UK's nets have gaping holes

The Government security agency, GCHQ, has told Network News that the demand for resources to protect Britain's communications networks exceeds even its wide reach.

"Demand for network security assessment is experiencing explosive growth and, as that continues, we alone cannot meet demand," said Chris Inch, an IT security expert at The Communications Electronics Security Group.

The CESG, the infosecurity arm of GCHQ, is developing a programme with the private sector called the IT Health Check. Now in the pilot phase, it is due to launch later this year.

Recent checks on government and private-sector organisations carried out by CESG during the pilot phase revealed a raft of problems. Among them were thousands of idle accounts, which could be exploited by intruders, passwords written on bits of paper and attached to terminals , terminals left unattended with root privileges, and unrestricted access between networks. Failure to apply manufacturers' patches to address security vulnerabilities was also a common problem.

"It's naive to think any one organisation can know everything about how to combat network vulnerabilities," emphasised Inch.

Under the IT Health Check scheme, CESG-approved companies carry out computer system security checks based on publicly known vulnerabilities and common configuration faults. A report is then produced that details vulnerabilities and recommends effective counter-measures.

The Defence Evaluation Research Agency is also involved in the scheme, developing advanced intruder testing that uses neural networks and artificial intelligence to simulate and detect attacks.

In a separate development, the FBI has launched a counter-attack against computer hackers who have recently penetrated US Government websites.

While they are keeping details quiet, White House press secretary Joe Lockhart conceded: " I know that there have been a series of (hacking) attempts, some with some success, some without success.

"We are constantly reviewing and will continue to review the security measures we have. Most importantly, for those who do this for whatever kind of sport it provides them, they will be found and they will be prosecuted".