TechMiso

The United States Department of Defense is one of the largest consumers of Microsoft’s Windows family of operating systems. There are certainly a small number of organizations with a larger install base, but definitely not one as distributed, inter-connected and solely dependent upon Windows to complete just about every facet of work accomplished. The reliance solely on Windows, from the end-user workstation to the back-end server farm, is a huge risk which DoD has shown no desire to mitigate.

There are a staggering number of workstations required for the warfighters throughout DoD. Approximately 95% of these systems are WinTel, with only a very small number being Unix based. However, even the Unix based workstations are merely virtual Windows sessions – although the host OS is Unix, the user is performing all work within Windows!

The reliance on Windows is the single biggest weakness in the DoD information assurance strategy. Our adversaries know what we run and use that knowledge to craft specific attacks aimed directly at Windows. The Windows family of operating systems are riddled with vulnerabilities if not properly maintained – this delicate foundation has allowed attackers to compromise DoD networks at-will.

The problem, according to a second Army e-mail, was prompted by a “virus called Agent.btz.” That’s a variation of the “SillyFDC” worm, which spreads by copying itself to thumb drives and the like. When that drive or disk is plugged into a second computer, the worm replicates itself again — this time on the PC. “From there, it automatically downloads code from another location. And that code could be pretty much anything,” says Ryan Olson, director of rapid response for the iDefense computer security firm. SillyFDC has been around, in various forms, since July 2005. Worms that use a similar method of infection go back even further — to the early ’90s. “But at that time they relied on infecting floppy disks rather than USB drives,” Olson adds.

There are many strategies for mitigating this type of vulnerability. I previously spoke about defense-in-depth, whereby a layered approach to security strengthens the overall security of the network. Being reliant on a single operating system is wholly anti-defense-in-depth.

To counteract the threat to their networks, DoD needs to incorporate alternative operating systems in their approach to information assurance. It is time to start purchasing Apple workstations and installing strong workstation-based Linux distributions like Ubuntu, Red Hat, Novell and/or Suse. Integrating additional types of operating systems in use throughout DoD will complicate the types of attacks required to successfully compromise DoD networks. The Army understands the threat and has recently purchased Apple workstations as a means of mitigating these vulnerabilities.

While this change in strategy is required to assist in mitigation of many existing known threats, it is not an inexpensive solution. In addition to purchasing new hardware and software licenses, users will require training on these systems. Most DoD users, like most users, are solely familiar with Windows and have very little, if any, experience with Apple or Linux. Education is necessary and the associated costs substantial.

Does the risk associated with staying entirely Windows-based outweigh the funding required to migrate to a multiple OS strategy? According to existing DoD policy, there is absolutely no desire to mandate such a policy. DoD desires to stick with Windows and pray their high-paid system administrators tasked with protecting the network will do what is required of them.

Unfortunately, DoD is going to continue to stick its head in the ground, hoping the holy grail of resolutions is right around the corner and everyone can continue to use Windows in perfect harmony. After all, why upset the delicate balance by incorporating such a radical transformation? For the DoD, as with most of the US government, business as usual is far more essential than change for the better.