Military Bans Removable Media After WikiLeaks Disclosures 346
cgriffin21 writes "The Pentagon is taking matters into its own hands to prevent the occurrence of another WikiLeaks breach with removable media ban, preventing soldiers from using USB sticks, CDs or DVDs on any systems or servers. The directive prohibiting removable media followed the recent publication of more than 250,000 diplomatic cables, which were leaked to whistleblower Web site WikiLeaks at the end of last month by a military insider."
Re:horse (Score:5, Interesting)
I had a conversation with a high ranking officer a few years back who boldy calimed that their systems was 100% secure, nothing i could do.. When i explained my attack vector would be to phone in and pretend to be from support and ask him to stick in the usb-dongle (wich he had in his mail) and plug it into the secure line
Re:horse (Score:5, Interesting)
The problem is that security tends to be more of a human problem than a technical problem. A person can easily hide a usb stick somewhere on their person, and in the event that fails, take screenshots with a camera or write notes down. The first step is not to take away the usb stick, but to give the individual in question the training and incentive not to leak information in the first place. The training might include don't open any wierd attachments, browse to unauthorized sites, or use io devices from an unverified source. The incentives might include monitoring of sensitive material, legal repercussions, and, God-forbid, not implementing stupid policies that are morally questionable. Assenge noted in an interview that the purpose of Wikileaks wasn't to start a revolution but to make it easier for (morally)good companies to do business and to make it harder for (morally) bad companies to do business. The same could be said for government. Hire a trustworthy+competent staff don't be a jackass and you'll be less of a target, or at least implement fewer inane 'security' measures.
Re:Nothing to see... (Score:5, Interesting)
Years ago we filled the USB ports of SIPRnet nodes at our site with crazy glue.
Which horse? (Score:5, Interesting)
The Pentagon had to ban USB sticks, et al, internally after the biggest single security breach caused by a virus passed around and brought onto the secure SIPRNET within the Pentagon itself. It's unclear to me if the problem was the virus relaying secret information off the secure network, or what, but apparently it was labelled the single biggest security breach by the Pentagon and they're unlikely to be overplaying security holes.
Mind you, NASA has just released secret information into the public domain by selling hard drives known in advance to contain secret information. These are drives that FAILED in-house auditing for such stuff. And prior to that, disk drives containing blueprints for the current generation of super stealth fighters were sold by Lockheed-Martin to Iran. (And people think Wikileaks did bad stuff?!?!?!?! How the hell does a bunch of personal opinions compare with giving a terrorist-funding nation plans for the top US fighters? Internal to Iran, there's the possibility they will find a weakness. Think Death Star plans. Think the Stealth Fighter shot down in Serbia. Yes, the Serbians blew up one of America's best planes, and with a cruddy cheap missile at that. On an international level, the Russians will doubtless use the plans to improve on their own airfoils and may be able to exploit the design to improve on whatever shape-based stealth they've developed so far.)
Add to that that NASA servers have been hacked in the past to turn them into file-sharing sites. Which means that whatever classified files were in those exposed directories have been shared as well. Quite plausibly these files were protected by DES only, not triple DES or AES, as "commercially sensitive" data is classified below secret and certainly only used basic DES up until a couple of years before that breech was discovered.
Then, back in the 90s, there was a breech at the Pentagon due to computers containing classified information being on the public Internet and having .hosts files. (NASA used .hosts files and rsh well into the current millenium and may well still do so.)
That's four Bloody Obvious horses, with gold bridles and gem-encrusted saddles, that have walked out and were only noticed after they kicked the door down at the stablemaster's house. There may be others.
Re:horse (Score:5, Interesting)
The problem is not the decision, so much as that allowing insecure mechanisms (in violation of NSA Security Information notices, Common Criteria instructions for the levels required for secret information and Federal Information Processing Standards, I should add) was not only bloody stupid to begin with, it was in violation of US law regarding the handling of classified information.
Instead of prosecuting Manning, who at worst is guilty of far less than the Lockheed-Martin officials who publicly sold the plans for the current stealth fighters, one should ask why his actions were even possible in the first place. FIPS standards for secure platforms and NSA publications expressly prohibit the capability to transfer files to insecure formats. It is illegal, under US law, to install or use non-compliant systems for Government purposes. This means that giving Manning the computer violated US law. Do you see anyone charged with violating such US laws? I don't.
Re:horse (Score:1, Interesting)
Our company, CodeLock Computers [codelockcomputers.com], provides high quality encrypted Linux computers/workstations. We would be willing to provide welded-shut computer cases. We can also do security screws, USB ports filled with epoxy, and hardware encryption to protect boot partitions from tampering. Best of all, they run Linux.
Re:Which horse? (Score:5, Interesting)
If you outlaw USB drives, only outlaws will have USB drives.
Re:horse (Score:5, Interesting)
Removable media, cameras, or phones with cameras are not and have not been allowed in SCIFs for as long as I remember. Old fashioned paper and pencil is difficult to detect, as are meat memory devices.
No, that does not work. You have to choose who you trust, which is why DSA performs investigations for all military personnel before granting clearances. Security managers interview personnel and ask questions, looking for warning signs. Someone could have a pristine history and list of contacts but still want to do harm: asking the right questions can tip off the people in charge of security. Also, as I saw on Dateline the other night with regards to corruption in the Iraqi police force, paying people a livable wage helps them not to betray you when given a carrot in the form of money, or the satisfaction of fucking with you (e.g. giving documents to Wikileaks).
Security is a tough business. The government needs tens of thousands of people in the intelligence community across all four branches of the military and civilians in various DOD organizations: people from all walks of life, all ages, ethnic groups, geographic locations, etc. No matter how careful they are, there will be leaks. Their goal is to detect internal threats early, and to minimize damage.
For example, when working in a classified environment, everyone is watching not only what they are doing, but keeping an eye on everyone else. Maybe someone left their SIPRNET terminal unlocked and left for the bathroom: probably just careless, but it is important to have coworkers keep an eye out for innocent errors and help correct them. Maybe someone really is trying to steal data: coworkers need to question that person why they are not following approved and document security procedures. Maybe there is a legitimate reason for putting data on removable media: couriers do exist even in the current era of high speed private networks such as SIPRNET.
Finally, by limiting the data each person has, a breach can be localized. For example, if an image analyst steals satellite imagery, odds are that person does not have access to lists of informants, even if it is classified at the same level. That lessens the impact of a leak.
The real failure with that kid that leaked to Wikileaks is the human factor: nobody paid attention, asking him why he was not following procedures. Someone gave him access to far more data than he needed to do his job. Forget the USB drive restrictions, the DOD needs to crack down on basic security training and protocol.
Hmph (Score:4, Interesting)
But yeah, banning removable media is also good...