Gilligan urges agencies to push for safer software

Gilligan urges agencies to push for safer software

SANS-FBI Top 20 Internet security vulnerabilities

General deficiencies:


  • Default installation of operating systems and applications

  • Weak passwords

  • Incomplete data backup

  • Unneeded ports left open

  • Packets not filtered for correct incoming and outgoing addresses

  • Incomplete logging of network activity

  • Vulnerable Common Gateway Interface programs


    Microsoft Windows deficiencies:


  • Vulnerability in the Unicode Standard that lets Web servers be hacked through a faulty uniform resource locator

  • Internet Services Application Programming Interface buffer overflows

  • Internet Information Server Remote Data Services weakness

  • Unprotected networking shares

  • Null session connections

  • Weak default password protection in LAN Manager


    Unix deficiencies:


  • Buffer overflow in remote procedure call services

  • Sendmail vulnerabilities

  • Berkley Internet Name Domain weaknesses

  • R command weakness for connecting to remote systems

  • Remote print control daemon weakness

  • Sadmind and mountd buffer overflows

  • Default Simple Network Management Protocol settings

  • The Air Force's deputy CIO last week called on the software industry to deliver products that are more secure out of the box than they are now.

    'None of us can afford a continual race with hackers in the current find-and-patch mode,' John Gilligan said.

    Gilligan, co-chairman of the CIO Council's security, privacy and critical infrastructure committee, said government agencies should demand more secure software from suppliers and be willing to pay for it.

    'The initial cost may be higher, but we need to look at the whole lifecycle,' he said.

    Gilligan made his challenge last week at the release of the SANS Institute-FBI list of the most critical computer security vulnerabilities. It expands last year's top 10 vulnerabilities to 20, which most successful hacker attacks exploit, said Alan Paller, research director of the SANS Institute of Bethesda, Md.

    Paller said none of last year's top 10 vulnerabilities has been retired because poorly configured software still is being sold and installed.

    'The Internet is not ready to withstand a major attack,' he said.

    State Department CIO Fernando Burbano testified to the effectiveness of the list. He said he oversees systems with 50,000 users at 260 locations in 169 countries that successfully weathered the recent onslaught of Internet worms.

    When Code Red struck, State systems received 500,000 copies the first day and 1 million a day for the next several days but without infection, said Burbano, who also is assistant secretary of State for IRM.

    Nimda repelled

    As for the Nimda virus, 'We were bombarded the first day, and we repelled it,' he said. There were 1 million strikes the first day, 4 million the second and 8 million the third.

    State has contingency plans for locking down its systems and disconnecting from the Internet, 'but we haven't had to do that' because of the SANS-FBI list, Burbano said. 'We've implemented most [patches] to the extent we can.'

    Burbano predicted that America's war on terrorism will produce a cyberbacklash.

    'When the attack starts, you're going to see some of the terrorist countries striking back from cyberspace,' he said.

    Gilligan agreed.

    'We can be absolutely certain there will be a continuation, and probably an escalation, of cyberattacks in the future,' he said.

    He acknowledged that demanding better software from vendors is difficult because of the lack of standards.

    'We are nowhere near' being able to certify commercial software as secure, he said. 'But I think we're at the point where we are ready to begin discussions.'

    The Center for Internet Security will release an automated scanner program that searches for the SANS-FBI top 20 vulnerabilities. To request a copy, send e-mail to info@cisecurity.org with the subject 'Top Twenty Scanner.'

    More information appears on the SANS Web site, at www.sans.org.

    About the Author

    William Jackson is freelance writer and the author of the CyberEye blog.

    Reader Comments

    Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

    Please type the letters/numbers you see above