t do background checks on some auditors who had access to sensitive information and has “routinely failed to secure physical access” to computer systems; the EPA (Environmental Protection Agency) has a security program deemed “ineffective” due to “pervasive problems”; and 7 of the Department of Commerce's computer systems were seriously breached, giving full access rights to “sensitive economic, financial, personnel, and confidential business data” just by logging on as a sysadmin without a password!
Security analysts feel the government must coordinate its security efforts and establish accountability for problems. In light of September 11, the Bush administration plans to create “an office of cyber-security in the National Security Council office in the White House.”
For much more information, please see The Washington Post.
I think the most salient point in the entire article is that this has been a known–and addressed–problem for years, but it's only now, after the 9/11 tragedy, that we have a real possibility of fixing the holes that plague our government systems. It's totally unfortunate that a massive disaster has to happen to make us wake up to the severity of computer system vulnerabilities, but that's just human nature. Let's hope that a new Department of Homeland Security and this new Office of Cyber-Security can get our government's computer systems shored up and protected before the next sophisticated terrorist attack is preceded by a massive computer outage. If the FAA is still having problems keeping unauthorized people from accessing computers (most security plans do forget to address the key issue of a hacker changed Yahoo! News stories in an attempt to expose a system vulnerability; while the hacker didn't really intend to cause trouble, his exploits point out how subtle and devious a hack attack can be on the 'Net. We've already seen how malicious rumors in a chat room can cause a company's stock to tank … information can be a dangerous thing in unscrupulous hands, and the Internet's well-publicized lack of providing a “this is really true” type of verification could be a valuable tool to malicious folks bent on causing more havoc across the world.
We've been covering a lot of security issues recently, and we can only hope that everyone–from a small company sysadmin to the home user to whoever ends up coordinating the government's new cyber-security efforts–will start taking computer system protection measures more seriously.
USER COMMENTS 8 comment(s)
|Good pointer (10:46am EST Fri Sep 28 2001)
Thanks for the advice! – by Sammy Bin Liner
|Question? (11:06am EST Fri Sep 28 2001)
Is everybody else sick of hearing the word 'Cyber' every 20 seconds or so? Can't we just let it die quietly like 'The Information Superhighway' did? Please? – by Pete Reid
|this got to be funny…..whats wrong what these people (11:38am EST Fri Sep 28 2001)
just by logging on as a sysadmin without a password! – by mmmmm
|CyberThreat (12:34pm EST Fri Sep 28 2001)
CyberTerrorists will attack whenever they find an opportunuity. In order to keep our cybersystems safe, we need to enact cyber-countermeasures and do cyber investigations of individuals known to do cybercrimes.
My thinking? I'm going to go pour myself a tall glass of spiced apple cyber. – by F Theilig
|I'm shocked (1:03pm EST Fri Sep 28 2001)
FAA systems that are still insecure?? Are these the same systems that GWB was talking about yesterday to take control of an aircraft and land it remotely?
Right now, I feel perfectly secure on commercial aircraft. But, if GWB installs groundbased flight control systems on the planes like he spoke about yesterday, I'll never set foot in an aircraft again. Think about it, Flight Simulator and War Games!!
– by Get a Grip
|a bit off topic: no need for cyber terrorists (1:44pm EST Fri Sep 28 2001)
Hate to say that, but this is a real story: 4 armors were sent to defend a local VOA building.
Unit A broke down somewhere in the country, unable to move. Unit B did better and finished off just one crossing away from the building as battery ran