White House Attempts To Strengthen Federal Cybersecurity After Major Hacks (cnn.com) 20
The White House plans to release an ambitious strategy Wednesday to make federal agencies tighten their cybersecurity controls after a series of high-profile hacks against government and private infrastructure in the last two years, according to a copy shared with CNN. From a report: It's one of the biggest efforts yet by the Biden administration to secure the computer networks that the government relies on to do business. Under the strategy, federal employees will need to sign on to agency networks using multiple layers of security and agencies will have to do a better job of protecting their internal network traffic from hackers. The strategy gives agencies until the end of the 2024 fiscal year to meet these benchmarks and others. The overhaul was inspired in part by a 2020 spying campaign by alleged Russian hackers that infiltrated several US agencies and went undetected for months, leaving US officials frustrated at their blind spots. The hackers tampered with software made by federal contractor SolarWinds, among other tools, to sneak onto the unclassified networks of the Departments of Justice, Homeland Security and others.
Small quibble: (Score:4, Insightful)
This hasn't been going on for just a few years. It's been happening for a decade. It's about time we hardened our government (and contractors) against hackers.
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Let's impose laws/punishments for which are more strict (and actually enforceable) against people that leave their cars and homes unlocked, who refuse to behave more responsibly, and stop enabling casual theft.
As it stands they get off as easy as the wall-street execs that caused the 2008 crash.
Re: (Score:3, Insightful)
Just checking: We are talking about Clinton's emails in this thread, right?
Re: (Score:1)
Re: (Score:3)
I would argue that back taking lax precautions with your home auto or even personal effects you are making theft less risky and therefore a more profitable vocation for thieves. To some small degree you are endangering others. I would also argue your right to do as you please with your own property greatly outweighs my right not to be exposed to somewhat heightened theft risk due to your negligence.
Its the same with IT and PII. For the most part if they have your PII its because you gave it to them. The fa
Re: Small quibble: (Score:2)
Actually, some of that already exists. Those items that you're talking about are usually covered by insurance, and if the insurance company finds that you didn't conform to their requirements then you ain't going to get a payout.
At a local gun store in West Virginia got robbed 2 years ago. Insurance company found out they didn't lock everything up in the safe at night and it was stolen from the glass display cases. They're no longer a gun store because the insurance company told him to kiss off and refused
Re: (Score:3)
Problem is government tends to accomplish it in the most assbackwards, buzzword laden methods.
Already seen how they "hardened" access to some employee records by requiring a cell phone for two-factor authentication.
Problem is several federal sites ban cell phones.
Only took them about 5 years to realize the problem, and another five years to jump through enough bureaucratic hurdles to come up with a workaround.
Meanwhile, during those 10 years, the only way to access those records sans cell phone was trough t
Re: (Score:2)
Re: (Score:2)
Probably because originally everything was stored on big iron that was more difficult to remotely access. Tough to do much when you've got punch card and tapes involved. Then there started to be terminal access and things got easier for the end users but were still limited by physical access. Eventually the internet came along and access exploded, but due to cost and must keep the interface to the data the same because all these tools rely on it working this way, more security was never factored in. It shou
Re: (Score:2)
Better late than never I guess. Let's see if they can do it though.
Authentication (Score:3)
Re: (Score:1)
Have you ever considered that in all of your dissatisfying relationships, the common factor is you?
Doubling Down on a Failed Model (Score:3)
Implementing a litany of mandatory security controls on systems running off-the-shelf software is a guaranteed disaster.
Most vendors assume a default (or nearly default) security posture when their application is installed and executed. A system confirming to a pre-defined and poorly scoped set of controls will often fail to run the application.
In this situation, you will need senior-level administrator and/or developer support to identify the specific security options that are breaking the application. There may be more than one control blocking the application, which renders untargeted, ad hoc troubleshooting ineffective.
Junior admins and point-and-clickers will have a rough ride. Scripting or programming is almost a necessity---and smaller environments that don't need it could probably move to a government cloud with enterprise monitoring anyway.
You must be able to interpret verbose logging for every essential daemon, service, or application if you want reliable infrastructure and timely changes/additions. These skills are neither common nor cheap.
Look at the government pay scales (adjusted for locality) for GS-9 through GS-12, which are the pay bands for people doing this type of work. In the larger metro areas where these workers are easier to find, do you expect to get strong candidates with those types of skills?
Re: (Score:1)
A system confirming to a pre-defined and poorly scoped set of controls will often fail to run the application.
A system conforming to...
Hold CEOs Criminally and Financially Liable (Score:1)
What else will light a fire under their butts?
You get knocked down by a 0-day that's one thing. You get knocked down by known vulnerabilities you go to jail.
The Federal Government (Score:2)
The Federal Government blobbitty blah blah something cybersecurity blobbity bloo blob. Agencies will be required to bloo blob before blah blah and something something moar security something blah blah. This will be the blobbity blah bloo blob effort to blah that someone something something security something.
How many articles on how the federal government is finally going to get its cybersecurity shit together can we possibly publish without the federal government actually doing anything at all?
No accounta