Lawmakers assail DHS cybersecurity
Connecting state and local government leaders
DHS' IT security posture came under fire from lawmakers after the Government Accountability Office found 'systemic and pervasive' problems.
The Homeland Security Department's IT security posture came under fire from lawmakers after the Government Accountability Office found 'systemic and pervasive' problems.
At a hearing yesterday, House Homeland Security Subcommittee on Emerging Threats, Cybersecurity and Science and Technology members grilled DHS chief information officer Scott Charbo about the state of the agency's cybersecurity, including the U.S. Visitor and Immigrant Status Indicator Technology (US-Visit) program.
'[I]nformation provided by DHS suggests that the CIO is failing to engage in defensive best practices that would limit penetrations into DHS networks,' said Rep. Jim Langevin (D-R.I.), subcommittee chairman. 'The department's failure to implement the Einstein program, contracts with Sprint and MCI where the carrier has misconfigured the firewall, and other problems are quite disturbing.'
Charbo said the agency's cybersecurity posture is getting better, but could not answer a lot of questions around the problematic configurations of DHS' systems.
When Langevin questioned whether Sprint, MCI or even DHS' National Cyber Security Division has audited the ISP providers, Charbo said while he is ultimately responsible for the security, the issue of auditing contractors is not a decision any CIO could make. Charbo said it needs to be addressed from a higher authority.
Charbo also couldn't answer how long the vulnerabilities in the ISP have been open and when the last audit of the data network occurred.
Langevin once again called Charbo's lack of response disturbing.
'It was a shock and a disappointment to learn that the Department of Homeland Security ' has suffered so many significant security incidents on its networks,' the congressman said. 'DHS reported to the committee that it experienced 844 cybersecurity incidents in fiscal 2005 and 2006.'
Langevin pointed out these included workstations infected with Trojans and viruses, a workstation infected with a Trojan scanning for port 137, which demonstrates that 'individuals attempting to scan DHS systems through the Internet,' and PCs containing suspicious beaconing activity and a botnet that lets a hacker control the compromised computer.
GAO's chief technologist Keith Rhodes said Charbo's claim about auditing the ISP is incorrect.
'The Centers for Medicare and Medicaid audited their telecommunications contractor,' he told lawmakers. 'We have reviewed the [ISP] at CMS, identified vulnerabilities and made recommendations.'
Charbo countered by saying just because there was an incident doesn't mean there is success in breaking into DHS systems.
'We monitor routers on the edge,' he said. 'If we find suspicious activities, we track it on our network and take care of it immediately. We do forensic analysis if we identify malware too.'
Rhodes said a lot of these problems could be fixed by improving DHS network configuration of specific hardware devices or software.
'There are zero cost fixes,' he said. 'DHS has made some fixes, but there are others they could do.'
Rep. Bennie Thompson (D-Miss.), chairman of the full committee, asked Charbo whether the lack of cybersecurity for U.S. Visit made it vulnerable to hacking. Charbo said there was no evidence of any breaches.
But Rhodes said DHS does not have the controls in place to protect the system had there been an intrusion.
'If someone was smart enough to get in, they could get out and no one would know about it?' asked Rep. Bob Ethridge (D-N.C.)
Charbo said DHS has made some fixes to immediate problems, but they still are working with GAO. He said one example GAO recommended would be to encrypt their LAN, but he believes that wouldn't be necessary.
'We encrypt the data going out of the network, but not while it is in the network,' Charbo said. 'We will mitigate the risks and if there are easy controls we will sit down with GAO and discuss them.'
But Alan Paller, director of research for the Sans Institute, said Charbo's rationale for not encrypting data on the LAN is faulty.
Paller, who attended the hearing, said one successful spear phishing attack would wreak havoc on the LAN.
'Spear phishing eliminates the perimeter defenses,' he said. 'It could create a rogue tunnel out of the system through Port 80.'
GAO will issue a report on DHS cybersecurity problems in July, said Greg Wilshusen, the watchdog agency's director of information security issues.
NEXT STORY: NIAP certifies Linux