Army Buys Macs to Beef Up Security

agent_blue writes "The Army is integrating Macs into their IT network to thwart hack attempts. The Mac platform, they argue, is more secure because there are fewer attacks against OS X than Windows-based systems. 'Military procurement has long been driven by cost and availability of additional software--two measures where Macintosh computers have typically come up short against Windows-based PCs. Then there have been subtle but important barriers: For instance, Macintosh computers have long been incompatible with a security keycard-reading system known as Common Access Cards system, or CAC, which is heavily used by the military. The Army's Apple program, created [in 2005], is working to change that.'"

but

i thought they don't allow gays in the military?!?

Re:but

Hey I'm gay you insensitive clod... wait no...!!! That joke backfired horribly!!

Re:but

There's no rule against being a Mac user in the military. You're just not allowed to tell people that you're a Mac user, and they're not allowed to ask if you're a Mac user.

Don't ask, don't tell ...

but i thought they don't allow gays in the military?!?

They expect the computer to be running MS Office on an Intel CPU. They are not allowed to ask, and you are not supposed to volunteer, whether you are doing so under Windows or Mac OS X. It is a don'

Don't ask, ...

Don't ask, don't Intel?

US Army used Macs in/since 1999 for servers

http://www.serverwatch.com/news/article.php/201361 [serverwatch.com]

i always liked the idea...

from the article: "Until the Army's Web site was hacked in late June by a 19-year old Wisconsin man, the site had been using a Microsoft Windows NT-based Web server..." :)

How many times?

How many times do I have to keep telling people that security is more about the skill of the IT staff than it is about the operating system it runs on?

Yes, Windows has vulnerabilities. Windows sucks as far as security goes. That goes for Vista, too. But waving around an OS like it was some magic bullet that's going to somehow fix your security problems is, well, insanity.

Re:How many times?

How many times do I have to keep telling people that security is more about the skill of the IT staff than it is about the operating system it runs on?

"More about" is not the same as "entirely about." Sure, a good IT staff with a bad system will be more secure than a bad IT staff with a good system. But a good IT staff with a good system will be more secure than either. And Unix-based systems, including OS X, are demonstrably better in terms of security than Windows-based systems are.

Do you think the Army should go back to using bolt-action rifles? It's true that a good marksman with an M1903 is more useful on the battlefield than a bad marksman with an M16, but ...

It's about avoiding a computing monoculture

But waving around an OS like it was some magic bullet that's going to somehow fix your security problems is, well, insanity.

If you read the article instead of the headline, you'll see that the Army is making the attack target more diversified, so that a single attack will not bring down all computers. What's wrong with that tactic?

Re:It's about avoiding a computing monoculture

As a long time opponent of homogeneous computing/infrastructure I think this is a great move. Any security conscious shop makes certain to balance the management benefits along with the heterogeneous benefits.

Sure, it's cute and cheap to run everything on any one platform, but like they always say "spread out or one grenade will get you all".

Serial, not parallel

The simple thing that's wrong with that tactic is that instead of having to provide security for one OS, they now have to provide security for both.

When protecting data, think "serial" and not "parallel". You won't get extra security by diversifying your OSs because hackers don't need to hack ALL of them, but just ONE of them, to compromise data. This is not a case of "redundant systems", but rather a case of "the weakest link". The more OSs are supported the more chances that AN OS will get hacked (as opposed to ALL OSs), but when it comes to protecting data, hacking that ONE OS is all it takes. Hackers are certainly more agile than the government, and the government should try to minimize its profile, together with hacking avenues, rather than build redundant systems where redundancy is not the solution for the problem at hand.

In other cases when the issue IS parallel, such as protecting a mission-critical system (think Space Shuttle), then yes, multiple OS's increase the chance that any one will survive. But this doesn't apply to data security. They should stick to one OS as well as one of everything else, preferably as secure as possible (NetBSD, some Linux distros, etc). But even JUST Windows is more secure than Windows and OTHER stuff together, because you keep all the risks of Windows while adding the extra (even if relatively smaller) risk of the other system on top of the original risk.

one point of failure

so whats wrong with supporting more than one OS? Would you prefer one point of failure? A good sys admin can support multiple platforms. The only people I ever hear complain about this are Windows people who can't support anything else. Linux admins can ALWAYS support Windows and Mac platforms so why is it so hard for the vast majority of Windows admins to support the other platforms? Hmmm...? Do you just prefer having a single point of failure?

Re:

One side would say that there are benefits to supporting only one system. One can get expertise in supporting, maintaining, and securing the system. There are cost savings in not having to maintain separate inventories. There are cost saving in being abl

Re:

You might be a good admin but your comprehension kind of blows. His ENTIRE POINT was that finding 'non sucky' admins (as you put it) is very difficult. People who are skilled to an enterprise level in multiple operating systems are extremely rare. (My prev

Re:Serial, not parallel

The simple thing that's wrong with that tactic is that instead of having to provide security for one OS, they now have to provide security for both.

And your point is? That extra security costs money?

When protecting data, think "serial" and not "parallel". You won't get extra security by diversifying your OSs because hackers don't need to hack ALL of them, but just ONE of them, to compromise data.

In one instance you may be correct, but in other instances, you are not. Whether or not data are compromised depends upon how that data are partitioned and where the data reside.

You do get extra security by diversification, because you have the ability to continue to function while one OS's computers are struggling with a malware attack.

Note that the article is not saying that diversification of OS will make an installation 100% secure, just that it will improve the likelihood of continued operation albeit at reduced levels.

Re:

Tell that to the OpenVMS guy in the food line down the street. Did I say that out loud?

Magic Bullets Kill... sometimes not who you think

... The Mac platform, they argue, is more secure because there are fewer attacks against OSX than Windows-based systems. ...

Not any more.

If the army is using it for that reason then you know the Chinese, Russians, and any other tech savvy nation will now point their hackers at Macs.

Re:Magic Bullets Kill... sometimes not who you thi

Well, isn't that part of the idea? If you can divide your opponent's attention in half with only a small amount of your own resources, that seems like it would be a worthwhile tactic.

Re:How many times?

Psh, yeah. That 8% of Macs -- only a few tens of millions? All with no anti-virus software whatsoever? And the fame/infamy of being the first to write a self-replicating virus for Macs?

Yeah. Totally not worth it.

Stop perpetuating simple-minded myths.

Re:How many times?

If the military starts using them, it's only a matter of time until attackers hone their Mac skills and then the Army is right back to where it started, possibly even worse off because they evidently wouldn't see it coming.

Well, if they mix the OS-vendors like they (finally) mix aircraft-engine suppliers [aviation.com], it will be harder for an adversary to knock out all computers with the same (cyber-)attack. If a flow is found and/or exploited in some of the systems, they can be shut down and the same tasks performed on systems of (an)other type(s).

This argument — strength of diversity — floated here before...

Re:

Once you can lose [windows or *nix or Mac] systems, for all intents & purposes, the IT infrastructure in question is near useless.

This presumes, the systems are always used in sequence (links in a chain), rather than in parallel (say, like a fishing

Re:How many times?

Let's put this in a language we can all understand.

Money.

According to one of these links, a press release, on Google [google.com], ID thieving alone "costs more than $56 billion, or $6383 per victim, annually". That's US, obviously.

Social hacks (phishing) can be done to anyone clever enough to hold a conversation but stupid enough not to be even slightly cynical when strangers start asking certain questions. But many phishing techniques ask the hapless victim to download an attachment, or get access to the victim's computer using online foot-in-the-door tricks like eCards that are more than they appear [hexus.net].

What's the level of Mac penetration? 5%? 8%? Let's say it's the lowest number. Five percent of $56 billion is still $2.8 billion a year. If anyone manages to write malware that could spread in the way PC malware can multiply, especially with the average Mac user's attitude ("virus protection? Why should I save a PC user's arse when I send them Word documents? My iBook's fine..."), imagine the draw for crime syndicates. A guaranteed first shot at nearly three billion EVERY YEAR.

And yet it hasn't happened. An illegal industry that pays better than drugs, without the inherent violence on the streets, and Mac users steadfastly refuse to get fleeced.

Which means either the criminals either aren't really that hungry for this potential sector, or there's an easier way to get the money.

Just having the standard feature in a Mac that asks for your password for any new program being installed means you're put on guard. "Hey, I went to see this funny ReindeerYourself card and it's asking for my passowrd? No way..." and the keylogger software remains off your computer. It wouldn't matter if Mac penetration was 12%, 15%. If it's so much easier to hack the PC system for financial gain, it's not financially viable for anyone to write the keylogger software and then wait for enough Mac owners to be stupid enough to install the software to recopu their costs. Just let Windows users visit the page you mass-maile and enough will click the link with high speed connections. Ker-ching.

So this is finally put-up-or-shut-up for the Windows fanboyz. If the US Army puts its weight behind it, this shifts the whole landscape for writing malware. You see: before this announcement, any jihadist that wanted death to America would just do what all the other fanboys did: learn Visual Basic and send away. But now? Now they'll need to try and sneak through the Mac architecture. And unlike the Russian Mafia, cost isn't an issue. The 'enemy' will throw everything they have to bring the Army system down. Cost isn't an issue if money is not what you're after.

So if it turns out that a world full of hate-filled terrorists that care nowt for money can't hack their way in, what then for the Apple bashers?

Re:How many times?

The worst part about this all is that there are usually just about as many vulnerabilities affecting Apple's platform as there are vulnerabilities affecting Microsoft's platform for any period of time. I invite you to review a few pages and look at the volume by date range.

On the other hand, when you compare the number of Macs that have actually fallen victim to any vulnerabilities with the number of PCs, then the Macs are outnumbered more than one to a million.

One small step

One small step for Mac one giant leap for Mac kind.

CAC on OS X has been working for a while...

http://www.google.com/search?client=safari&rls=en&q=cac+on+mac&ie=UTF-8&oe=UTF-8 [google.com]

Support is built into Safari, and it is possible to set it up to log into a Windows domain, I believe.

According to Hollywood

All computers used in the military facilities in the Transformers movie by the teams trying to break the Decepticon's code where Apples. It should also be pointed out that the computer that defeated the martins in Independence Day where macs.

Life imitating "art"?

I'm stumped.

How will they know if the user prefers a Mac or PC with their "Don't ask, don't tell" policy?

Re:

Very good. I about sprayed salad all over my monitor when I read that.

No surprise

With a runaway defense budget like ours, I'd say the mac is a perfect fit!

Computer security specialists

The clear majority of the really high end computer security people I know are driving Macs. On the military side Army and Marines seem to be tinkering more with Linux. The Marines less so because of NMCI, but there was a demo of battlefield information system that was Linux based. Navy and Marines have pretty much locked themselves into Windows desktops managed by EDS on the administrative side. A move I believe will go down as one of the great defeats in Naval history, with casualties of 250 million American taxpayers.

Don't know about the Air Force but the few AF people I've met at conferences seemed pretty on the ball and struck me as Linux curious if not outright supporters.

I've seen this before...

HThe Army's push to use Macs to help protect its computing corps got its start in August 2005, when General Steve Boutelle, the Army's chief information officer, gave a speech calling for more diversity in the Army's computer vendors. He argued the approach would both increase competition among military contractors and strengthen its IT defenses.

"Sir, I have the DOJ on line 2."
"Tell them to get Bill Gates in here."
"Yes sir."
(door opens an hour later)
"Bill Gates, you told us Windows Vista would be more secure!"
"It IS more secure, over five million...(BLAM)"

Military Intelligence

Mac: Hi I'm a Mac
PC: and I'm a PC
Military Intelligence: And I'm no longer an oxymoron

Bootcamp

Brings a whole new meaning to BootCamp, doesn't it?

Hell is a bit colder today

About five years ago I was doing a training session/presentation for IT staff at an Army base where I was told that the Army would never use anything other than Windows. I made the mistake of referring to Linux, Mac OSX and open source software during the presentation which caused some folks in the room to get upset with me. I remember a comment about hell freezing over first. I guess hell is a bit colder today.

Bah, MI-5's been doing this for years

http://www.imdb.com/title/tt0160904/ [imdb.com]

But on the more serious note:

Why not Linux?

A: http://www.openbsd.org/ [openbsd.org]

Which at one time was a DARPA funded project.

Re:

Why, yes it does! [terrasoftsolutions.com]

Re:why not liunx it is free and runs on any x86 ha

Maybe because no one would bribe anyone to buy linux, the profit margin is thin.

Re:why not liunx it is free and runs on any x86 ha

Probably because they already use Linux [slashdot.org]. It's hard to start using something you already use.

Re:OpenBSD???

Yes, and no.

I think they should use tools available cross-architecture for their software, and then have a multi-arch setup. For example:

30% Free/Net/Open BSD
30% Linux
25% Mac
15% Windows

This would alleviate the issues of an entire-network compromise from potentially overlooked vulnerabilities in any one system. Because you can get fairly simple general interaction for the operating systems listed (given modern desktop environments offered on Linux/BSD, Mac would be the most "different" and not terribly so even then), and applications That had cross-platform natures would be all that's used, there would be little difficulty for the end users to go between systems.

Re:OpenBSD???

Actually on a properly designed system not even the Administrator's should be able to install applications alone. And no one should be able to open every file.

Files should be locked, So while the Admin's can see them, move/copy them, they can't actually open the file itself. security should extend to more than just the file system, but to the files themselves. Of course being open to all should also be a manual changed possibility.

I wonder how long it will take for someone who makes more money than I will ever see to figure that out.

Re:OpenBSD???

Actually, given that it is military and should have very fine grained security, nobody should have the rights to install a program, not even on their own space, except administrators.

One of the biggest security problems is when security reduces usability to the point where users bypass the security for convenience, or simply because it is easier. I've even seen situations where no one had rights to install any software because of security policies, and the admins were then ordered to look the other way for security violations in general because a company still needed to get work done and make money. Good security does not reduce usability. If users don't have the ability to run the software they want to, you've greatly reduced usability and should not be surprised when users start rebooting from a flash drive or working on their home PCs with basically no security.

Re:OpenBSD???

Apple may have unix roots, but openBSD it is not. There is no comparison security-wise, openBSD wins hands down. If you need user-friendliness and usability, then that significantly changes the equation. My guess is they are looking for improved security with the happy clickiness that Macs provide.

Re:OpenBSD???

While openBSD may be more secure, remember the Army is about procedures. Leopard has been certified as Unix like AIX and Solaris. Leopard has gone through the time and expense to be certified, and it has a better UI whereas openBSD has not.

Re:OpenBSD???

Being certified a Unix doesn't mean but one thing, your organization was willing to throw a pile of money at another organization, nothing more and nothing less.

Which was implicitly his point, perhaps you missed the part...

While openBSD may be more secure, remember the Army is about procedures

Essentially declaring that perhaps one bullet point on a requirement to address this problem somewhere was 'UNIX platform'. Technical reality be damned, per the grandparent post, it could be the Army had that criteria and was therefore limited to Solaris, AIX, or OSX in terms of actively released/maintained platforms.

Of course, even restricted to these choices, Solaris might have been a better choice. OSX is the sort of vendor lock in I would hope my taxpayer dollars wouldn't go toward supporting. Windows is bad enough, but with OSX you get lock-in of hardware and software. Recalling how skiddish the US government got about Thinkpads and the like when Lenovo bought those bits, I wonder what the contingency plan would be if Apple sold off their computing bits to an offshore company. Even in and of the software platform itself, despite the Darwin base, OSX software tends to require the proprietary Quartz/Cocoa underpinnings, so supporting third party software with new hardware without Apple's blessing would be challenging. Windows is a little better in terms of hardware support, but the software portion is bad enough, though at least there is an excuse of the market situation as to why they haven't thrown it out completely.

Meanwhile, Solaris has an equally reputable backer, doesn't implement many proprietary APIs that common applications would make use of (AIX goes this far as well), has an unlocked x86 implementation (no hardware vendor ties, unlike any other officially certified UNIX), and is also under an open source license. In terms of an official UNIX with options for contingency plans, it doesn't get better than that.

*BSD, Linux, et. al. may or may not be even better choices, but this was sticking strictly to the assumed criteria of being able to officially declare it a Unix system.

BTW:

The Aqua interface is no more special or better than KDE.

Which may well be true, but wanted to emphasize the converse is not true. KDE/Gnome/Motif/Xaw/raw Xlib all have full stacks in terms of implementation available as truly open-source. If serious about security, the potential to audit your running stack as resources permit would be great. Also, goes back to the futureproofing mentioned earlier, if ultimately the organization can fork a private copy and do whatever the hell they want, they can avoid vendor lock in.

Re:

Macs have a large corporation backing them. With the partial exception of Red Hat, any given flavor of *nix doesn't.

So I guess AIX [ibm.com], HP-UX [hp.com] and Solaris [sun.com] don't have large corporations backing them.

Always best to be careful what you say about who does bac

Re:OMG Terrorists will attack Macs!

The NSA have an OS X hardening guide you may be interested in: http://www.nsa.gov/notices/notic00004.cfm?Address=/snac/os/applemac/I731-006R-2007.pdf [nsa.gov]

Beg to differ, OS X at install pretty secure

1) Out of the box, you don't have services running you can exploit.

2) On install, OS X makes you chose a username so you have to log in to use the system.

3) OS X by default is suspicious of all content coming in from the web.

OS X already starts out with a high level of security, and doesn't do anything that would lead a user to weaken that without need (say opening a port for printer sharing).

Re:

Because Linux is for European communist queers who pirate music. Macs are all-american and manly (sort of).

Seriously though, its probably to do with letting Apple join in at the endless corporate trough that is the US military, in order to expand their d

Re:Army buys BigMacs to Beef Up

Anyway, who else has a hard time imagining an army without right clicks?

Not me! How do they plan to assign orders after selecting units? It's like these people have never been on the field!

No open ports

1) No Bonjour services listen on open ports by default, even if the Bonjour handler itself may be running somewhere on the system.

2) Bonjour is ZeroConf is Open Source. And included in Darwin...

You don't have to assume anything, you can see it right there