Can DHS Even Handle Its Own Cyber Security?

Legislation currently being considered by Congress would give the Department of Homeland Security a huge role in overseeing some private-sector IT security. Before giving DHS authority over anyone else you have to wonder how well it can do its own security. In at least one case the answer is, “Not at all.”

The understandably anonymous Guy In A Computer Chair (GIACC) tells the story of one DHS website that doesn’t use encryption and displays passwords in plain text. The site is used to schedule appointments for Vendor Outreach Sessions with small businesses. It is run by a private contractor. This is just the sort of oversight DHS might be expected to do under the Cybersecurity Act of 2012.  

GIACC, being a good responsible American, tried to get the DHS to address this problem.

In January 2012, I attended a vendor outreach session organized by DHS in Washington, D.C.  During my scheduled meeting with Faye Jones, a small business specialist at DHS (see here for more), I brought screenshots like this to show her the vulnerability.  Ms. Jones fully understood my concerns for displaying contractors’ (many of whom do classified work for DHS) passwords in plain text and for their transmission to occur over the internet unencrypted.  I’ve personally never seen any site do this, whether it purported to be secure on insecure — and this is a site that is displaying the DHS logo.  

Ms. Jones understood the problem immediately. Unfortunately, the person she directed GIACC to was less than helpful, suggesting he contact the contractor directly. Nothing happened. I have verified that this problem still exists and I, too, have heard nothing back from DHS. While this is just one website, given the ongoing problems the government is having with vendors’ websites (see After first Anon hack, PR firm failed to update other .gov websites), this is clearly a weak spot that needs to be addressed.

As Guy in the Computer Chair put it so well:

Why is this a big deal, if this portal is only used for scheduling?  Three reasons:

1. People reuse passwords, and this represents an easy way to steal passwords.

2. Network security professionals often (rightly, in my view) describe network security as a chain, in which the overall network is only as secure as each link.  This website represents easy prey — an “attack vector” — for a hacker to launch a broader attack.

3. DHS already has a significant cyber security mandate and it appears that it will only be expanding.  How can the American people trust that DHS will secure civilian cyberspace when they are paying a private contractor to transmit passwords unencrypted and show them in plain text?