Feeds

Gummint security is utterly hopeless

Auditor strolls through West Oz networks

Internet Security Threat Report 2014

In the kind of report that really spoils your day, Western Australia’s Auditor-General has presented the findings of a study into that state’s government network security. The finding? Fourteen out of the 15 agencies subjected to “hostile scans” of their networks failed to notice anything amiss.

The Auditor-General also went further, penetration-testing three agency networks using known vulnerabilities. All three failed to detect the intrusion, the report says.

And when the agency left USB keys lying around in department offices, curiousity beat caution most of the time. “Eight agencies plugged in and activated [the] USBs,” the report said, which “sent information back to us via the Internet”.

The report also questions the value of consultants’ penetration testing. Nearly all agencies had conducted recent penetration tests, with some scheduling repeat tests four times a year, yet the Auditor-General’s office was able to use known vulnerabilities to attack or penetrate their networks.

In a curious snippet, the report also highlights the value of price-benchmarking for external services: some agencies could get their useless pen-tests for as little as A$9,000, while for others, the price tag was A$75,000.

The Auditor-General, Colin Murphy, said: “The failure of most agencies to detect our attacks was a particular concern given that the tools and methods we used in our tests were not sophisticated.”

The report also identified inadequate risk assessment in agencies. As a result, 12 out of the 15 agencies had not recognized threats either from the Internet or from social engineering; nine agencies had conducted no risk assessment; and seven agencies had neither a response plan nor “procedures for managing cyber threats”.

The penetration tests were conducted by researchers from Edith Cowan University, who were not briefed on the networks they were attacking before-hand. In the two-stage pen-tests, an initial scan identified vulnerabilities, and only those vulnerabilities revealed by the scan could be used to launch an attack.

In one case, the report notes, the test included a brute-force attack on a Web server that generated several million attempts to gain access, and degraded the server’s performance – without being noticed by the server’s owner.

“All of the agency Web servers allowed technical information to be collected, and poorly configured firewalls and IDPs failed to prevent this information being returned to the source of our scan,” the report notes. “This information included operating system and version, the type of firewall in use, and what software was running.”

Meanwhile, in the three agencies for which the testers were given permission to launch a full intrusion, attackers were able to obtain administrative usernames and passwords and copy files.

The full report is available here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Same old iPad? NO. The new 'soft SIMs' are BIG NEWS
AppleSIM 'ware to allow quick switch of carriers
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Brits: Google, can you scrape 60k pages from web, pleeease
Hey, c'mon Choc Factory, it's our 'right to be forgotten'
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
FCC, Google cast eye over millimetre wireless
The smaller the wave, the bigger 5G's chances of success
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.