Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security

How Safe are Government Computers? 35

Posted by Cliff from the a-soft-underbelly? dept.
KingOfBLASH asks: "Recently, when I was in the local City Court to protest a parking ticket, I noticed that all of the computers were running Windows (some as old as Windows 95!), and there were definitely network cables snaked around them. The City Hall suffers from the same affliction. Given that some of these computers have passed the End of Life for support, and there are a number of known exploits, how safe our government computers? What damage could be done if they were attacked?" It would be interesting to note if it's just local governments that may be running lower-than-expected tech or regional governments, as well. It would also be worthwhile to hear how governments outside the US compare to their American counterparts.
This discussion has been archived. No new comments can be posted.

How Safe are Government Computers? More

How Safe are Government Computers?

Comments Filter:

  • Well what are they really running? (Score:3, Insightful)

    by SmallFurryCreature ( 593017 ) on Monday March 29, 2004 @08:40PM (#8709568) Journal
    It may be like the police here that they run Windows as the base OS but really run the app on a Unix somewhere through a terminal session. Maybe even a mainframe.

    On the other hand it would be easy to fit goverment with the latest in secure systems. Just pay more taxes.

    • Re:Well what are they really running? (Score:1, Insightful)

      by Anonymous Coward

      On the other hand it would be easy to fit goverment with the latest in secure systems. Just pay more taxes.

      ...or install OpenBSD.

    • Providing more money for government via increased taxes does not necessarily mean you can have more secure systems. I'm not saying that it won't help, but I know of a case where a government operation was caught with missing licenses for Windows, and as part of the settlement, they are now locked into Windows. They are still trying to upgrade everyone to W2k. So, just because they are upgrading does not mean that they are more secure.
    • I can tell you with 100% certainty that City of Seattle IT department is complete crap. Their IT people a bunch of clueless idiots. I wonder how they manage to still be employed.
    • On the other hand it would be easy to fit goverment with the latest in secure systems. Just pay more taxes.

      You are assuming that they would actually spend the money upgrading the computers instead of some politicians pet project designed to get re-elected.

      I have a right to be cynical, I have to hear about politicians every night on the news.

  • Probably no better than your average small busines (Score:5, Informative)

    by MerlynEmrys67 ( 583469 ) on Monday March 29, 2004 @08:42PM (#8709587)
    So government computers have old OSes, old network connections, and old hardware. This doesn't make them any more vulnerable when deployed in a correct networking environment (just because there are network cables - doesn't mean they are hooked up to the network). I would be a lot more wary if the computers were not locked down and you were able to start typing on the keyboard, or even better - just steal the whole darned thing.

    In reality Windows 3.1 was a pretty secure OS - after all there was no networking built in (it was an add on) so very few remote vulnerabilities. That said - there were a LOT of vulnerabilities in the add on software to get them on the network. The other thing going for them is if they are old enough a lot of the vulnerabilities (various scripting flaws etc.) weren't built in to the level that they are today - making the current crop of random Trojan horses a lot less effective

  • private v. public (Score:5, Interesting)

    by MacAndrew ( 463832 ) on Monday March 29, 2004 @08:46PM (#8709620) Homepage
    how much information on these is machines is public record? how much of government records should be confidential? what i would worry more about is people tampering with the records, doubling my property tax and so on.

    also, what if any liability does government have for misuse of information? an infamous case was a state (CA?) that gave out auto licence plate information promiscuously enabled a stalker to locate and kill a woman. for a time state governments were selling driver's license information to marketers, all the way down to the height and weight info. i worked on a proposed "violent gang database" collecting officer intelligence on alleged gang members, such as nicknames, residence, and so on -- i asked, what if the data falls in the hands on an enemy gang?

    i would suggest that government should be held liable for negligent dissemination of private information, and that some sort of comprehensive plan regarding what is "private" and what is required to access private data. right now i can apparently find out how much my neighbor paid for her house, how much she gave to poilitical campaigns, where she's lived for the last 20 years -- questions i would hesitate to ask to her face (and she's nice!). what's going on here?

    this touches a nerve, as you can see. :) don't get me started about identity theft! (like why is SSN used for anything OTHER THAN social security?)
    • For the SSN, there was an article in the latest 2600 [2600.com] about how to live w/o your ssn. Living in Chicago, i have the joy of being in a place where the County accessor's office is online [cookcountyassessor.com](Where the blues bros ended up at the end of the movie, before jail), so you can see photos, and values of any property in the city. They were driving around in unmarked vans photographing your house!!! Worse than this, the cops have small laptops hooked to a centralized db w/ all available info on you(regardless of if you h

  • Public toilet (Score:3, Funny)

    by AtariAmarok ( 451306 ) on Monday March 29, 2004 @08:47PM (#8709631)
    Public computer, public toilet. City Hall *says* they are clean. Who am I to argue?
  • I recently had one fall on me and it bloody hurt!

    -psy

  • As a county DBA/Network Technician (Score:5, Informative)

    by infohord ( 311979 ) on Monday March 29, 2004 @08:54PM (#8709677)
    As a county DBA / Network Technician, I can tell you that most government computers are secure and often more secure then some of the vendors/businesses we deal with. Unlike corporations, we have mandated audit processes. Our agency just went through an extensive IT audit conducted by a legally seperate internal auditor who hired out much of the audit work. From a technology stand point we are very secure (biggest problem was lack or written policy). We take great strides to make sure our network and systems are secure and most other local government IT people I talk to do the same thing.

    We as taxpayers/employees take great pride in protecting the public's information. And while one respondent asked about public record, yes most are public but we MUST control the way in which the public gets access.

    • Re:As a county DBA/Network Technician (Score:1, Interesting)

      by Anonymous Coward
      Yet you still do not have a written policy? Why doesn't the woman in charge of the dept get fired for not doing her job?

    • Re:As a county DBA/Network Technician (Score:2, Interesting)

      by Anonymous Coward
      Ha! You must come from a wealthy county.

      The counties that I have dealt with bitch about replacing Windows 3.51 systems and refuse to keep computers on overnight to receive patches because they bitch about electricity usage.
    • > As a county DBA / Network Technician, I can tell
      > you that most government computers are secure...

      Including those at the US Dept. of Interior?

  • Basically, it sucks just about everywhere (Score:5, Insightful)

    by Mr. Piddle ( 567882 ) on Monday March 29, 2004 @09:02PM (#8709729)

    When aquisitions are written into a contract or pre-set by an annual budget, this means they probably left out long-term maintenance, upgrades, and funds to pay anyone do to maintenance and upgrades. Welcome to basically every bureaucracy large and small on the whole planet.

    For example, wasn't it the good ol' Department of Homeland Security that scored an 'F' for network security this last year? Wasn't the Department of the Interior that was ordered off-line for gross negligence? Large and small, they all fall.

    Have a nice day.

  • Definately network cables ... (Score:5, Insightful)

    by sparkie ( 60749 ) on Monday March 29, 2004 @09:08PM (#8709761) Homepage
    snaked around them.

    So what? Just because they have a network card and some cabling does not necessarily mean they are hooked to anything but another computer in the building.

    I don't believe the question here is 'how prone to hacking are these computers' I believe the question is, 'how strong is the firewall protecting them.'

    That is of course assuming they are 1 connected to the internet, and 2 firewalled.

    The county government here has one computer on the internet, and it's isolated from the other computers, i.e. not networked in with them.

    • The City Of Ithaca [ithaca.ny.us] (Where I live), has a web site. That means that they are hosted somewhere. So, some city computers, somewhere, are connected to the net (note that this counts the possiblitiy they pay some one to host).

      I don't believe the question here is 'how prone to hacking are these computers' I believe the question is, 'how strong is the firewall protecting them.'

      Well, that may be so. But does the city have a competent IT department? And given the fact that even people who are supposed to

      • Having a website doesn't necessarily mean you have internet access either. In this case, a traceroute to The City of Ithaca (I live not too far from you) times out at gig0-0-0.mpls-asp-agw2.mpls.uswest.net (207.225.159.247) 17.866 ms 19.678 ms 17.808 ms, which is in minneapolis minnesota. I by no means the authority on routing.

        Incidentally, cityofithaca.com is hosted by http://www.govoffice.com/

  • Where I work (Score:5, Insightful)

    by blankmange ( 571591 ) on Monday March 29, 2004 @10:16PM (#8710191)
    the weakest link is the employees -- minimal computer knowledge -- anything official-looking and these users will download and install anything.... Worse yet, when they do make a mess of their workstations, they never seem to know what they did to get there...

    Try asking federal employee a few simple questions and you will find the majority of them know next to nothing about security (other than how to log on to their workstation).

    • > the weakest link is the employees -- minimal computer knowledge

      No, the weakest link is the software that requires more than minimal computer knowledge. My wife doesn't have to know how to do a brake job on her car in order to drive it safely. Why should users have to know all the intricacies of security (that even many slashdotters probably don't completely understand) in order to compute safely? Personal computers are just too damn complicated and insecure for their intended audience. What we need is

  • uh..... (Score:2, Funny)

    by gr8fulnded ( 254977 )
    What damage could be done if they were attacked?

    If anyone wants to take the chance of finding out how secure they are, can you get rid of those pesky parking tickets in my name?
  • I work for a state Govt agency finally got an upgraded pc this winter (promised last summer). It has xp. However, I am one of the few that have xp. My PC they just replaced was still on Win98 which is mostly what we run. I don't work in IT (I'm in marketing), but I can safely bet any of you that there's only ONE member of our IT staff (7 members) that is more qualified for the position than I am. Reason: because I am a geek at home, and my SO works in the industry. This is just the cabinet/department

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Close