9 ms·

I have a class with the guy who was in charge of infosec (or the closest thing they had to 'in charge') for US military in the Middle East from about 2004-2006.

I have a class with the guy who was in charge of infosec (or the closest thing they had to 'in charge') for US military in the Middle East from about 2004-2006. When he got there he implemented a policy forbidding use of flash drives, and in doing so made everyone furious. For his entire time there he was pissing off users, but maybe the capacity for accepting unexplained 'No's is greater in the military, so the policy held. Then as soon as he left, they got rid of his rule, and a year later Russia landed their worm on tons of DoD boxes, classified and otherwise, with some flash drives in a parking lot; as the largest ever of DoD networks, it led to the start of CyberCom. Talk about failing to get any buy-in...

toomuchtodo 11y ago
Sometimes the "no" exists for a reason. Users don't understand this, and want the path of least resistance. Which is why policies exist for terminating such users from organizations. But heh, infosec shouldn't exist and everyone should be able to BYOD, amirite? "Frictionless" or something like that?
- vonmoltke 11y ago
  > Sometimes the "no" exists for a reason. Users don't understand this, and want the path of least resistance. Which is why policies exist for terminating such users from organizations. I will say that, in my experience dealing with government and DOD contractor security, is that they often fail to articulate the reasons. Users should understand, at some level, the threats you are trying to face. If someone comes to you for permission to do something and your "No" is backed up with nothing more than "That's the policy" or "Because I said so" you can expect them to be much more hostile to it and more likely to go around it.
  - toomuchtodo 11y ago
    I agree that user education is required.
chris_wot 11y ago
The problem with this story isn't that USB drives were used and caused a vulnerability, it's that USB drives could be used to cause a vulnerability. Let's say the Russians did the same thing dumping a bunch of USB devices whilst the USB drive ban was in place. Almost certainly someone is going to sneak in a USB drive at the risk of getting caught, just so they can do their job more effectively. There is still a good chance that this USB drive hack might have worked, just not as likely. I really feel that your friend wasn't looking at things from the right perspective. The reason that USB drives were the vector that allowed the Russian hack to work was because they allow the execution of arbitrary code once the drive is mounted. If you prevent the execution of that code, then the issue would largely have gone away. Instead of only banning USB drives, why not investigate ways of preventing code execution on drive insertion from occurring in the first place? Then you could have the policy of no USB drives, but if someone did sneak one in then it would have removed the vulnerability completely.
- fabulist 11y ago
  A small point of information, it is also problematic (in a highly sensitive enviornment) to let people arbitrarily decide to take gigabytes of information out the door with them.
  - chris_wot 11y ago
    Indeed. Allowing workstations to connect USB storage should be prevented, even if they actually connect the drive into the USB slot. Actually, I'm not even sure if Windows allows a way of preventing this.
    - fabulist 11y ago
      I've definitely spoken to people who've told me that, when they plug a USB drive in at their place of work, Windows pops up a dialog for an administrator's password in order to mount it. I believe this is some sort of group policy, but I'm afraid I only use GNU/Linux.
      - 11y ago

toomuchtodo 11y ago

Sometimes the "no" exists for a reason. Users don't understand this, and want the path of least resistance. Which is why policies exist for terminating such users from organizations. But heh, infosec shouldn't exist and everyone should be able to BYOD, amirite? "Frictionless" or something like that?

vonmoltke 11y ago
> Sometimes the "no" exists for a reason. Users don't understand this, and want the path of least resistance. Which is why policies exist for terminating such users from organizations. I will say that, in my experience dealing with government and DOD contractor security, is that they often fail to articulate the reasons. Users should understand, at some level, the threats you are trying to face. If someone comes to you for permission to do something and your "No" is backed up with nothing more than "That's the policy" or "Because I said so" you can expect them to be much more hostile to it and more likely to go around it.
- toomuchtodo 11y ago
  I agree that user education is required.

chris_wot 11y ago

The problem with this story isn't that USB drives were used and caused a vulnerability, it's that USB drives could be used to cause a vulnerability. Let's say the Russians did the same thing dumping a bunch of USB devices whilst the USB drive ban was in place. Almost certainly someone is going to sneak in a USB drive at the risk of getting caught, just so they can do their job more effectively. There is still a good chance that this USB drive hack might have worked, just not as likely. I really feel that your friend wasn't looking at things from the right perspective. The reason that USB drives were the vector that allowed the Russian hack to work was because they allow the execution of arbitrary code once the drive is mounted. If you prevent the execution of that code, then the issue would largely have gone away. Instead of only banning USB drives, why not investigate ways of preventing code execution on drive insertion from occurring in the first place? Then you could have the policy of no USB drives, but if someone did sneak one in then it would have removed the vulnerability completely.

fabulist 11y ago
A small point of information, it is also problematic (in a highly sensitive enviornment) to let people arbitrarily decide to take gigabytes of information out the door with them.
- chris_wot 11y ago
  Indeed. Allowing workstations to connect USB storage should be prevented, even if they actually connect the drive into the USB slot. Actually, I'm not even sure if Windows allows a way of preventing this.
  - fabulist 11y ago
    I've definitely spoken to people who've told me that, when they plug a USB drive in at their place of work, Windows pops up a dialog for an administrator's password in order to mount it. I believe this is some sort of group policy, but I'm afraid I only use GNU/Linux.
    - 11y ago