Pity the government entities that have to deal with information security.  If they get it right, no thanks will be forthcoming.  If they get it wrong, they live in fear of mortifying headlines.  What are their shrieking eels?

Government has special challenges pursuing modern information security goals.

• Confidentiality – access to information is limited to the right people.  Government doesn’t always have the latest and greatest technology, which can lead to system administrators having access to everything.
• Integrity – information is accurate.  This is tough.  Without the profit motive business has to force correction there’s only indirect feedback from citizens and self-starting conscientiousness of some government employees.
• Availability – information can be accessed reliably.  Frankly, I’m not sure why government does as well as it does on this count.  Perhaps it’s a combination of dedicated civil servants and more public visibility combined with the enabling platform of the web.

There are some across the board threats against the information security goals.
1.  Dysfunctional approval process

• Two bad things can occur.  There can be no oversight, producing insecure systems or there can be over the top oversight, which often produces no systems at all.
• ​For classified information, stringent requirements are supposed to be apply to new systems.  That sounds good, but in practice, systems are secured more by generating paper than by testing.  Industry, when it cares, cares about real world tests.
• Never done it before x 100,000.  Because shared solutions and shared standards within the government are rare, most projects have to be figured out individually, with little benefit of reuse or lessons learned.

2. Wrong Priorities

• The primary challenge in getting a new system approved is fear.  Since security folks get beaten up for failures and ignored for successes, some decide the safest approach is “no”.  This produces huge time delays and needless expense to deal with a “jump”, “how high”, “higher” cycle that ends by either wearing out the requester, the approver, or by political pressure.
• Myopic focus is on incoming email and network based threats, perhaps because the tools are fairly mature, neglecting insider threats, where big name failures have occurred and neglecting the vulnerability of data.​

3. Bad technology approaches

• Buzzwords vs. technology.  Multi-tier, Virtualized, Object Oriented, Cloud.  All of these are valuable technologies  or approaches that every government organization should care about.  Unfortunately these concepts often get treated as buzzwords, producing nothing but incomplete or unused systems.
• Kitchen Sink.  Seemingly more often than not requirements for security products consist of a compilation of the different capabilities from competing vendors.  Rather than buy the most useful option, the purchaser tries to get an all-things-to-all-men solution.  Unsurprisingly those systems either do all things poorly, or worse yet, only meet the requirements by creative interpretations.
• Let’s invent the Internet!  Closely related to the buzzword problem, some organizations get so enthused about a commercial technology that they decide to invent their own version, competing with man years of testing, development, and feedback.  Such only-a-mother-could-love solutions don’t live long.

What’s the future outlook?  Not bad, given that improving technology will eventually sweep everyone forward.

There are good reasons to dislike the push to move from perpetually licensed software to subscription software:

Does the title seem like a typo, randomly generated, a joke?

​No, it’s deliberate, thought out, and not a joke.  Run with me on this.

A friend read a story claiming the U.S. nuclear system still used archaic 8 inch floppy disks.  He didn’t want to get suckered into believing an urban legend and asked, “Can we actually take an article like this seriously?”

Unfortunately, it’s correct.  Sounds like an urban legend, doesn’t it?  CNN and NPR vouch for its truth.  Our nuclear weapons system uses 8″ floppy disks— a technology that had almost vanished before I started my career but that could easily still be in use after I retire.

This is normal for government.

• The Space Shuttle program used 386 computers to run the cockpit.
• The Secret Service uses a failing 1980’s era mainframe.
• U.S. Navy ship radar systems use 1970’s DEC PDPs.

OK, this is normal (and amusing), but is it bad?  Yes, because this is very old hardware, the parts are often only available on eBay, and to try keep these systems at high reliability we have to spend a lot of money and time.

There are many reasons why the government spends so much to get so little.

• • Single year budgets provide an agency little ability to save for big projects.
  • “Use it or lose it” government budgeting punishes severely any attempt to save.
  • The government is famous for changing requirements so many times that they burn up the budget and wind up with nothing useful.
  • There is an excellent level of testing done with critical systems, such that no one is willing to move to a new system.
  • The government isn’t short on money, it’s short on the right color of money.  In other words, maintenance funds can only be spent on maintenance, never on buying new, better, cheaper, more cost effective stuff.  While a business would usually add up the high cost of maintaining, training, & using archaic hardware then throw the money into replacing it, the government CAN’T.
  • The best way to get promoted in government is to squeak by, hiding problems, claiming success, and have any disasters occur on the next guy’s watch.  I have friends in government and they do a harder, better thing, by insisting on real progress.  Unfortunately many people succumb to temptation and go the easy way.

Oddly, the archaic hardware helps with one kind of security problem–fewer hackers are working on finding security problems with systems their grandmothers used.  That’s not the only kind of security though, and an increasing likelihood of total system failure is a huge risk to security.

We’ve only just begun, really, so come back for more problems and some choices.