Feeds

Gummint security is utterly hopeless

Auditor strolls through West Oz networks

Next gen security for virtualised datacentres

In the kind of report that really spoils your day, Western Australia’s Auditor-General has presented the findings of a study into that state’s government network security. The finding? Fourteen out of the 15 agencies subjected to “hostile scans” of their networks failed to notice anything amiss.

The Auditor-General also went further, penetration-testing three agency networks using known vulnerabilities. All three failed to detect the intrusion, the report says.

And when the agency left USB keys lying around in department offices, curiousity beat caution most of the time. “Eight agencies plugged in and activated [the] USBs,” the report said, which “sent information back to us via the Internet”.

The report also questions the value of consultants’ penetration testing. Nearly all agencies had conducted recent penetration tests, with some scheduling repeat tests four times a year, yet the Auditor-General’s office was able to use known vulnerabilities to attack or penetrate their networks.

In a curious snippet, the report also highlights the value of price-benchmarking for external services: some agencies could get their useless pen-tests for as little as A$9,000, while for others, the price tag was A$75,000.

The Auditor-General, Colin Murphy, said: “The failure of most agencies to detect our attacks was a particular concern given that the tools and methods we used in our tests were not sophisticated.”

The report also identified inadequate risk assessment in agencies. As a result, 12 out of the 15 agencies had not recognized threats either from the Internet or from social engineering; nine agencies had conducted no risk assessment; and seven agencies had neither a response plan nor “procedures for managing cyber threats”.

The penetration tests were conducted by researchers from Edith Cowan University, who were not briefed on the networks they were attacking before-hand. In the two-stage pen-tests, an initial scan identified vulnerabilities, and only those vulnerabilities revealed by the scan could be used to launch an attack.

In one case, the report notes, the test included a brute-force attack on a Web server that generated several million attempts to gain access, and degraded the server’s performance – without being noticed by the server’s owner.

“All of the agency Web servers allowed technical information to be collected, and poorly configured firewalls and IDPs failed to prevent this information being returned to the source of our scan,” the report notes. “This information included operating system and version, the type of firewall in use, and what software was running.”

Meanwhile, in the three agencies for which the testers were given permission to launch a full intrusion, attackers were able to obtain administrative usernames and passwords and copy files.

The full report is available here. ®

Boost IT visibility and business value

More from The Register

next story
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Canadian ISP Shaw falls over with 'routing' sickness
How sure are you of cloud computing now?
Don't call it throttling: Ericsson 'priority' tech gives users their own slice of spectrum
Actually it's a nifty trick - at least you'll pay for what you get
Three floats Jolla in Hong Kong: Says Sailfish is '3rd option'
Network throws hat into ring with Linux-powered handsets
Fifteen zero days found in hacker router comp romp
Four routers rooted in SOHOpelessly Broken challenge
New Sprint CEO says he will lower axe on staff – but prices come first
'Very disruptive' new rates to be revealed next week
PwC says US biz lagging in Internet of Things
Grass is greener in Asia, say the sensors
Ofcom sees RISE OF THE MACHINE-to-machine cell comms
Study spots 9% growth in IoT m2m mobile data connections
O2 vs Vodafone: Mobe firms grab for GCHQ, gov.uk security badge
No, the spooks love US best, say rival firms
Ancient pager tech SMS: It works, it's fab, but wow, get a load of that incoming SPAM
Networks' main issue: they don't know how it works, says expert
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.