Slashdot Log In
White House Specifies And Mandates Secure Windows
Journal written by twitter (104583) and posted by
Zonk
on Fri Mar 23, 2007 09:51 AM
from the on-the-up-and-up dept.
from the on-the-up-and-up dept.
twitter writes "The Register is reporting on an effort to bring order to the wild world of Windows patching, at least in the US Federal Government. The White House has issued a directive to federal CIOs throughout the country, issuing a call for all new PCs to use a 'common secure configuration.' 'Registry settings and which services would be turned on or off by default [are specified and] the directive calls for suppliers (integrators and software vendors) to certify that the products they supply operate effectively using these more secure configurations. "No Vista application will be able to be sold to federal agencies if the application does not run on the secure version of Vista," explained Alan Paller, director of research at The SANS Institute.'"
Related Stories
[+]
Your Rights Online: Court Orders White House to Disclose Telecom Ties 147 comments
rgiskard01 writes "Glenn Greenwald is reporting at Salon.com on a win for the EFF, in the battle for clarity regarding the telecom surveillance scandal. A federal judge ordered the Bush administration yesterday to accede to the EFF's Freedom of Information Act request. Assuming the White House follows the court order, they would have to make public their lobbying ties to the telecoms industry. 'These disclosures will reveal ... which members of Congress McConnell and other Bush officials privately lobbied. As an argument of last resort, the administration even proposed disclosing these documents on December 31 so that -- as EFF pointed out -- the information would be available only after Congress passed the new FISA bill. The court rejected every administration claim as to why it should not have to disclose these records.'" Greenwald goes on to argue that the order should be leveled against Senators as well, to get a sense of who else is in Ma Bell's pocket.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Heh (Score:4, Insightful)
The phrase "don't put all your eggs into one basket" comes to mind...
Cheers,
Ethelred
Re:Heh (Score:4, Interesting)
If all MS baskets have holes, does it really matter?
Parent
Re:Heh (Score:4, Funny)
Parent
Re:Heh (Score:4, Funny)
Parent
Re:Heh (Score:5, Funny)
Parent
Re:Heh (Score:4, Insightful)
Parent
Re:Heh (Score:4, Insightful)
Parent
Monoculture Worries. (Score:5, Insightful)
The phrase "don't put all your eggs into one basket" comes to mind...
The net result will be identically configured computers with fewer applications, a bot maker's paradise. The comply/no-comply label give M$ more veto power over applications and that will reduce the number of applications that can be used. Everything must now be done the M$ way on Windoze, so the worst practices with the worst track record have been mandated. The identical settings are only more "secure" until someone breaks them and then they are all equally hosed.
Parent
That;'s one way to look at it. (Score:5, Insightful)
Yep. That's one way to look at it.
A different way to look at it is that a known, reduced configuration allows vulnerabilities to be patched (government-wide) at the lowest level possible with minimum code necessary.
I for one fucking HATE the 500MB "service packs" that are released. It is far easier to test frequent, minor changes than infrequent MASSIVE changes. And it looks as if the Federal Government is finally catching on to that fact.
#1. There is no security without physical security.
#2. Run only what you absolutely need.
#3. Run it with the minimum possible rights.
Parent
Re:That;'s one way to look at it. (Score:5, Funny)
You're talking about the Federal Government here, I'm not sure that is at all a relevant concern. At worst, it's a feature, not a bug.
Parent
Re: (Score:3, Insightful)
Re:Monoculture Worries. (Score:5, Funny)
That's a Mac, right?
Parent
Ultimate Control. (Score:4, Interesting)
A very Silly AC taunts:
It's the government mandating this version of Windows, not Microsoft. Reading comprehension much?
Once the settings are specified, M$ can make the system do as they please. What, do you think Uncle Sam is going to give up patch Tuesday? The whole point is to make it easier to apply patches. It won't really work, of course, because M$ and others will keep playing the same anti-competitive tricks. When an application does not work with the settings, it not Windoze is rejected.
The net result is contrary to commodity computing. The whole reason for using M$ is to gain access to cheap hardware and a universe of software. Reducing your choice in software goes a long way toward making your hardware worthless. A fancy computer that does not do the task you want it to is not doing you any good. The proposed flexibility will inevitably sink to Dell software install options and people who want to get work done with specialized programs will be forced off Windoze or suffer with second rate software on expensive hardware.
The same kind of program would not be such a disaster in the free world. First, it's easy to tell what works and upgrades are already painless. Second, if something does not work, it will be fixed quickly. Third, and most importantly, the software does not have "owners" who want to mess with other software "owners".
Parent
This is easier in the free world. (Score:3, Insightful)
But it is doing what the customer wants. They want a baseline configuration and any programs that don't work with their configuration aren't allowed.
They could have gotten that and a much wider choice of applications by choosing any Linux distribution. Free software package management works. A side benefit is real security
You're trying so hard to turn this around and make it about Microsoft but they have little to do with it. This is the federal government making up these rules.
That could be, but
Re: (Score:3, Informative)
They also have guides for OSX and Solaris.
Security (Score:5, Funny)
Re:Security (Score:5, Insightful)
Parent
Security and Liberty. (Score:4, Insightful)
Well, if there's one White House that I think might be experts on Security, it's this one.
I'm not very impressed with most of the "security" people have traded their liberty for. The failure [slashdot.org] is nowhere more apparent than the non free computing world [slashdot.org].
Parent
Re: (Score:2)
I was so happy you managed to keep your bias out of the summary, but then you had to go and ruin it, didn't you?
If I Have Learned One Thing... (Score:5, Insightful)
Yikes! (Score:4, Insightful)
One word: Monoculture.
Yes, this might be a darn sight better than what currently exists, but having all the systems have the same configuration is just ASKING for trouble. I predict that within two years, some virus or the like which would have attacked just a department or two is going to hit a huge swath across multiple departments, instead.
Unless, of course, the federal government has figured out how to configure their systems to be entirely secure. In which cse, I'd suggest they share it with Microsoft and the rest of the systems on the internet.
Re: (Score:2)
I'm looking forward to color-coded "Vista Alert Level" updates and thousands of other goodies.
Re: (Score:2)
Why do I suspect that the highest level will be blue?
Re:Yikes! (Score:4, Funny)
Parent
Re:Yikes! (Score:4, Insightful)
Parent
From TFA... (Score:5, Funny)
I just wanted to let you know all of those people who purchased "Unsecured Version" of Vista can upgrade to the "Secure Version" for a fee, when it is released (probably in late 2009-early 2010).
Sincerely,
Steve "Monkeyman" Ballmer
Quoting myself (Score:5, Insightful)
Has anyone considered if [Apple adopting Intel] is *** INTEL's *** way of diversifying, as an "off world colony of Planet Wintel"? In other words, is this a backup location in the seemingly increasingly likely implosion of the 'Win Wing" of WinTel? Nothing is "unthinkable", merely improbable.
Blustery pundits have used the phrase "national security risk" when referring to Windows. What if it were outlawed in government facilities? I have worked with LARGE corporations that 'forbade' IE on the computers. What if something unthinkable, as unthinkable as an asteroid strike is on Planet Earth, happened to Windows?
---
Don't put all yer x86's in one basket
------
And myself in 1998
The day will come when WinPlanet implodes. It happened to IBM. Hell, it happened to Apple. On that day, you will ask the reflection in your blank monitor the question, "Where do you want to go today?" [made with Mac logo]
And this is unusual why? (Score:4, Funny)
I was there a few weeks ago and they all were using what looked like Windows 98 still. I don't think 'Vista' and 'federal agency' will be in the same sentence again for many, many years.
Re: (Score:3, Interesting)
I don't know exactly what goes on in that office, but I suspect it hasn't changed radically in 10 years. They're probably running identical software, perhaps with occasional upgrades. Probably some custom application providing access to their database. Why replace all the hardware just to stay in place?
Sure, the security of 98 is a nightmare. They definitely need to keep these computers behind a firewall, and in fact preferably with absolutely no access at
Secure Vista... (Score:5, Insightful)
That said, it must be acknowledged that the federal government is actually showing some real intelligent thinking here for a change, and we should support that. "Just use whatever configuration Microsoft shipped it with" is dangerous thinking. They're looking at what services should be running, how things should be configured, etc., with a mindset of security (and not, mercifully, "ease of use"). This is a Very Good Thing.
Yeah, we can rail at "defective by design" ideas in Windows all we want, but one of the big security complaints about Microsoft OS'es is that they are NOT "Secure by default." Changing defaults doesn't get you home for security, but let's applaud a positive step, and hope Microsoft takes some note of this.
Will make problems for R&D/scientific applicat (Score:2)
If apps can run without admin accounts... (Score:3, Interesting)
Where I work, I waste half my time tweaking and proding half-assed, government-mandated, useless POS apps just for them to work without being an administrator.
It seems Windows developers will always trade end-users security to prevent permissions-issue support calls. And *ALL* of them develop and test as administrators. QA'ing with a user account is too much work.
BTW: Yes, the other half of my time is paperwork.(close to TPS reports)
Stamp out diversity! (Score:2)
Heh, thats not to say any other OS would do great as the defacto standard either. I'm no big fan of windows these days, but if linux or macOS were top dog they'd be the target too. I just have to question the wisdom of this logic: This isn't wor
I'm a bit confused here.... (Score:2)
That it has been mandated to secu
Re: (Score:3, Informative)
The government branches/organizations should have been doing this all along, that is making every effort to ensure that their computing platforms are secure, AND comparing one vendor against another.
Many if not all of the US Federal agencies HAVE been doing this all along. Look back over slashdot for the last 2 - 4 weeks, and you'll see stories that several government agencies have declared moratoriums on updating to Vista. Other agencies are certainly doing the same thing, but managing their moratoriums more quietly.
I left USGOV service several years ago, but I can attest that the VA and other big agencies began actively managing update strategies as early as Win98. When Directors of VA hospitals
Honesty (Score:5, Funny)
Look, if they just don't want to use Windows why can't they say so???
Regulated businesses already have this (Score:5, Insightful)
I have to admit, the federal regulators did not ask us to do anything that I did not agree with. The only exception was changing our default SQL server port. I think that was around the slammer virus time and that was the quick fix. Unfortunately their "quick fix" turned into months of application research trying to figure out what we were going to break by changing the SQL port. I told the auditors that a quick nmap scan would reveal the new port easily.....and future worms would have that ability built-in. They made us change it anyway.
Beyond that, they also looked at our audit trail, monitoring and alerting, and our network/firewall architecture. You pretty much had to do everything they asked or you lost your FDIC insurance.
You should be glad the feds care about bank security....after all, it is your money they are protecting.
-ted
But my application requires admin rights! (Score:2)
The government is now putting developers on notice. If your application needs something strange.....like administrative / root access for all who use the app, then guess what - you can't sell that application to the US government.
I'm actually happy to hear this. All users on our network run as a standard user. No one outside of our IT department gets administrative or root access....if their application requires it.....too bad.
-ted
Why don't they roll their own? (Score:3, Interesting)
Re:Why don't they roll their own? (Score:4, Informative)
Parent
Mandates secure windows.... (Score:4, Funny)
There are rumors that such things exist, in very special cases, but is easier to see pigs fly than to see a secure windows machine.
A word on federal security mandates (Score:3, Insightful)
The actual OMB memo (Score:3, Informative)
http://www.whitehouse.gov/omb/memoranda/fy2007/m0
The text follows:
EXECUTIVE OFFICE OF THE PRESIDENT
OFFICE OF MANAGEMENT AND BUDGET
WASHINGTON, D.C. 20503
DEPUTY DIRECTOR FOR MANAGEMENT
March 22, 2007
M-07-11 / MEMORANDUM FOR THE HEADS OF DEPARTMENTS AND AGENCIES
FROM: Clay Johnson / Deputy Director for Management
SUBJECT: Implementation of Commonly Accepted Security Configurations for Windows Operating Systems
To improve information security and reduce overall IT operating costs, agencies who have Windows XP TM deployed and plan to upgrade to the VistaTM operating system, are directed to adopt the security configurations developed by the National Institute of Standards and Technology (NIST), the Department of Defense (DoD) and the Department of Homeland Security (DHS).
The recent release of the VistaTM operating system provides a unique opportunity for agencies to deploy secure configurations for the first time when an operating system is released. Therefore, it is critical for all Federal agencies to put in place the proper governance structure with appropriate policies to ensure a very small number of secure configurations are allowed to be used.
DoD has worked with NIST and DHS to reach a consensus agreement on secure configurations of the VistaTM operating system, and to deploy standard secure desk tops for Windows XPTM. Information is more secure, overall network performance is improved, and overall operating costs are lower.
Agencies with these operating systems and/or plans to upgrade to these operating systems must adopt these standard security configurations by February 1, 2008. Agencies are requested to submit their draft implementation plans by May 1, 2007 at fisma@omb.eop.gov. With your endorsement we will work with your CIOs on this effort to improve our security for government information. If you have questions about this requirement, please contact Karen Evans, Administrator, E-Government and Information Technology at (202)395-1181 or at fisma@omb.eop.gov.
Hrm ... (Score:4, Insightful)
1) It ties the entire government into Windows - and on top of that, the most expensive and resource-consuming version thereof. Think of the thousands of PCs that would have to be upgraded for Vista? Now
2) It may prevent opensource applications from achieving any traction in the US government. Unless, of course, Microsoft is willing to give them the keys to be declared "Secure/Vista Friendly" or whatever the latest gimmick certification is. Granted, the big guns like OpenOffice and Mozilla might be able to make inroads, but smaller opensource applications might be S.O.L.
So it's nice that the issue has received consideration, but it may be a rather insidious form of consideration. And that's not a good thing.
Re: (Score:3, Informative)
From the directive, "Agencies with these operating systems and/or plans to upgrade to these operating systems must adopt these standard security configurations"
Meaning, it only applies to existing or future Windows installs. Not, "all government computers must follow this Windows' configuration" (therefore computer must run Windows).
Open Sourc
Wow, no one on here RTFA (Score:4, Interesting)
lets start with the second goddamn line of the article
"A White House directive to federal chief information officers issued this week calls for all new Windows PC acquisitions, beginning 30 June, to use a common "secure configuration"."
You'll notice that there is no mention of Macs or Linux. That's because this only affects _new windows PC acquisitions". That means it only affects the box when you have windows on it.
"Applications (such as anti-virus, email etc) loaded onto systems remain flexible but what will be specified in the registry settings and which services would be turned on or off by default."
Look here... configuration management mandated. How about that??!
"Even more importantly, the directive calls for suppliers (integrators and software vendors) to certify that the products they supply operate effectively using these more secure configurations."
OMFG, vendors actually have to put out products that work in secure configurations. holy crap!!! end of the goddamn world. heaven forbid we make them code securely and force them to make it work in something other than the Administrator account.
"The federal government scheme builds on the "comply or don't connect" program of the US Air Force. The principal targets are Windows XP and Vista client systems but the same ideas might be applied in Unix and Windows Servers environments over time."
Lookie there, it only applies to windows again. later on, it'll apply to windows Desktops! Not even servers. wtf is this call of monoculture I keep seeing.
Every consumer should be happy to see this, because a huge client (the biggest?) of computer hardware and software says "that's quite enough. If you can't work in our secure environment, you are going to lose a lot of business. Fix it already".
In the US Air Force, this has already happened (Score:3, Insightful)
Re: (Score:3, Funny)
You might need this:
printf("HA");}
Re: (Score:2)
Re: (Score:2)
I dont think forcing OS makers to include specific functions is a step in the right direction. I think that suggesting the same is a good idea, however.