DHS looks to get its cyberhouse in order
Connecting state and local government leaders
The Homeland Security Department plans several consolidation efforts to shore up security after a grilling on the Hill.
Homeland Security Department officials are counting on system consolidation to help solve some of the cybersecurity shortcomings that got a recent airing on Capitol Hill.On the heels of a report by the Government Accountability Office that found 'systemic and pervasive' problems with DHS systems, members of the House Homeland Security Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology, grilled DHS Chief Information Officer Scott Charbo at a hearing on the state of the agency's cybersecurity.'Information provided by DHS suggests that the CIO is failing to engage in defensive best practices that would limit penetrations into DHS networks,' said Rep. Jim Langevin (D-R.I.), subcommittee chairman. 'The department's failure to implement the Einstein program, contracts with Sprint and MCI where the carrier has misconfigured the firewall, and other problems are quite disturbing.'Charbo said the agency's cybersecurity posture is getting better but could not answer many of the questions about the problematic configurations of DHS' systems.When Langevin questioned whether department Internet service providers Sprint or MCI ' or even DHS' National Cyber Security Division ' has audited the ISPs for security holes, Charbo said that, although he is ultimately responsible for security, the issue of auditing contractors is not a decision any CIO could make. He said it needs to be addressed from higher up the chain of command.Charbo also was unable to say how long the vulnerabilities in the ISP have been open and when the last audit of the data network occurred.'It was a shock and a disappointment to learn that the Department of Homeland Security'has suffered so many significant security incidents on its networks,' Langevin said. 'DHS reported to the committee that it experienced 844 cybersecurity incidents in fiscal 2005 and 2006.'Langevin said the incidents included workstations infected with Trojans and viruses, a workstation infected with a Trojan scanning for Port 137, which demonstrates 'individuals attempting to scan DHS systems through the Internet,' and PCs containing suspicious beaconing activity and a botnet that lets a hacker control the compromised computer.Charbo countered by saying just because there was an incident doesn't mean there is success in breaking into DHS systems.'We monitor routers on the edge,' he said. 'If we find suspicious activities, we track it on our network and take care of it immediately. We do forensic analysis if we identify malware, too.'Keith Rhodes, GAO's chief technologist, said a lot of these problems could be fixed by improving DHS network configuration of specific hardware devices or software.'There are zero-cost fixes,' he said. 'DHS has made some fixes, but there are others they could do.'Rhodes also said Charbo's claim about lacking the authority to audit an ISP wasincorrect. 'The Centers for Medicare and Medicaid audited their telecommunications contractor,' he told lawmakers. 'We have reviewed the [ISP] at CMS, identified vulnerabilities and made recommendations.'When Rep. Bennie Thompson (D-Miss.), chairman of the full committee, asked Charbo whether the lack of cybersecurity for the U.S. Visitor and Immigrant Status Indicator Technology program made it vulnerable to hacking, Charbo said there was no evidence of any breaches.Rhodes said DHS does not have the controls in place to protect the system if there had been an intrusion.'If someone was smart enough to get in, they could get out and no one would know about it?' asked Rep. Bob Ethridge (D-N.C.).Charbo said DHS has made some fixes to immediate problems but is still working with GAO.He said one thing GAO recommended would be to encrypt the department's local-area network, but he believes that won't be necessary.'We encrypt the data going out of the network, but not while it is in the network,' Charbo said. 'We will mitigate the risks, and if there are easy controls, we will sit down with GAO and discuss them.'Alan Paller, director of research for the SANS Institute, who attended the hearing, contested Charbo's rationale for not encrypting data on the local-area network. Paller said one successful spear phishing attack could wreak havoc on the LAN.'Spear phishing eliminates the perimeter defenses,' he said. 'It could create a rogue tunnel out of the system through Port 80.'GAO will issue a report on DHS cybersecurity problems in July, said Gregory Wilshusen, the watchdog agency's director of information security issues.
Audit in limbo
Phishing threat
Jason Miller is news editor of Federal Computer Week, an 1105 Government Information Group publication.
Audit in limbo
Phishing threat
Jason Miller is news editor of Federal Computer Week, an 1105 Government Information Group publication.