Right, all the Iranians had to do was follow MS's recommendations for USB ports on sensitive machines. Good thing they didn't. :rofl:
Interesting article on the problems with passwords
- Thread starter aramis
- Start date
Right, all the Iranians had to do was follow MS's recommendations for USB ports on sensitive machines. Good thing they didn't. :rofl:
Yea, that too!
Actually no one does. I'll have to look for it but a year or so ago there was a study done by the GAO on USB drives. They took a bunch of them and dropped them in the parking lots of several different government office buildings, including Homeland security. They had, IIRC, something like 90% of their USB drives taken into the buildings and plugged into a computer.
Users can be lazy and stupid. The only people surprised by this are people not in IT...
Yea, that too!
Actually no one does. I'll have to look for it but a year or so ago there was a study done by the GAO on USB drives. They took a bunch of them and dropped them in the parking lots of several different government office buildings, including Homeland security. They had, IIRC, something like 90% of their USB drives taken into the buildings and plugged into a computer.
Users can be lazy and stupid. The only people surprised by this are people not in IT...
My friend used to be the CIO DHS and congress wouldn't give him statutory authority to issue orders that were IT related for any network in the entire Dep.
I get people who tell me all the time that our government systems MUST be more secure than most civilian non-government networks and I just laugh...
For Traveller I would think a body scan would be more common for higher tech worlds. I still think PWs are okay for most things. It's like having a lock on your front door. It'll deter the casual would be burglar, but not the professional who already has the tools or will with a method he knows works, to get into your home.
For really important stuff, I think verification with witnesses would be the safest way to go.
I get people who tell me all the time that our government systems MUST be more secure than most civilian non-government networks and I just laugh...
That one always gives me a chuckle too.
I get people who tell me all the time that our government systems MUST be more secure than most civilian non-government networks and I just laugh...
Given that most civilian networks are totally insecure except by accident, it's true.
The best civilian ones generally beat the best military ones, but the SCL5 systems have levels of security that are hard to beat in the civilian world. An SCL5 system has to be in a guarded secure facility on a secure installation with no connections to outside systems other than by secure courrier-carried media.
Pretty hard to beat in the civil world. It can be met, but most civil uses now involve network access.
Hi,
As a completely pointless aside, I'm reminded a bit about an incident from several years ago at one office that I worked at. To get into the office before or after regular office hours, or to enter through the side doors, each employee was issued a passcard that you were supposed to waive in front of a scanner. Most of us would either keep this on a lanyard around our necks or in our wallet.
Over time, however the scanner began to fail and you often had to try a couple times to get it to click. One day while showing a new employee around I saw a friend of mine standing in front of one of the scanners shaking his "backside" back and forth in front of one of the scanners (presumably since he had is card in his wallet in his back pocket). In response to the confused look on the 'new" employees face, I joked that the company had originally spec'd out a "retina" scanner for the door but the subcontractor misread the contract so that we ended up with a "rectal" scanner instead.
I'm pretty sure he didn't fall for that, but it did take him awhile to realize that he probably should only trust about 1/2 of what I said most of the time.
As a completely pointless aside, I'm reminded a bit about an incident from several years ago at one office that I worked at. To get into the office before or after regular office hours, or to enter through the side doors, each employee was issued a passcard that you were supposed to waive in front of a scanner. Most of us would either keep this on a lanyard around our necks or in our wallet.
Over time, however the scanner began to fail and you often had to try a couple times to get it to click. One day while showing a new employee around I saw a friend of mine standing in front of one of the scanners shaking his "backside" back and forth in front of one of the scanners (presumably since he had is card in his wallet in his back pocket). In response to the confused look on the 'new" employees face, I joked that the company had originally spec'd out a "retina" scanner for the door but the subcontractor misread the contract so that we ended up with a "rectal" scanner instead.
I'm pretty sure he didn't fall for that, but it did take him awhile to realize that he probably should only trust about 1/2 of what I said most of the time.
Funny story from years ago when I was working in D.C. Remember when IR wireless keyboards came out? Well, Foggy Bottom purchased for all their PC's. You could stand on the sidewalk outside and pick up the keyboard transmissions from about 1/2 the users. :rofl:
But yes, there are certain gov sites that are more secure than pretty much anything in the civvie world.
Fritz_Brown
Super Moderator
Seems it would be easier to just tattoo a number on their forehead.....
(Yes, that's a joke.)Definitely! It's a never-ending fight.
Sadly, that doesn't surprise me too awful much.
*facepalm* Fortunately, certain government facilities have *finally* taken some action to monitor and restrict that sort of thing nowadays.
That was my thought. But, no, most government networks aren't nearly as secure as they ought to be. Neither are a lot of the important corporate ones.
ROFLMAO! :rofl: Given how high most of our scanners are (because you're supposed to wear the badge above the waist), that would have been some serious bending and waving!
Fritz_Brown
Super Moderator
That's why I stay away from wireless keyboards. I will use a wireless trackball. As a matter of fact, I had to fight with the rulesmakers to get a wireless trackball on my system at work (since they no longer make the shape/style of trackball that works for me in a wired configuration). They were concerned about the wireless aspect. Since it wasn't a secure facility, however, and people could have cell phones and such, it shouldn't have been a problem. But there's that blanket wireless ban....
The reasoning I used that evidently worked was "Do you really think anything useful can be gathered by bad guys by knowing that I scrolled down... down... down... down... click! Over, over... up, down a little... right click! up a little and click!?"
It doesn't take a wireless keyboard to be tapped into. Any keyboard that isn't secured by something like the military/goverment Tempest program can be tapped from a distance.
IME, what breaks network security is usually Executives who insist on being able to do things that are against network security policies. Sometimes the only thing you can do is to inform them of the potential problems and perhaps get a signature from them acknowledging it. One of the things that I hear almost weekly, "I took my laptop home and now it doesn't work right since my kid did homework on it. But he wouldn't have gone to any bad websites..." When they say that, I just run through them through multiple anti-spyware programs and show them what they got infected with.
Or the other thing is someone taking a "Secure" laptop home and then they leave it visible in a car and are surprised when their car window gets broken and the computer stolen. We track lost/stolen pdas and phones with GPS all the time also. "I just left it in the truck for a few minutes..." :rofl:
IME, what breaks network security is usually Executives who insist on being able to do things that are against network security policies. Sometimes the only thing you can do is to inform them of the potential problems and perhaps get a signature from them acknowledging it. One of the things that I hear almost weekly, "I took my laptop home and now it doesn't work right since my kid did homework on it. But he wouldn't have gone to any bad websites..." When they say that, I just run through them through multiple anti-spyware programs and show them what they got infected with.
Or the other thing is someone taking a "Secure" laptop home and then they leave it visible in a car and are surprised when their car window gets broken and the computer stolen. We track lost/stolen pdas and phones with GPS all the time also. "I just left it in the truck for a few minutes..." :rofl:
A lot of sec gov installations tackle this via shielding the walls and windows (if any). That way if some brain dead exec swaps out his approved keyboard...
Yea, I know. The USN used to have a program for that called Tempest, I don't know if they still call it that but I worked on those systems 20 years ago.
Fritz_Brown
Super Moderator
I won't get into what is and isn't current procedure or technique. But, there are some things still done to protect information systems that are based on the insecurities found in old technology.
Or, they simply take home classified information and put it on their home computer... then surf the internet... or let their daughter surf the internet...... :nonono:
Or, they simply take home classified information and put it on their home computer... then surf the internet... or let their daughter surf the internet...... :nonono:
Passwords, like locks, are for honest people.
One of the most prevalent ways of social engineering is going through the trash and getting people's names, then working that angle. From what I have read, various groups, notably east euros, can be persuasive at getting what they want, which has facilitated the rise of the "private security contractor".
One of the most prevalent ways of social engineering is going through the trash and getting people's names, then working that angle. From what I have read, various groups, notably east euros, can be persuasive at getting what they want, which has facilitated the rise of the "private security contractor".
Yes, that works against the not quite bright...
... or employees who couldn't care less or vulnerable assets like wife and kids; it is a pretty common scenario we train for in crisis management.
Sad part is, a lot of cars are stolen because of this, and people are surprised!
Fritz_Brown
Super Moderator
You know, should Traveller have a tech that only allows intelligent people to actually operate computers as anything more than a totally locked down dumb terminal?
Similar threads
