y ago

It's a small town police department. They just don't have the resources to properly address those aspects of IT. I worked IT helpdesk for an affluent city of 70,000, you would be surprised at all the ancient equipment they were still using.

icebraining 12y ago
Which raises the question: why are they handling their own servers? Can't it be centralized within the county or state?
- fletchowns 12y ago
  In theory, maybe. In practice, not even close. The current state of information sharing between different levels of government is really, really bad.
Spearchucker 12y ago
Can't they sell one of their armoured personnel carriers or assault vehicles to pay for modern IT equipment? Decent opsec and backups strike me as more useful than militarizing the police.
- lmm 12y ago
  No, they get those on a "loan" from the agency that actually needs them, mainly as a way to shunt maintenance costs onto the police. But they can't sell them because they don't actually own them.
kbart 12y ago
It's not that costly to hire a smart highschool kid to handle the basic security, such as backups and virus/malware prevention. It probably would have been enough in this case. Of course, such means won't protect against targeted attacks, but I doubt small town police departments are in a high risk of that anyway.
- thaumaturgy 12y ago
  Yeah, but they don't operate that way, and that's part of the problem. From their point of view, if anything goes wrong with whoever they hire to work on their infrastructure, they get excoriated by the public. That smart high school kid turns out to be fond of child porn? The department ends up in the state newspaper. So, they publish RFPs and select for established companies. The RFP publishing process isn't that great, so generally speaking there's a subset of companies that monitor for RFPs at various governmental levels, and those companies don't tend to be supplying the most cutting edge technology at the lowest prices. Then, to cover themselves, the departments require a stupid amount of paperwork and a carefully-prepared proposal that's supposed to establish firm costs on vague requirements, like, "cost per computer to provide hardware support for offices in the county". So, the businesses writing the proposals stuff pork all over the place so that they don't end up upside-down on the deal, and besides, they have to pay somebody just to sit and write up reports like these and fill out paperwork and supply background information and client references and attend social mixers and so on and so forth just to get the work in the first place. The entire process is not great, and it's the direct result of everyone just trying to watch out for their own best interests.
- MichaelGG 12y ago
  Do these programs lay in wait, hoping to wipe out all backups? Otherwise a weekly USB-drive backup would probably have been enough protection.
  - thaumaturgy 12y ago
    Please, don't call "manually copying files to a USB drive once a week" a "backup", that's something we have to educate people on and it's frustrating. I know you didn't mean it that way, I'm just trying to combat the spread of a bad idea. CryptoLocker doesn't lay in wait or try specifically to target backups. However, it will hit shared network drives; basically, anything that Windows has mounted as a drive letter at the time of infection can end up getting its files encrypted. (And I'm betting that's how the police department's file server was affected -- it wasn't the point of infection, it was just a shared network drive.) CryptoLocker bets on most Windows users not having reliable backups, and it's usually right. This is one area where Mac users often have no idea how good they have it; there is simply nothing in the Windows ecosystem that is as simple, reliable, and complete as Time Machine, at any price.
pbhjpbhj 12y ago
Isn't this why you have centralised government. Every town doesn't need to do a procurement process for basic logical infrastructure. The government acquires personnel and skill sufficient to implement the infrastructure and does so in all areas vs. private companies it has to be more cost-effective as there is no need to pay out profits. With logical infrastructure there is no overhead for equipment retention and maintenance. In short why doesn't the gov offer IT support to ensure that government services have properly configured networks, backups, and such - a police department doesn't need freedom to not make backups or to have no firewall. Private companies would still be involved in filling procurement orders for hardware needed to implement the logical infrastructure. It's like having 10,000 offices write their own dress-code, you only need a central standard gov dress-code for office workers; individual locations could overload or enforce the code as they see fit but you reduce the workload using scale. A police department should be more like a fast food restaurant [or at least a UK one], you come along with a pre-built infrastructure and implement it, rather like "apt-get police-department", bang there you have it cookie cutter infrastructure.
- thaumaturgy 12y ago
  All bureaucratic and personnel issues aside, it wouldn't do enough to address the simple fact that a lot of government services are under-funded right now. As a trivial example, a local fire department just enacted "rolling brown-outs", periods of the week during which they will not have any fire personnel available, and any calls to the fire department will have to be handled by a nearby agency instead. Local citizens are still refusing to accept any tax increases or new fees of any kind to keep the fire department 100% open. It's really that bad. Centralizing services can get you some gains in efficiency -- sometimes! -- but I doubt there'd still be enough to go around.

pjc50 12y ago

Public sector IT is nearly always terrible. Why? It's a slow-change environment. Salaries are low. Morale is often low. Sometimes it's contracted out to the lowest bidder. It's a procedure-orientated environment.