Topic: Pentagon bans computer flash drives

[toasty0]

They allow flash drives? No wonder some think the term Military Intellegence is an oxymoron.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
WASHINGTON - The Pentagon has banned, at least temporarily, the use of external computer flash drives because of a virus threat officials detected on Defense Department networks.

While defense officials would not publicly confirm the ban, messages were sent to department employees informing them of the new restrictions. As part of the ban, the Pentagon was collecting any of the small flash drives that were purchased or provided by the department to workers, according to one message distributed to employees.

Workers are being told there is no guarantee they will ever get the devices back and it is not clear how long the ban will last.

Pentagon spokesman Bryan Whitman would provide no details on the virus Friday, but he described it as a "global virus" that has been the subject of public alerts.

"This is not solely a department problem, this is not solely a government problem," Whitman said.

The Pentagon has acknowledged that its vast computer network is scanned or probed by outsiders millions of times each day. Last year a cyber attack forced the Defense Department to take up to 1,500 computers off line.

Officials said then that a penetration of the system was detected, but the attack had no adverse impact on department operations.

However, military leaders have consistently warned of potential threats from a variety of sources including other countries — such as China — along with other self-styled cyber-vigilantes and terrorists.

The issue has also been of concern at the Department of Homeland Security. A September audit by the DHS Inspector General recommended that the agency implement greater procedures to ensure that only authorized computer flash drives or other storage devices can be connected to the network there and that an inventory of those devices be set up.

DHS agreed with the recommendations and said some of that is already being done. DHS also said more software enhancements are in the works that will provide more protection.

[Wraith 413]

  It's not only thumb drives that have been banned. Apparently the AV software, which is a Norton Corporate edition, does not properly scan external media very well.

[toasty0]

If they were using WinServer08 that would not be an issue. By default it sandboxes everything new to the network.

[Wraith 413]

 Agreed.

 IF the DoD's claims are true about malware embedded in thumbdrives, what harm and info is someone getting from the average home users computer?

[Rod ONeal]

I can't believe that the Pentagon allows people to work on their home PCs. If they need to do work out side of the office, which I question the security of that, then they should be supplied with laptops.

[NJAntman]

Well this wasn't a problem for me until the Directorate got last years "spend it or loose it money" and viola we all ended up with Belkin USB hubs on our desks. Other then my plug in Cylon Snow Man the hubs are only good for downloading from the net since we can't install programs on our desktops.

This is the info we got:

Per below, in addendum to my previous message, the restriction on flash
drives also includes ANY USB hard drives and ANY camera.

In effect, the Safety digital cameras are now useless!

___________________________________________
XXXXXXXXXXXXX
IT Specialist
CECOM, DOIM
Providing support for Directorate for Safety
Building XXXX (XXXXX-XX)
Fort Monmouth, NJ 07703
Phone: (XXX) XXX-XXX
Fax: (XXX) XXX-XXX
Email: XXXl.XXXXXXXl@us.army.mil


-----Original Message-----
From: Help-Desk, Fort Monmouth
Sent: Monday, November 17, 2008 3:38 PM
Subject: Mandatory Compliance Required
Importance: High

Date: Monday 17 November 2008

As per Army guidance, the DOIM will temporarily disable the use of memory
sticks, thumb drives, camera flash memory cards, and any other external
storage devices in all DoD NIPRNET and SIPRNET computers using Windows
Operating systems.  This applies to all assets and no exceptions will be
granted to this suspension. 

Additionally, all users are required to connect their government-furnished
laptop computers to the network on 18 - 19 November 2008 between 0800 and
1600 so that these systems can be scanned and updated with the latest
security software. 

Lastly, all general use computer systems (training rooms, conference rooms,
etc) must be powered on 18 - 19 November 2008 between 0800 and 1600 so that
they can also be scanned and updated with the latest security software. 

Please visit our DOIM IT Status Page for updates to our IT Services.
https://XXXXX.XXXXXXXXXX.army.mil/dashboard/view_it.aspx

DOIM Help Desk
Service Management Division
ATTN:  XXXX-XXX-XXX, Bldg XXXX
US Army Garrison, Fort Monmouth, NJ 07703 Phone - DSN: XXX-XXXX, COM: (XXX)
XXX-XXXX) Fax - DSN: XXX-XXXX, COM: (XXX) XXX-XXXX
Email:  mailto:XXXX-HelpDesk@conus.army.mil
gl

Well, there goes any hope of being able to install the drivers for my USB rocket launcher.

[Wraith 413]

I can't believe that the Pentagon allows people to work on their home PCs. If they need to do work out side of the office, which I question the security of that, then they should be supplied with laptops.

 Any classified material could not be taken home.

[Rod ONeal]

I can't believe that the Pentagon allows people to work on their home PCs. If they need to do work out side of the office, which I question the security of that, then they should be supplied with laptops.

 Any classified material could not be taken home.

I've worked for companies where you aren't allowed to bring any work home at all, ever, for any reason. The thinking was, "Why chance any info getting out?" There were no options, no exceptions. I always assumed that the Pentagon, CIA, etc... would operate under the same premise.

[toasty0]

One would assume that, but evidence says otherwise: http://www.homelandstupidity.us/2006/05/22/va-loses-sensitive-personal-info-for-26-million-vets/

[Wraith 413]

 That was personal data that was stolen, covered under the Privacy Act of 1974, not classified data.

[Wraith 413]

 The working on projects from home is a little off tangent of OP's post. The threat of embedded malware is what spurred this ban. Not the fact that office work is done on a home computer.

[toasty0]

The working on projects from home is a little off tangent of OP's post. The threat of embedded malware is what spurred this ban. Not the fact that office work is done on a home computer.

True, but I think it is the commonality in the lack of awareness of security considerations that link the posts.

[Just plain old Punisher]

About damn time if you ask me.

[Wraith 413]

The working on projects from home is a little off tangent of OP's post. The threat of embedded malware is what spurred this ban. Not the fact that office work is done on a home computer.

True, but I think it is the commonality in the lack of awareness of security considerations that link the posts.

 I don't disagree with your statement Toasty. Hopefully, DoD will get some better AV software that actually does it job, rather than some lowest bidder crap.

[toasty0]

A friend of mine has been contracted to instruct some folks ( DoD types) on a new thing called Mobile Armor. I don't know much about it except it sounds like a step in the right direction.

[Bonk]

As per Army guidance, the DOIM will temporarily disable the use of memory
sticks, thumb drives, camera flash memory cards, and any other external
storage devices in all DoD NIPRNET and SIPRNET computers using Windows
Operating systems.

Well, there goes any hope of being able to install the drivers for my USB rocket launcher.

I don't see any problem here if you just get some Unix, BSD or DOS drivers for your USB rocket launcher!  

QNX is the way to go.

[Panzergranate]

Banning Microsoft from the Pentigon would, perhaps, be a wiser decision.

We were using QNX software in the enmbedded PC hardware for train digital radios, when I was an Engineer at Siemens (until 3 weeks ago), due to safety issues obviously banning Windows from said units.