"We have almost everyday cyber attacks at a federal level," said Secretary of Defense Guy Parmelin a year ago in an interview with the newspaper. The attackers often wanted to take business secrets, but also military secrets. The successful cyber attacks on its department and the federal weapon factory Ruag in 2016 were "electric shock". "Many believe that the cyber war occurs elsewhere. That is not really," warned the VBS manager.
An important IT security challenge for IT departments around the world is called shadow IT: private devices and software that individual workers or individual departments use on their own and without knowing the IT department.
A few weeks after the interview, the defense minister commissioned an internal audit on that subject only. The aim of the investigation is to determine the extent to which VBS workers and military personnel also use their own private software, hardware and cloud services. The auditors answered the question between January and March 2018; The results were published last week, as the "Luzerner Zeitung" said on Friday.
Where is the Wi-Fi network coming from?
In general, the auditors give the department a good general mark. However, action is needed in the Defense Group. The problems and depicting a visit to Waffenplatz Bure are impressive: According to the report, there are several WLAN access points "whose origin in place and location are not well known" – which is # 39 ; n means no-one could say where WLAN devices were, which produced these Wi-Fi signals. In at least one case, a foot unit had "installed a WLAN device alone and was not disabled after the end of the service," the auditors suspect. "The question of where these wireless devices can not be explained exactly and whether they are still connected to a network".
In general, an extremely confusing situation with Internet connections is criticized. According to an internal list, there are a total of 251 direct DSL connections in the DDPS, which are used, for example, such as Internet access to third parties, for monitoring systems or also for remote control of cable cars. The justification for the existence of these links is not always clear, and the auditors suspect that the list is complete.
"We see the main risk that DSL and WLAN bridges in VBS and military networks could be beaten," says the auditors.
A own mail server was installed
There are other safety holes when using equipment that increases productivity but poses risks. The reviewers complain that cloud services such as Google Drive, Dropbox and Swisscom MyCloud are not blocked and accessible.
In Bure, for example, a group of army members have developed their own program that shows the maintenance situation of all vehicles being cared for on the tool station. This instrument will be transmitted on a USB stick from each platoon leader to a platoon leader.
At the Leadership Support Brigade 41, Army personnel would also have installed a mail server on their own to communicate with each other. The server is funded by the army, but is operated by an external company.
No alternative to private laptops
The DDPS defense group comments on the criticism report. WLAN access points respond that such devices are only critical if they have been connected directly to the VBS infrastructure. The explanation of whether such a connection exists or does not exist. Also, VBS's main information, Renato Kalbermatten, can apply at the request of this newspaper without further information on the case.
On the DSL lines, Kalbermatten noted that they were in any case independently of the VBS network. It would be simple to provide access to the Internet for soldiers or, in an infrastructure where the DDPS does not have access to the network, to provide access to a public service provider service (such as Swisscom).
No alternative to private laptops
In general, the opinion in the report asks whether the term category can be used to the militia army. For the army only secures IT resources for "the real education and training services". "The needs of the militia outside these services, especially for most preparatory work by the cadres (other than the body's commander) can not be included in safety army security. " So it is inevitable that the militia uses private money.
Kalbermatten's main information confirms that some of the militia managers, for example, use their private laptops when preparing them. That would not possibly be the case, says Kalbermatten. However, each has instructed to adhere to the obstruction between the outside world and the VBS infrastructure and to handle any sensitive data on their unwanted devices. Army hosts specific training on this and is sensitive to army personnel to the problem.
The auditors agree with Kalbermatten: The audit report praises in particular "there are adequate directives and guidance in the DDPS that describes the safe use of computer equipment." However, the report recommends a more detailed risk assessment in the interface with the militia.
Created: 09.11.2018, 16:30 clock