Posted on Tuesday, November 14, 2006 - 6:11 pm:

---

quote:

Some close-proximity insight for those evaluating ES&S. I'm an Omaha resident and have knowledge of ES&S's application development and information security environment.

1. Senior management does not see information security as ES&S's responsibility. The developers are under very tight schedules and are not given much in terms of time and resources to focus on the "apply security after dev is done" model ES&S uses. I discounted this a bit since nearly every programmer complains about not having enough time and resources, but believe there is some merit in the case of ES&S.

2. The codebase was never designed from a security perspective and is old legacy code that has been dragged along into newer OS platforms.

3. ES&S senior management believes that information security is the responsibility of their technology providers. For instance, they attribute OS and networking flaws to Microsoft and indicate they are not responsible for these issues as they're "only users." Unfortunately, in the shop I work in, we're aware Microsoft disagrees and expects us to harden our apps, OS, network and general environment.

4. ES&S security staff are not very well qualified. Internal audits are not performed unless a client requires it, and unfortunately, most governmental clients only know to ask for a SAS-70 (which is usually done by an accountant and says nothing material about information security). Internal security processes are seriously lacking.

5. Constructive criticism is not well tolerated within ES&S's business environment. Production schedules are tough and resource challenges are pushing people to the edge. Shortcuts with the promise of "coming back later to tighten up all these holes" is common practice.

I should note that many of the people that work there are well intentioned and are trying to do their best, but until clients expose these flaws and know how to demand better security (vs. the useless SAS-70), senior management won't realize it needs to allocate these resources. Presently, security is perceived as an unnecessary overhead cost that is the responsibility of others, not ES&S.

---

---

quote:

I manage critical applications (of the 'people can die if the system breaks down' variety) and the key is the the "high-tech" bits are just PART of the system--and the most untrusted part of them to boot. When I saw this application, my first thought was "Good lord, this is FAR too vertical for the intended purpose." Trusting the same thing to collect, record, count, aggregate and report the same numbers? Crazy. In a proper system, each step of that process should be independently capable of validating the next, interchangeable with another component of arbitrary source, whether it is a collection of people, machines or combination of the above. If they cannot agree, the process should start again from the beginning until they DO.

That last bit is the most glaringly obvious problem in our system. When we have total disagreement, all it takes is a Secretary of State to sign off that we officially don't care.

In what I do, it would be akin to patient coming in and saying they have asthma, the doctor writing a scrip for Albuterol, the computer registering Preparation-H, the pharmacist dispensing Aspirin and the nurse administering Heroin, then everyone agreeing that the patient got the Albuterol and no one having the means to prove otherwise...then replacing the computer and saying everything's all better now, pity the patient is dead.

I'm glad to see you're going in the direction of correcting the system, not just the unnecessarily fancy blinkenlights.

It is truly inspiring, admirable work you are doing.

---

---

quote:

The file un5.zip contains an installer for what appears to be ballot designing software. It can't be started up properly without patching the binary, though, because it checks for the presence of a specific printer driver. At least under Wine in Linux anyway -- I don't have a copy of Windows to test it on.

To fix the problem, open opt.exe in a hex editor and nop out 30 bytes starting at offset 0x30527. Save the file and rerun opt.exe. You can now play around with ballot software!

Interestingly, some of the data files contain locality information. OPTBATCH.DAT has references to several locations in Pennsylvania, but the software itself is licensed to Tarrant County, Texas. The string "Tarrant County" is part of the actual binary opt.exe, leading me to believe that the applications are built specifically for each municipality.

---