I'm really surprised they're allowed to take information out of the building without having it checked in/out.

@Sariscos

From the DOHS website:
"Mission support careers involve the following fields: medical, human resources, facilities, budget, procurement, science and technology, training, intelligence, planning and coordination, detection, civil rights, fraud detection and more. Sample components"

Depends what buildings they targeted, many of these wouldn't require such intense secrecy.

Want to know how the Stuxnet virus could have accidently been insinuated into the software located on a closed server, of the type found in most nuclear energy plants? Look no further than this article.

The headline was unsupported by the what was in the article - I would propose that the headline is proof that headline writers are stupid.

See

and what about antivirus software installed on the PCs ? if it is configured correctly as well as user rights and permissions (only admin are allowed to install smth), than how come call home routine or other software is allowed to be installed by antivirus from thumb drives and etc?

I'm really surprised they're allowed to take information out of the building without having it checked in/out.

No information was taken out for the test, they tested information being taken in...
IT Security no doubt requires no data carriers from outside being used in department systems, but clearly there's no safeguards against this and/or the staff have become expert at circumventing such safeguards as may exist.

I used to work at a major bank's headquarters. This scenario would have been physically impossible there as all computers had hardware to prevent it.
The disk drives (no USB ports existed back then, and if they did they'd have been internally disconnected or physically removed from the systems for just this reason) were all special units that would encrypt and decrypt any disk put in on the fly.
Unencrypted disks thus could not be read, and disks written by them could not be read by any outside system (though decryption software might have decrypted the data).

All external connectors to the computers were either removed, internally disconnected from the rest of the hardware, or where needed (like network, keyboard, mouse, and monitor connectors) were shielded so they could not be disconnected by the user (a metal shield was placed over the rear of every workstation, which required a key to unlock which only the IT department had access to and was probably stored in a safe somewhere).
All computers were furthermore locked with a steel cable to individual desks to prevent theft.
Laptops weren't much of a problem as we had none, and our network was such that it was impossible for unauthorised systems to log on (both an obscure network topology, and the servers required custom software to communicate any login request, developed in house, which would present a workstation dependent code to the server for authentication, any unknown code, even were the workstation known to another server, would cause the workstation to be locked out from the network).

Yes, it was paranoid. But we didn't have to fear compromised data security from people plugging unauthorised disks or computers into the network.

It's rather disturbing that similar security measures aren't in place in a supposedly security conscious government department like DHS.

and what about antivirus software installed on the PCs ? if it is configured correctly as well as user rights and permissions (only admin are allowed to install smth), than how come call home routine or other software is allowed to be installed by antivirus from thumb drives and etc?

AV software works on pattern recognition and behaviour prediction.
If you write something that doesn't match those patterns and seems innocious in its behaviour it doesn't get flagged.
Say this thing installed itself as a plugin into MS Office when a Word document with a macro was loaded, then sends a single email before deleting itself or going dormant.
That's unlikely to get detected by an AV scanner.

Reads like an episode of Candid Camera :)

most bases don't allow you to use thumb drives in the computers and if you do there are serious repercussions.

it is surprising they're allowed to take information out of the building without having it checked in/out.

If this were to be in my country, the testers would have taken over the whole nation and become so wealthy.