Legislation currently being considered by Congress would give the Department of Homeland Security a huge role in overseeing some private-sector IT security. Before giving DHS authority over anyone else you have to wonder how well it can do its own security. In at least one case the answer is, \u201cNot at all.\u201d\n\tThe understandably anonymous Guy In A Computer Chair (GIACC) tells the story of one DHS website that doesn\u2019t use encryption and displays passwords in plain text. The site is used to schedule appointments for Vendor Outreach Sessions with small businesses. It is run by a private contractor. This is just the sort of oversight DHS might be expected to do under the Cybersecurity Act of 2012. \u00a0\n\tGIACC, being a good responsible American, tried to get the DHS to address this problem.\n\t\n\t\tIn January 2012, I\u00a0attended a vendor outreach session organized by DHS in Washington, D.C. \u00a0During my scheduled meeting with Faye Jones, a small business specialist at DHS (see here for more), I brought screenshots like this to show her the\u00a0vulnerability. \u00a0Ms. Jones fully understood my concerns for displaying contractors\u2019 (many of whom do classified work for DHS) passwords in plain text and for their transmission to occur over the internet unencrypted. \u00a0I\u2019ve personally never seen any site do this, whether it purported to be secure on insecure \u2014 and this is a site that is displaying the DHS logo. \u00a0\n\n\tMs. Jones understood the problem immediately. Unfortunately, the person she directed GIACC to was less than helpful, suggesting he contact the contractor directly. Nothing happened. I have verified that this problem still exists and I, too, have heard nothing back from DHS. While this is just one website, given the ongoing problems the government is having with vendors\u2019 websites (see After first Anon hack, PR firm failed to update other .gov websites), this is clearly a weak spot that needs to be addressed.\n\tAs Guy in the Computer Chair put it so well:\n\t\n\t\tWhy is this a big deal, if this portal is only used for scheduling? \u00a0Three reasons:\n\n\t\n\t\t1. People reuse passwords, and this represents an easy way to steal passwords.\n\t\n\t\t2. Network security professionals often (rightly, in my view) describe network security as a chain, in which the overall network is only as secure as each link. \u00a0This website represents easy prey \u2014 an \u201cattack vector\u201d \u2014 for a hacker to launch a broader attack.\n\t\n\t\t3. DHS already has a significant cyber security mandate and it appears that it will only be expanding. \u00a0How can the American people trust that DHS will secure civilian cyberspace when they are paying a private contractor to transmit passwords unencrypted and show them in plain text?