4 ms·

So let me get this straight. The guy who headed the NSA--an organization so secure that a 30 year old contractor was walking out with classified documents on a

by Zelphyr 11y ago

So let me get this straight. The guy who headed the NSA--an organization so secure that a 30 year old contractor was walking out with classified documents on a thumb drive during this guy's tenure--wants companies to buy his product? I don't think so.

dsl 11y ago
Snowden is actually a great example of how well compartmentalization works. He downloaded what was effectively the brochure stand you see in the lobby of a cheap hotel. Look, we have this for use, here is a high level overview. Come talk to us, we will read you into the program, and provide you with the details. Sure it was an intelligence loss - but it was all stuff that any cleared staff could access anyway.
- hackuser 11y ago
  > He [Snowden] downloaded what was effectively the brochure stand you see in the lobby of a cheap hotel The NSA and other government security organizations say that the information he leaked was very damaging. The NSA also changed their security procedures in response. All of that could be for show, but I haven't seen evidence that it is.
- scintill76 11y ago
  I kind of see your point in that he mostly got things like slideshows, rather than detailed memos, code, operational details. Yeah, without compartmentalization, it could have been worse, but unless they intended to allow someone to mass-exfiltrate all that, there's still a pretty bad security failure.
raincom 11y ago
There are many start ups, which serve 3 letter agencies. This guy will sell his product to those agencies, make big bucks.
- rdtsc 11y ago
  Yap common path for ex-heads and high ranking people from those agencies. His friends will funnel business his way. While they make friends there, retire, start business so those friends can now funnel business their way.
nickpsecurity 11y ago
He only had access to stuff lots of people were cleared for. I predicted that early on and further guessed that most of capabilities were in SAP's for stronger protection. That was confirmed later with ECI leaks which specifically reference the SAP's. People kept getting confused, esp over ECI vs SCI, so I explained how the classification system worked and how it applies to Snowden here: https://www.schneier.com/blog/archives/2014/10/nsa_classificat.html#c6681021 https://www.schneier.com/blog/archives/2014/10/nsa_classific... Anyone wanting to know about how thoroughly SAP's are protected can start with the NIPSOM Industrial Security Manual(s): http://fas.org/sgp/library/nispom.htm http://fas.org/sgp/library/nispom.htm They start with that stuff as a framework and use specialists for categories demanding it. Much better than CISSP as it covers papers, personnel, INFOSEC, COMSEC, OPSEC, EMSEC... the works. My own framework built on it plus what I learned in privacy guides (eg Eden Press), spy/military nonfiction, and writings of crooks. All kinds of useful techniques to draw on when filling in the blanks of the framework for a given organization. INFOSEC turned into the most fun of the rabbit holes. Mostly solved and just not reaching mainstream, but still stuff to figure out for pro level and high assurance sector. Many, many surprises await.
tlrobinson 11y ago
Yeah, but "Mr. Alexander was known for modeling an NSA command center after the interior of Star Trek’s USS Enterprise."

by Zelphyr 11y ago

dsl 11y ago

Snowden is actually a great example of how well compartmentalization works. He downloaded what was effectively the brochure stand you see in the lobby of a cheap hotel. Look, we have this for use, here is a high level overview. Come talk to us, we will read you into the program, and provide you with the details. Sure it was an intelligence loss - but it was all stuff that any cleared staff could access anyway.

hackuser 11y ago
> He [Snowden] downloaded what was effectively the brochure stand you see in the lobby of a cheap hotel The NSA and other government security organizations say that the information he leaked was very damaging. The NSA also changed their security procedures in response. All of that could be for show, but I haven't seen evidence that it is.
scintill76 11y ago
I kind of see your point in that he mostly got things like slideshows, rather than detailed memos, code, operational details. Yeah, without compartmentalization, it could have been worse, but unless they intended to allow someone to mass-exfiltrate all that, there's still a pretty bad security failure.

raincom 11y ago

There are many start ups, which serve 3 letter agencies. This guy will sell his product to those agencies, make big bucks.

rdtsc 11y ago
Yap common path for ex-heads and high ranking people from those agencies. His friends will funnel business his way. While they make friends there, retire, start business so those friends can now funnel business their way.

nickpsecurity 11y ago

He only had access to stuff lots of people were cleared for. I predicted that early on and further guessed that most of capabilities were in SAP's for stronger protection. That was confirmed later with ECI leaks which specifically reference the SAP's. People kept getting confused, esp over ECI vs SCI, so I explained how the classification system worked and how it applies to Snowden here: https://www.schneier.com/blog/archives/2014/10/nsa_classificat.html#c6681021 https://www.schneier.com/blog/archives/2014/10/nsa_classific... Anyone wanting to know about how thoroughly SAP's are protected can start with the NIPSOM Industrial Security Manual(s): http://fas.org/sgp/library/nispom.htm http://fas.org/sgp/library/nispom.htm They start with that stuff as a framework and use specialists for categories demanding it. Much better than CISSP as it covers papers, personnel, INFOSEC, COMSEC, OPSEC, EMSEC... the works. My own framework built on it plus what I learned in privacy guides (eg Eden Press), spy/military nonfiction, and writings of crooks. All kinds of useful techniques to draw on when filling in the blanks of the framework for a given organization. INFOSEC turned into the most fun of the rabbit holes. Mostly solved and just not reaching mainstream, but still stuff to figure out for pro level and high assurance sector. Many, many surprises await.

tlrobinson 11y ago

Yeah, but "Mr. Alexander was known for modeling an NSA command center after the interior of Star Trek’s USS Enterprise."