5 ms·

An interesting statement from the UC President, former head of the Department of Homeland Security: [1] > "While we have absolutely no interest in the content

by toufka 11y ago

An interesting statement from the UC President, former head of the Department of Homeland Security: [1] > "While we have absolutely no interest in the content of any individual's emails or browsing history, we must accept that active network monitoring is a critical element of a sound cyber-security infrastructure and the interconnections of the University and all of its locations requires that such monitoring be coordinated centrally." Do you guys agree? [1] https://www.documentcloud.org/documents/2702981-Chancellors-Cybersecurity-Measures-020116.html https://www.documentcloud.org/documents/2702981-Chancellors-...

jonesb6 11y ago
Essentially "we care about privacy, until something comes up that scares the general public and makes us care less about privacy", a.k.a. Ohlocracy [1]. It also doesn't address the problem of abuse. Remember when the NSA agents spied on their spouses, girlfriends, and lovers [2]? [1]: https://en.wikipedia.org/wiki/Ochlocracy https://en.wikipedia.org/wiki/Ochlocracy [2]: http://www.nydailynews.com/news/politics/nsa-analysts-spied-spouses-girlfriends-documents-article-1.2058282 http://www.nydailynews.com/news/politics/nsa-analysts-spied-...
deleted 11y ago
[deleted]
Eridrus 11y ago
The security industry has largely given up on prevention as a means of stopping breaches, the current trend is very much based on fast detection & response. Neither the NSA's nor these systems have the capacity to store full-take data, hell even just netflow data can be a challenge to store for any extended period of time. The only thing that can really be done is streaming monitoring. To the people wondering why decryption is necessary: HTTPS is ubiquitous and ip/port info is not actually enough to figure out where the communications are going, SNI helps quite a bit, but it may not be enough e.g. if a bad guy decided to use Twitter or AppEngine/Spot or an S3 bucket for C&C. In a corporate environment your options are usually either network or host agent based, and frankly the network approach is significantly less intrusive, but also less effective.
- pfooti 11y ago
  According to an earlier article [0] about this, there's enough storage to keep 30 days of network traffic. That's not nothing. It's also something that apparently the regular UC IT folks have no control over whatsoever. 0: http://utotherescue.blogspot.com/2016/01/ucop-ordered-spyware-installed-on-uc.html http://utotherescue.blogspot.com/2016/01/ucop-ordered-spywar... 1: https://news.ycombinator.com/item?id=11006915 https://news.ycombinator.com/item?id=11006915
  - reolt 11y ago
    That's strange. My company uses the same Fidelis XPS appliances Berkeley is using, and they're entirely installed, administered, managed, configured, and monitored by our internal IT security staff. Only our staff has access to alerts it fires and the snippets of traffic it captures (for example, if it detects potential malware C&C beaconing, it'll show the bytes it flagged as matching the signature, and some ~200 bytes before and after it). We're also able to view, change, or add all the rules it uses. The source code is closed, so that part is a blackbox, but it seems like a huge stretch to call the entire appliance a blackbox considering we're 100% responsible for integrating, managing, and utilizing it. I imagine Fidelis probably also offers a professional services option that allows them to manage setup and maybe even remote monitoring. If this is true, there's absolutely no reason why Berkeley can't hire competent infosec folks to handle it all internally, especially considering they have a lot of smart students in the field.
    - pfooti 11y ago
      My understanding of the situation (which I'm not involved with since I'm no longer Berkeley faculty, but I follow because I was in the past) is that the office of the president (UC-wide, not just UCB) ordered the systems installed and specifically out of the control (and over the objections) of UCB IT services.
      - reolt 11y ago
        I see. That certainly makes it more interesting. In that case, all of the criticism should be directed at him, and not at Fidelis or their appliances.
deleted 11y ago
[deleted]
edge17 11y ago
Somewhat sad to see given the high profile McCarthy era cases that placed staff and faculty in the UC system front and center in the 40's and 50's. Saying "we have no interest" is somewhat ambiguous; it is after all public money.
ladzoppelin 11y ago
Actually,this response is really good. Thanks for posting the link. I hope this actually works and ends up providing a good example on how to secure high valued targets. How is this action surprising or even debatable?

by toufka 11y ago

jonesb6 11y ago

Essentially "we care about privacy, until something comes up that scares the general public and makes us care less about privacy", a.k.a. Ohlocracy [1]. It also doesn't address the problem of abuse. Remember when the NSA agents spied on their spouses, girlfriends, and lovers [2]? [1]: https://en.wikipedia.org/wiki/Ochlocracy https://en.wikipedia.org/wiki/Ochlocracy [2]: http://www.nydailynews.com/news/politics/nsa-analysts-spied-spouses-girlfriends-documents-article-1.2058282 http://www.nydailynews.com/news/politics/nsa-analysts-spied-...

deleted 11y ago

[deleted]

Eridrus 11y ago

The security industry has largely given up on prevention as a means of stopping breaches, the current trend is very much based on fast detection & response. Neither the NSA's nor these systems have the capacity to store full-take data, hell even just netflow data can be a challenge to store for any extended period of time. The only thing that can really be done is streaming monitoring. To the people wondering why decryption is necessary: HTTPS is ubiquitous and ip/port info is not actually enough to figure out where the communications are going, SNI helps quite a bit, but it may not be enough e.g. if a bad guy decided to use Twitter or AppEngine/Spot or an S3 bucket for C&C. In a corporate environment your options are usually either network or host agent based, and frankly the network approach is significantly less intrusive, but also less effective.

pfooti 11y ago
According to an earlier article [0] about this, there's enough storage to keep 30 days of network traffic. That's not nothing. It's also something that apparently the regular UC IT folks have no control over whatsoever. 0: http://utotherescue.blogspot.com/2016/01/ucop-ordered-spyware-installed-on-uc.html http://utotherescue.blogspot.com/2016/01/ucop-ordered-spywar... 1: https://news.ycombinator.com/item?id=11006915 https://news.ycombinator.com/item?id=11006915
- reolt 11y ago
  That's strange. My company uses the same Fidelis XPS appliances Berkeley is using, and they're entirely installed, administered, managed, configured, and monitored by our internal IT security staff. Only our staff has access to alerts it fires and the snippets of traffic it captures (for example, if it detects potential malware C&C beaconing, it'll show the bytes it flagged as matching the signature, and some ~200 bytes before and after it). We're also able to view, change, or add all the rules it uses. The source code is closed, so that part is a blackbox, but it seems like a huge stretch to call the entire appliance a blackbox considering we're 100% responsible for integrating, managing, and utilizing it. I imagine Fidelis probably also offers a professional services option that allows them to manage setup and maybe even remote monitoring. If this is true, there's absolutely no reason why Berkeley can't hire competent infosec folks to handle it all internally, especially considering they have a lot of smart students in the field.
  - pfooti 11y ago
    My understanding of the situation (which I'm not involved with since I'm no longer Berkeley faculty, but I follow because I was in the past) is that the office of the president (UC-wide, not just UCB) ordered the systems installed and specifically out of the control (and over the objections) of UCB IT services.
    - reolt 11y ago
      I see. That certainly makes it more interesting. In that case, all of the criticism should be directed at him, and not at Fidelis or their appliances.

deleted 11y ago

[deleted]

edge17 11y ago

Somewhat sad to see given the high profile McCarthy era cases that placed staff and faculty in the UC system front and center in the 40's and 50's. Saying "we have no interest" is somewhat ambiguous; it is after all public money.

ladzoppelin 11y ago

Actually,this response is really good. Thanks for posting the link. I hope this actually works and ends up providing a good example on how to secure high valued targets. How is this action surprising or even debatable?