Question on internet security.

We hear tales of the Pentagon being hacked by Autistic 15 year olds and various other tales of institutional technical woe, but it occurs to me there may be a very simple solution to this and one which poses me some questions.

Why not just have any sensitive information stored on computers that aren't connected to the web?

Seriously, I can understand law enforcement needing to check stuff from different locations, but that could still be done by documents requested being transferred manually.

I don't understand.

reply to post by jokei


You have a point.... but i'll assume its because its much quicker over the net!

As for security... take a look at this :

The internet security experts M86, who uncovered the scam, estimate that at least £675,000 has been illegally transferred from the UK in the last month - and that the attacks are still continuing. All the victims were customers with the same unnamed online bank, the company said. Last night online banking customers were urged to make sure their anti-virus software was up to date - and to check for any missing sums from their accounts.


www.dailymail.co.uk...

Read the full story at above link!

reply to post by TruthxIsxInxThexMist


Cool, thanks for that - I was specifically thinking of organisations like the CIA, FBI, Pentagon, MI6, etc, etc, etc.

You would have thought that such organisations would have been part of a government internet that was not connected to the main internet.

Seems daft not to do that for sensitive stuff.

reply to post by jokei


The methods used by the more well known hackers into the pentagon were very basic.

The only explanation for these breeches is an ineffective security policy.

I'd hope that the most sensitive information was stored on computers that arent connected to the net but it doesnt look promising. They obviously didnt employ hackers or even automated tools to test their security.

[edit on 11/8/2010 by LightFantastic]

reply to post by jokei
Sensitive information above FOUO are on the SIPRNet, not the internet (NIPRNet).

I wouldn't take much stock in tales of the Pentagon being hacked. Even if breached, I wouldn't worry about some civil servant's Farmville being interrupted.

Originally posted by jokei
Why not just have any sensitive information stored on computers that aren't connected to the web?

I read this years ago on a computer security analysts website. I think it was after some hacker stole some source code from a microsoft PC connected to the internet. The security analyst commented that the microsoft computers with such sensitive information shouldn't even be connected to the internet. Even Wikipedia says that:

en.wikipedia.org...

The most secure computers are those not connected to the Internet and shielded from any interference.

Also, what do you make of this comment about DOD exposure:

Information Security: Computer Attacks at Department of Defense Pose Increasing Risks

while the DOD information available on the Internet is unclassified, it is sensitive and must be restricted

That sounds like the DOD doesn't put classified material on computers connected to the internet? Or am I misinterpreting that?

[edit on 12-8-2010 by Arbitrageur]

Originally posted by Arbitrageur

That sounds like the DOD doesn't put classified material on computers connected to the internet? Or am I misinterpreting that?

Originally posted by Zaxxon

Sensitive information above FOUO are on the SIPRNet, not the internet (NIPRNet).

Originally posted by Zaxxon
Originally posted by Zaxxon

Sensitive information above FOUO are on the SIPRNet, not the internet (NIPRNet).

I'm not sure if that's true since FOUO isn't really a classification?

www.wright.edu...

For Official Use Only (FOUO) is a document designation, not a classification. This designation is used by Department of Defense and a number of other federal agencies to identify information or material which, although unclassified, may not be appropriate for public release.

I was referring to classified documents.

[edit on 12-8-2010 by Arbitrageur]

reply to post by jokei


I have often pondered this myself.
I have been afraid to ask as i am not known for technology competence.In case there was a simplistic explaination that even the technical novice could smugly educate me on I have remained silent.
Thanks for expressing my thoughts in post form!

Seems so....... obvious.

Technically, they use they're own lines, and frequencies for a majority of communications.

What some said happened, the terminals hacked got connected mistakenly to the incorrect data-points, and caused the breakdown.

They develop their own technologies to prevent the 'enemy' from disclosing whereabouts of secret locations, and troops and what not; however, occassionaly, a simpleton can do what the Kremlin never dreamed of during the height of info tech gathering, the cold war.

I think I read that the big Wikileaks thing was some guy using CD+RW's to copy data to music CDs... so presumably those computers wern't connected to the internet...

Now, why did they have CD+RW drives?

Originally posted by Arbitrageur

Originally posted by Zaxxon
Originally posted by Zaxxon

Sensitive information above FOUO are on the SIPRNet, not the internet (NIPRNet).

I'm not sure if that's true since FOUO isn't really a classification?

www.wright.edu...

For Official Use Only (FOUO) is a document designation, not a classification. This designation is used by Department of Defense and a number of other federal agencies to identify information or material which, although unclassified, may not be appropriate for public release.

I was referring to classified documents.

[edit on 12-8-2010 by Arbitrageur]

I said "above FOUO" meaning "Secret". FOUO is unclassified material, hence the reason it isn't on the SIPRNet specifically. Get it now?

Originally posted by Ian McLean
I think I read that the big Wikileaks thing was some guy using CD+RW's to copy data to music CDs... so presumably those computers wern't connected to the internet...

Now, why did they have CD+RW drives?

Burning CD's is common place from the SIPRNet. The media itself is supposed to be labeled with it correct classification. How do you think classified equipment with classified data get updated? You can't just expect everything to have an ethernet card.

The fact is that there is a lot of security, but when people that are entrusted to use the system purposely circumvent procedure, then that is when you have a problem. Its unfortunate and can carry a heavy prison sentence.