Report: DHS cyber security lagging http://www.securityfocus.com/news/10148
By Kevin Poulsen, SecurityFocus Dec 16 2004 6:28PM The U.S. Department of Homeland Security is having some homeland cyber security issues on its systems providing remote access to telecommuters, according to a newly-released report by the DHS Inspector General's office. Earlier this year security auditors armed with ISS's Internet Scanner, @stake's L0phtCrack and Sandstorm Enterprises' PhoneSweep 4.0 spent five months probing hosts, attacking passwords and war dialing the Department. They found that some of the hosts designed to allow home workers and other trusted users access to DHS networks by modem or over the Internet lacked the authentication measures called for by official NIST guidelines and recommendations by the National Security Agency, like minimum password lengths and password aging. Moreover, system patches were not kept up to date, leaving some systems open to known buffer overflows and other exploits. Meanwhile, a war dialing effort against 2,800 DHS phone lines turned up 20 modems that the Department couldn't immediately account for. "Due to these remote access exposures, there is an increased risk that unauthorized people could gain access to DHS networks and compromise the confidentiality, integrity, and availability of sensitive information systems and resources," the report concludes. The audit examined DHS's Emergency Preparedness and Response Directorate; the Bureau of Immigration and Customs Enforcement; the Bureau of Citizenship and Immigration Services; and DHS Management. Only DHS Management proved resistant to L0phtCrack. Of the other three components, passwords were crackable with user name and dictionary attacks at a rate between 8% to 37%, with some accounts protected by no password at all. In a written response attached to the report, Department CIO Steve Cooper said some of the auditors' concerns were overstated: The systems suffering known vulnerabilities were waiting for patches to come out of testing, and any genuine effort at password hacking would be hobbled by the Department's policy of limiting failed login attempts, wrote Cooper. "As we complete the transition to Windows 2003 on most of our networks, it will be impossible to have a password that does not comply with DHS complexity requirements," he wrote. You are a subscribed member of the infowarrior list. Visit www.infowarrior.org for list information or to unsubscribe. This message may be redistributed freely in its entirety. Any and all copyrights appearing in list messages are maintained by their respective owners.
