backtop


Print E-mail del.icio.us 14 comment(s) - last by WoWCow.. on Jul 29 at 11:24 AM

We can only hope San Francisco has learned something from this entire computer network fiasco

Now that the city of San Francisco has full access to its FiberWAN network after a rather tumultuous journey that gained national attention, city administrators must learn from their mistakes to ensure this type of issue never happens again.

Terry Childs, 43, former San Francisco Department of Technology employee, remains in a jail cell, accused of locking city employees out of the San Francisco FiberWAN network.   Childs pleaded not guilty in court, and remains jailed on an unusually high $5 million bail.

After allegedly tampering with the computer network and giving himself exclusive access, no one was able to gain access without the passwords only Childs knew.  After restricting access for everyone but himself, he was also able to give himself administrative privileges to sections of the network in which he was not authorized to access.

I am not going to sit here and try to condone Childs for what he has done, because it's obviously foolish and illegal, but why was the city of San Francisco so unprepared for such an event?   

Bay Area security analyst Martin McKeay, along with multiple other analysts agree that it seems foolish for the city to allow a couple of people to control the entire network.  Along with Childs, a group of six other network administrators were said to have complete access to the S.F. FiberWAN network.    

The city also failed to keep updated backups of the network, which could have been used to help restore the network and passwords.

Childs eventually came to his senses and called Mayor Gavin Newsom's office, inviting the mayor to come and personally pick up the passwords necessary for the city to regain control of its network.  He reportedly didn't turn over the passwords earlier because "none of the persons who requested the password information were qualified to have it," Childs' attorney told the city.

The city is building its case against Childs, but may have opened itself for further punishment from people who are up to no good.  Around 150 usernames and passwords for accounts on the FiberWAN network were entered into "Exhibit A" in the court case against Childs - placing that many usernames and passwords into the public domain has given security experts yet another headache.

Prosecutors are trying to paint a picture of paranoia and instability, but Childs' friends and several former colleagues have taken to the local media to try and portray him as a self-made professional who took his job seriously.

Childs was previously arrested when he was 17 years old, convicted as an adult on charges of aggravated robbery after committing a robbery in Wichita armed with a knife.  He was sentenced to four years in prison.

Is he a talented computer engineer who simply snapped?  Is he a cyber terrorist who knowingly and willingly tried to make the city suffer?

As prosecutors continue to build their case against Childs, and he remains locked up in jail, expect the latest San Francisco drama to continue.



Comments     Threshold


This article is over a month old, voting and posting comments is disabled

Childs is being made into a scapegoat
By maxmaclaren on 7/28/2008 10:41:26 AM , Rating: 4
If child's managers did not know enough about managing an IT department to institute a policy of having mandatory configuration backups and a policy of who can share passwords with who, they obviously were not qualified to be given network admin privileges. Such a policy would have made this a clear cut case instead of a controversy, is in place in most large scale IT departments that are not just a bunch of friends of elected officials riding "cushy government jobs" and not doing them. Without such a policy, it is the security admin's duty to decide who is qualified to hold passwords. This is an embarrassment to the city, but they are placing the blame on the party responsible for fixing the situation, rather than the many who were letting it slide.




By Master Kenobi (blog) on 7/28/2008 1:09:10 PM , Rating: 1
No kidding. This is only possible due to the government factor. I find that government IT is laughable at best. All the real gigs are outsourced to private firms to get it done right, with the right protocols and policies in place. The city decided to do this on the cheap, and kept it all in house, and this is the result.


By FITCamaro on 7/28/2008 1:10:42 PM , Rating: 4
I think San Francisco has bigger issues to worry about rather than their lack of a proper IT policy. For instance the fact that their government is encouraging city employees to violate federal law and have been for years. Personally I think they should all be brought up on federal charges.

Especially after this latest triple murder by an illegal immigrant with a known criminal past.


RE: Childs is being made into a scapegoat
By KFZ on 7/28/2008 2:07:16 PM , Rating: 2
This is an embarrassment to the city, but they are placing the blame on the party responsible for fixing the situation , rather than the many who were letting it slide.

See: FEMA


RE: Childs is being made into a scapegoat
By Master Kenobi (blog) on 7/28/2008 3:50:39 PM , Rating: 3
Yea, FEMA was the scapegoat of Katrina, even though they did exactly what they were designed to do. It just "wasn't enough" for New Orleans and thus FEMA got blamed for it.


By FITCamaro on 7/29/2008 8:14:54 AM , Rating: 2
Love it how you didn't hear about people waiting for days on rooftops waiting for the government to save them in the mid-West with the floods they had. And you don't hear about them asking for tons of free sh*t either because of their suffering.


By WoWCow on 7/29/2008 11:24:12 AM , Rating: 2
Interestingly enough, there is more to the story that was written up just 10 days ago.

http://www.infoworld.com/article/08/07/18/30FE-sf-...

Apparently, he was the only qualified person in the department and the system administrator of the network (which he also built and designed) with little assistance from others.

More importantly, what Child's intent was is still unknown and how the prosecution will build its case is debatable.

The key thing to know here is that the network still works, just that it is locked. Nothing has been reported missing or damaged.

But yes, it is becoming painfully obvious that management is at fault; and why the bail is set at 5 million is beyond my thinking.


Get it straight.
By aerospaced on 7/28/2008 11:37:34 AM , Rating: 1
"After allegedly tampering with the computer network and giving himself exclusive access, no one was able to gain access without the passwords only Childs knew. After restricting access for everyone but himself, he was also able to give himself administrative privileges to sections of the network in which he was not authorized to access."

This whole paragraph is wrong. He built the entire network and set up the initial passwords. He already had administrative privileges, he never superseded the level that he already had.
Just save yourself from embarrassment and link to the S.F. Chronicle.




RE: Get it straight.
By Grast on 7/28/2008 1:50:43 PM , Rating: 2
Do we know what vendor/techonology this system uses? Is it Cisco, Nortel, etc....

It just seems stupid that no one in the entire IT department know how to perform password recovery on the devices. It also seems stupid that if a central RAID type authentication system was in use. The vendor did not have a proceedure to recover lost passwords.

I have worked in the IT department for a city and county agencies. They tended to breed incompetence. That is the reason I left.

Later..


RE: Get it straight.
By Hawkido on 7/28/2008 2:51:56 PM , Rating: 2
From the accusatory tone of the article it sounds as if the writer of this article used the prosecution's statement as their source. Since the city is blatelently neglegent\stupid, I wouldn't expect the prosecutor's statment to be less so. The source of this material neglects to point out relevent material, such as did the sysop guy flub a router programming and loose his settings? (I know it sounds stupid, but so does accidentially deleting the server OU from active directory, and I have seen that happen) I guess my question is: Was the guy just careless and perhaps negligent in proper IT procedures, or was he following (to the letter the SF IT procedures which were flawed) The statement that he was unwilling to give out the Access passwords sounds like a guy who follows the letter of the law, even though an emergency situation dictated bending the rules to expedite recovery. There are 3 ways to read this story...

1.
Either this is a guy who snapped and locked everyone out of the fibernet, so he could run the SF CS:S server from hell.

or

2.
This is a putz who followed bunk policy and either did not see the flaws in the policy due to inexperience or stupidity, or he was just too lazy or complacent to harrass managment to get them corrected.

and finally

3.
He knew the policies he had implemented were bunk, tried to get them corrected or changed and managment ignored him, so he staged the disaster to point out the problems with the procedures, things got out of hand, and managment saw red, because now it is either they are guilty for failing to implement and ensure that proper policy was created and followed, or they now have to prosecute this guy and hope that noone actually looks at the policy until they can correct it after the stink fades.


RE: Get it straight.
By Grast on 7/29/2008 11:23:13 AM , Rating: 2
Hawk,

I am going for option 3. I think this guy is someone who took pride in his work. He had incompetent co-workers and managers. Instead of just covering his ass, he want to make an issue in order to get some attention. It went horrible wrong and now he is sitting in jail.

Later...


a serious WTF???
By kattanna on 7/28/2008 1:46:02 PM , Rating: 3
quote:
The city is building its case against Childs, but may have opened itself for further punishment from people who are up to no good. Around 150 usernames and passwords for accounts on the FiberWAN network were entered into "Exhibit A" in the court case against Childs - placing that many usernames and passwords into the public domain has given security experts yet another headache .


seriously??? WTF!!

so to prosecute this case they now publish other peoples usernames/passwords?




RE: a serious WTF???
By Master Kenobi (blog) on 7/28/2008 3:52:58 PM , Rating: 2
It's not uncommon to seal evidence so that only eyes in the courtroom can see it, I would expect them to do the same here. Still that is a dozen or so people who will have access to the usernames and passwords. Not a good thing regardless.


RE: a serious WTF???
By lucre on 7/29/2008 5:54:02 AM , Rating: 2
well i assume they are wise enough to end use of those usernames/passwords...
i hope...


"Paying an extra $500 for a computer in this environment -- same piece of hardware -- paying $500 more to get a logo on it? I think that's a more challenging proposition for the average person than it used to be." -- Steve Ballmer

















botimage
Copyright 2009 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki