This story appeared on Network World Fusion at
http://www.nwfusion.com/columnists/2001/1022bradner.html

'Net Insider:

Does going it alone make sense?



By Scott Bradner
Network World, 10/22/01


On the premise that people who work for the government are good guys and deeply understand the intricacies of network security, some people in the U.S. government are thinking of spending a lot of taxpayer money building an illusion.

The new cyberspace security czar, Richard Clarke, just announced that the General Services Administration, the group that procures equipment and services for the U.S. government, has published a request for information (RFI) as a first step in a plan to build a separate data and multimedia network for the use of "government agencies and other authorized users only." In the interest of cuteness, the network would be called "govnet" (See this Word document).

The basic idea is that an isolated network is a secure network, which at some level is a truism. But the GSA does not stop there.

The RFI is looking for a lot of other things in this net: no interconnections with the Internet; commercial-grade voice; advanced videoconferencing; "[immunity] from malicious service and/or functional disruptions"; "network-based data encryption"; and a requirement for bandwidth-on-demand services. A neat network to have indeed. Some of these requirements might be more than a bit hard to meet, but Dad always said to "aim high."

But there are more basic problems with the idea. Government agencies, even those with sensitive data, are not a world in and of themselves. They get information from the rest of the world - the world of the Internet.

A separate network would mean two computers on a lot of desks. One computer to deal with the real world and one on the private network. It would also mean a great deal of inconvenience. A worker who gets an e-mail message on one network that needs to be forwarded to the other is in a real bind. Using a floppy disk could easily transfer a virus, but retyping is slow and prone to errors. So it would not be long before employees would be using floppies, or if they are banned, switching computers between the networks. This would be a natural process with laptop computers - use AOL at home and govnet at work (or even use CNN.com at work if there is something interesting going on) - reliably forwarding all sorts of digital infections with every reconnect.

Let's not even talk about the implications of using Microsoft Exchange and Internet Information Server on the security of govnet.

The most fundamental problem is the assumption of purity of heart and competence on the part of government employees, the same people that Clarke slammed in an interview at the time of the announcement of the RFI. Network security is hard, there are lots of seemingly illogical details to remember (just ask the ex-CIA chief), and security gets in the way of doing your job.

Isolation of some networks is the right thing, but it would be far better in most cases to have good security tools for use in the real world.

Disclaimer: Only some parts of Harvard are well isolated from the real world and the above dismissing of isolation as panacea is my own.

All contents copyright 1995-2002 Network World, Inc. http://www.nwfusion.com