In the kind of report that really spoils your day, Western Australia’s Auditor-General has presented the findings of a study into that state’s government network security. The finding? Fourteen out of the 15 agencies subjected to “hostile scans” of their networks failed to notice anything amiss. The Auditor-General also went …
In a weird way
It makes me proud to be a Western Australian. For the AG to actually do meaningful testing and then outline the flaws for all to see means there are still some reasonably courageous public servants left - who'd have thought.
That said, having spent some years in gov IT in other states, they're usually happier to just get a consultancy firm, the bigger the better, to just rubber stamp a report that absolves them from any blame.
Also, I wonder how many businesses would do much better... ?
Amen to that.
I'd love the same thing to happen here in Queensland, for other states, and also for the Oz Federal Government. The results may be embarrassing, but at least there would be results that can be acted on to address the underlying problems. It's certainly not "8 million NHS records on stolen laptop" level of snafu - the sort of article I was expecting here.
There's one moral I draw from the article. If you're going to get penetration testing done, get your local uni IT Masters/PhD students to do the work. They're cheaper than the "professional" consultants, and they're not going to go easy on government to ensure repeat business. In fact, their academic rep hinges on them doing a good, thorough job.
Good work on behalf of the AG to conduct these benchmarking tests!
Back in 2003 when i was working for a local government, we had a big budget to secure our network.
Implemented stringent password changing schedules for users, disabled USB ports, Allowed a locked down but still fairly free to use group policy, implemented firewalls, vlans, monthly server password changes, IPS/IDS systems, several AVs, on site email spam filtering, anti phishing devices, you name it.
Only once did we ever get hacked, someone uploaded BF2 for us onto our web server :-)
A friend's son worked on this series of penetration tests (he hinted at doing someting interesting a few months ago, but only fessed up now. Good lad). The "Cyber Security" (yeuch) course he's on certainly seems to throw some interesting tasks at them.