Energy's security still unfit, report says
Like a wildfire that refuses to die, criticism surrounding failed computer security efforts have again seared the Energy Department.
By Tony Lee OrrGCN StaffLike a wildfire that refuses to die, criticism surrounding failed computer security efforts have again seared the Energy Department.The latest flare-up came in the form of a June 9 General Accounting Office report that says the department's systems for unclassified civilian research make other systems throughout Energy more vulnerable.Although the civilian research systems contain unclassified data, some of the information is sensitive and requires protection from inappropriate access, GAO said.For the report, , GAO reviewed unclassified research systems at 15 laboratories.In the past year, the department has struggled with one computer security problem after another. Following an espionage scandal at the Los Alamos National Laboratory nuclear facility in New Mexico, the President's Foreign Intelligence Advisory Board enumerated ongoing problems with security at national labs and attitudes in general at Energy [].As a wildfire threatened Los Alamos, members of an elite group with top security clearance discovered the disappearance of two removable hard drives containing sensitive nuclear data used but failed to report the problem for nearly three weeks [].Last month, the department's inspector general revealed that officials at Energy's Savannah River Site sold surplus computer equipment without wiping the drives clean of data [].The new GAO report concluded that Energy had no security plans for 17 of 20 systems sampled during the audit and that the department had carried out no system-specific risk assessment for 19 of the systems.'Few on-site audit reviews have been conducted, and official IT security policies have not been enforced,' the report said.The report also indicated that Energy officials at labs are not reporting all security violations, and that the computer security plans proposed by the department have not been fully implemented.Energy's security czar, retired Air Force Gen. Eugene E. Habiger, responded to the report in writing and said the information was outdated and that GAO investigators seemed confused as to existing department policies.GAO said it conducted its reviews this year and late last year.The GAO report said threats from hackers have increased because vulnerabilities and automated attack tools for exploiting them are increasingly being publicized on the Internet, enabling attackers with little technical skill and knowledge to cause serious damage.In the past two years, 253 reportedly successful attacks have resulted in four instances in which Energy officials had to take systems offline to make repairs, GAO said.Investigators found poor access controls, such as the connection of two external networks with no restrictions on traffic, the report states.During penetration testing, one lab's intrusion detection system discovered the GAO investigators' attempt, but not before the GAO team had obtained detailed technical information about most of the systems at the lab.'It is possible that a potential intruder, working stealthily over an extended period of time, could gain access to these machines without being detected,' the report said.Furthermore, GAO said, the labs rely too heavily on intrusion detection devices.'Since as much as 60 percent of the serious incidents at the DOE laboratories involved compromised passwords, the heavy reliance on ' intrusion detection is risky,' GAO concluded.
GAO study finds treatment of unclassified data puts other systems at risk
Information Security: Vulnerabilities in DOE's Systems for Unclassified Civilian Research
GCN, Feb. 21, Page 1
GCN, June 19, Page 66
GCN, July 3, Page 1
Threat is on
| Hacking events that forced Energy repairs |
| ''October 1999: System administrators at an Energy lab discover that a hacker entered systems through an improperly configured computer. To resolve the security breach, the lab disconnected all networks from the Internet for a week to change users' passwords. ''August 1999: A hacker launched a denial-of-service attack that within three minutes compromised more than 20 systems at one lab. The hacker planted malicious software code on 27 systems. The lab was forced to disconnect the systems from the Internet to restore them. ''July 1998: A hacker exploited a known software vulnerability to break into a lab's e-mail server and modify files. The lab had to halt access to the Internet while it changed all passwords. ''June 1998: A hacker used a Unix remote log-in command to launch an attack on a lab system from a compromised machine at another DOE site. Once on the remote system, the hacker exploited that machine, compromising 40 to 50 user accounts on more than 30 systems. Energy had to take the system offline and change the passwords. |
Information Security: Vulnerabilities in DOE's Systems for Unclassified Civilian Research
GCN, Feb. 21, Page 1
GCN, June 19, Page 66
GCN, July 3, Page 1
Threat is on