8 ms·

Use of Yammer by VA staff was a major security risk, investigation says

43 points by jeo1234 11y ago

lo_fye 11y ago
They didn't setup an admin account and disable ex-employees' access. How is this Mucrosoft's fault?
- fapjacks 11y ago
  I didn't see where they implicate Microsoft for the VA's insecurity. This is exposing yet more complete and total ineptitude at the VA.
- bbrazil 11y ago
  "In June 2013, VA’s former chief information officer held a chat forum on the platform, “giving the false impression that VA approved the use of Yammer.com,” IG officials said. In fact, VA officials have not approved use of Yammer for any department work, despite the large number of employees on the site." Sounds more like it wasn't made clear what was or wasn't an okay internal communication tool, which points to a lack of training and IT management.
  - fapjacks 11y ago
    I need to warn you and others against the belief that employee training is going to solve any problems at the VA: They have consistently, constantly used this "we will train employees not to shred unprocessed veteran packets" and "we will train employees not to delete doctor appointments to make our schedule look good"... Clearly this "training" is not working at all. Something much more drastic needs to happen. Flush all employees. Flush all management. Something. Anything.
- sokoloff 11y ago
  Isn't Yammer's business model to entice corporate users to start using it publicly and then charge (extort?) companies to sell them admin access to control it? That's a pretty scummy business model, IMO.
  - steverb 11y ago
    Very similar to how slack was introduced to our organization.
    - sitkack 11y ago
      First hit is free.
- makomk 11y ago
  The reason they didn't do that is because this wasn't an official VA system and their employees weren't meant to be using it: http://www.militarytimes.com/story/veterans/2015/08/21/concerns-va-yammer/32106117/ http://www.militarytimes.com/story/veterans/2015/08/21/conce... Basically, it seems Microsoft designed Yammer so that any employee of any organisation can start/join a Yammer network for their employer just by using their work e-mail address. If the employer then wants to actually administer the internal social network that they've unexpectedly wound up with - for example, to remove ex-employees - Microsoft charge them a substantial monthly per-user fee.
  - narrowrail 11y ago
    That is how Yammer worked before MS bought it. They didn't change anything about it (rightly or wrongly).
  - a3n 11y ago
    That smells vaguely like ransomware.
  - angry_octet 11y ago
    Easily solved by blocking emails to/from and web traffic with a domain filter. If the VA had the guts to do it.
fapjacks 11y ago
There is another article on the internet describing recent findings at the Los Angeles VA regional office where "erroneous shredding" of veteran benefit applications was ubiquitous. As a veteran using VA services, I beg Americans to raise their own awareness of the criminal negligence occurring at the VA. Law currently provides that the VA may not fire or reprimand VA employees based on past performance. That's right: VA employees cannot be fired for shitty performance (or "erroneous shredding"). The phrase we use to describe the VA is "delay or deny until they die" and it's absolutely the truth. A very good friend of mine was murdered by VA doctors who prescribed him drugs with deadly interaction. His family can't do anything about it, and those doctors are still working at the VA, prescribing medications to veterans. If any government organization needs a complete overhaul, an across-the-board firing of all employees (and a permaban of all of those employees from ever working for the government ever again), it's the Department of Veteran Affairs.
- Asbostos 11y ago
  Can't you use normal healthcare? Soldiers aren't given insurance like other employees?
  - athenot 11y ago
    It wouldn't be free. Loved or hated, the VA is a large HMO set up as a benefit for veterans to help them because many of them have had to sacrifice their personal health to fulfill orders their were given. Any healthcare system is riddle with anecdotes of failures, but if you look at it from a population health perspective, as a whole the VA has been able to care for its patients with a pretty good quality if you consider the cost constraints they are working with. I'm not aware of any private health system that's as efficient as the VA. Also, the VA has had a fair amount of innovation that then trickles down to the rest of the healthcare systems. One example is BlueButton, a method to obtain a dump of all your healthcare records as a patient. Eventually CMS (Medicare) enhanced it and started promoting for everyone else, under the spec "BlueButton Plus".
    - fapjacks 11y ago
freshyill 11y ago
Meanwhile I've had two companies attempt to get employees to try to use this. If I can/want to deal with coworkers in person, I will. If I can't/don't want to, I've got real-time tools to do it. Where does this fit in? It's one more layer of crap to get in between me and getting my work done.
lokedhs 11y ago
We were looking at using these kids of tools, but having your internal corporate communication hosted on an external site which you have little control over wasn't really something we wanted to do. We ended up developing our own system which ended up a bit similar to Slack. Of interest to the crowd here, the server side is implemented in Common Lisp. We'll release it as open source as soon as we've cleaned it up a bit. I have an externally available demo system, but I don't want to reveal the URL to it publicly right now since it runs on the smallest possible Google Cloud instance. If anyone is interested in testing it, send a private message to me, or wait until we release it.
- tedsuo 11y ago
  Just pointing out that none of the security issues written about in the article appeared to be related to it being an external service. Their problems seemed to be: a) no one actively admining the service, in particular removing accounts when people left. b) users themselves were communicating things they were not supposed to, like instructions for circumventing other security procedures. You can just as easily have these problems with an internal service. Telling is that the illegal advice VA staff were giving each other had to do with circumventing other security procedures that were interfering with their ability to work effectively (like needing to be available via email but not having access to email on an available device). These are issues all big organizations face, regardless of whether they are purchasing IT services or implementing themselves.
  - solipsism 11y ago
    You can just as easily have these problems with an internal service. Not for the typical definition of "internal". Typically to reach an internal service you have to be on the internal network. Removal of an ex-user's intranet credentials is usually something IT handles well.
- pbreit 11y ago
  I don't think the trade off makes sense for most organizations. I'm guessing your system is substantially inferior to offerings like a Slack or Yammer.
mercurial 11y ago
> When quizzed about how exactly the network was supposed to stay secure without oversight, an official whose name is redacted from the document told the investigators: “It’s kind of like a self-policing, everybody’s job is to be responsible.” So their security policy was to not have a security policy, essentially.
douche 11y ago
The compliance tools for Yammer are pretty rudimentary. I've actually worked on a product for automating the Yammer data export, converting the raw data that that dumps to you (what looks suspiciously like a straight table dump, converted into an archive of CSV files), and pushing that into various compliance management systems.
douche 11y ago
I've also never really figured out what value Yammer, and other similar products, like Chatter from SalesForce, or IBM's Lotus Connections, was supposed to provide. As best I can tell, the rationale must have been something like: 1.) Well, our employees spend a lot of time screwing around on Facebook, so let's build something that looks almost identical, but that is supposed to be used for posting status messages about work, instead of BuzzFeed listicles, baby pictures, and venting! 2.) ????? 3.) PROFIT!!!!
- itaysk 11y ago
  Social network tools were found as very productive (since ppl are familiar with them from home). This caused employees to form work groups on commercial products like Facebook, WhatsApp, etc... companies want to give employees those same tools but under the control of the company and with enhanced governance.
  - douche 11y ago
    Having seen a lot of the content that goes through these products, from the compliance side, I'm not sure that they are particularly "productive." Where they have any uptake at all (surprisingly rare, for such expensive products, that require so much work to implement and roll out), it's pretty... meh. It seems like "social" is a buzzword that is finally starting to lose it's luster, but it was pretty ridiculous for a while - IBM changing the name of Lotusphere to IBM Connections, all of these business Facebook-clones, Microsoft spending a boat-load of money on Yammer, then letting it languish, while building more or less parallel features into SharePoint and Office365. So much hype about "transforming the way people work" and some truly disturbing rhetoric about enabling the blurring of personal and work life. Good riddance.
    - a3n 11y ago
      People know how to work. Work gets done despite the lack of these "enabling" social tools, or even despite their presence. People like to play around with how to arrange metawork. Mangers especially like this. A lot of it is yak shaving.
cs702 11y ago
As Randall Munroe has cleverly illustrated, a system is only as secure as its weakest point: https://xkcd.com/1200/ https://xkcd.com/1200/ IT administrators can secure everything under their control really well, but if a third-party web application used by employees is successfully penetrated, poof! IT infrastructure is now exposed to threats from the inside. Meanwhile, the only people who can evaluate and improve the security of that web application are the people selling the application.
astazangasta 11y ago
My IT department is a menace. In the name of security we have all been forced into a shitty Juniper VPN with no Linux support, ssh and http access is curtailed campus wide and we must install some tracking software so IT can "monitor our patch status". Whether this improves anything in terms of data breaches I don't know. But as far as I can see "security" is the literal opposite of freedom and openness.

43 points by jeo1234 11y ago

lo_fye 11y ago

They didn't setup an admin account and disable ex-employees' access. How is this Mucrosoft's fault?

fapjacks 11y ago
I didn't see where they implicate Microsoft for the VA's insecurity. This is exposing yet more complete and total ineptitude at the VA.
bbrazil 11y ago
"In June 2013, VA’s former chief information officer held a chat forum on the platform, “giving the false impression that VA approved the use of Yammer.com,” IG officials said. In fact, VA officials have not approved use of Yammer for any department work, despite the large number of employees on the site." Sounds more like it wasn't made clear what was or wasn't an okay internal communication tool, which points to a lack of training and IT management.
- fapjacks 11y ago
  I need to warn you and others against the belief that employee training is going to solve any problems at the VA: They have consistently, constantly used this "we will train employees not to shred unprocessed veteran packets" and "we will train employees not to delete doctor appointments to make our schedule look good"... Clearly this "training" is not working at all. Something much more drastic needs to happen. Flush all employees. Flush all management. Something. Anything.
sokoloff 11y ago
Isn't Yammer's business model to entice corporate users to start using it publicly and then charge (extort?) companies to sell them admin access to control it? That's a pretty scummy business model, IMO.
- steverb 11y ago
  Very similar to how slack was introduced to our organization.
  - sitkack 11y ago
    First hit is free.
makomk 11y ago
The reason they didn't do that is because this wasn't an official VA system and their employees weren't meant to be using it: http://www.militarytimes.com/story/veterans/2015/08/21/concerns-va-yammer/32106117/ http://www.militarytimes.com/story/veterans/2015/08/21/conce... Basically, it seems Microsoft designed Yammer so that any employee of any organisation can start/join a Yammer network for their employer just by using their work e-mail address. If the employer then wants to actually administer the internal social network that they've unexpectedly wound up with - for example, to remove ex-employees - Microsoft charge them a substantial monthly per-user fee.
- narrowrail 11y ago
  That is how Yammer worked before MS bought it. They didn't change anything about it (rightly or wrongly).
- a3n 11y ago
  That smells vaguely like ransomware.
- angry_octet 11y ago
  Easily solved by blocking emails to/from and web traffic with a domain filter. If the VA had the guts to do it.

fapjacks 11y ago

There is another article on the internet describing recent findings at the Los Angeles VA regional office where "erroneous shredding" of veteran benefit applications was ubiquitous. As a veteran using VA services, I beg Americans to raise their own awareness of the criminal negligence occurring at the VA. Law currently provides that the VA may not fire or reprimand VA employees based on past performance. That's right: VA employees cannot be fired for shitty performance (or "erroneous shredding"). The phrase we use to describe the VA is "delay or deny until they die" and it's absolutely the truth. A very good friend of mine was murdered by VA doctors who prescribed him drugs with deadly interaction. His family can't do anything about it, and those doctors are still working at the VA, prescribing medications to veterans. If any government organization needs a complete overhaul, an across-the-board firing of all employees (and a permaban of all of those employees from ever working for the government ever again), it's the Department of Veteran Affairs.

Asbostos 11y ago
Can't you use normal healthcare? Soldiers aren't given insurance like other employees?
- athenot 11y ago
  It wouldn't be free. Loved or hated, the VA is a large HMO set up as a benefit for veterans to help them because many of them have had to sacrifice their personal health to fulfill orders their were given. Any healthcare system is riddle with anecdotes of failures, but if you look at it from a population health perspective, as a whole the VA has been able to care for its patients with a pretty good quality if you consider the cost constraints they are working with. I'm not aware of any private health system that's as efficient as the VA. Also, the VA has had a fair amount of innovation that then trickles down to the rest of the healthcare systems. One example is BlueButton, a method to obtain a dump of all your healthcare records as a patient. Eventually CMS (Medicare) enhanced it and started promoting for everyone else, under the spec "BlueButton Plus".
  - fapjacks 11y ago

freshyill 11y ago

Meanwhile I've had two companies attempt to get employees to try to use this. If I can/want to deal with coworkers in person, I will. If I can't/don't want to, I've got real-time tools to do it. Where does this fit in? It's one more layer of crap to get in between me and getting my work done.

lokedhs 11y ago

We were looking at using these kids of tools, but having your internal corporate communication hosted on an external site which you have little control over wasn't really something we wanted to do. We ended up developing our own system which ended up a bit similar to Slack. Of interest to the crowd here, the server side is implemented in Common Lisp. We'll release it as open source as soon as we've cleaned it up a bit. I have an externally available demo system, but I don't want to reveal the URL to it publicly right now since it runs on the smallest possible Google Cloud instance. If anyone is interested in testing it, send a private message to me, or wait until we release it.

tedsuo 11y ago
Just pointing out that none of the security issues written about in the article appeared to be related to it being an external service. Their problems seemed to be: a) no one actively admining the service, in particular removing accounts when people left. b) users themselves were communicating things they were not supposed to, like instructions for circumventing other security procedures. You can just as easily have these problems with an internal service. Telling is that the illegal advice VA staff were giving each other had to do with circumventing other security procedures that were interfering with their ability to work effectively (like needing to be available via email but not having access to email on an available device). These are issues all big organizations face, regardless of whether they are purchasing IT services or implementing themselves.
- solipsism 11y ago
  You can just as easily have these problems with an internal service. Not for the typical definition of "internal". Typically to reach an internal service you have to be on the internal network. Removal of an ex-user's intranet credentials is usually something IT handles well.
pbreit 11y ago
I don't think the trade off makes sense for most organizations. I'm guessing your system is substantially inferior to offerings like a Slack or Yammer.

mercurial 11y ago

> When quizzed about how exactly the network was supposed to stay secure without oversight, an official whose name is redacted from the document told the investigators: “It’s kind of like a self-policing, everybody’s job is to be responsible.” So their security policy was to not have a security policy, essentially.

douche 11y ago

The compliance tools for Yammer are pretty rudimentary. I've actually worked on a product for automating the Yammer data export, converting the raw data that that dumps to you (what looks suspiciously like a straight table dump, converted into an archive of CSV files), and pushing that into various compliance management systems.

douche 11y ago

I've also never really figured out what value Yammer, and other similar products, like Chatter from SalesForce, or IBM's Lotus Connections, was supposed to provide. As best I can tell, the rationale must have been something like: 1.) Well, our employees spend a lot of time screwing around on Facebook, so let's build something that looks almost identical, but that is supposed to be used for posting status messages about work, instead of BuzzFeed listicles, baby pictures, and venting! 2.) ????? 3.) PROFIT!!!!

itaysk 11y ago
Social network tools were found as very productive (since ppl are familiar with them from home). This caused employees to form work groups on commercial products like Facebook, WhatsApp, etc... companies want to give employees those same tools but under the control of the company and with enhanced governance.
- douche 11y ago
  Having seen a lot of the content that goes through these products, from the compliance side, I'm not sure that they are particularly "productive." Where they have any uptake at all (surprisingly rare, for such expensive products, that require so much work to implement and roll out), it's pretty... meh. It seems like "social" is a buzzword that is finally starting to lose it's luster, but it was pretty ridiculous for a while - IBM changing the name of Lotusphere to IBM Connections, all of these business Facebook-clones, Microsoft spending a boat-load of money on Yammer, then letting it languish, while building more or less parallel features into SharePoint and Office365. So much hype about "transforming the way people work" and some truly disturbing rhetoric about enabling the blurring of personal and work life. Good riddance.
  - a3n 11y ago
    People know how to work. Work gets done despite the lack of these "enabling" social tools, or even despite their presence. People like to play around with how to arrange metawork. Mangers especially like this. A lot of it is yak shaving.

cs702 11y ago

As Randall Munroe has cleverly illustrated, a system is only as secure as its weakest point: https://xkcd.com/1200/ https://xkcd.com/1200/ IT administrators can secure everything under their control really well, but if a third-party web application used by employees is successfully penetrated, poof! IT infrastructure is now exposed to threats from the inside. Meanwhile, the only people who can evaluate and improve the security of that web application are the people selling the application.

astazangasta 11y ago

My IT department is a menace. In the name of security we have all been forced into a shitty Juniper VPN with no Linux support, ssh and http access is curtailed campus wide and we must install some tracking software so IT can "monitor our patch status". Whether this improves anything in terms of data breaches I don't know. But as far as I can see "security" is the literal opposite of freedom and openness.