9 ms·

If only we had an agency in charge of protecting and securing these kinds of systems. It seems NSA has spent all its budget on cool hacking tools and programs,

by rdtsc 10y ago

If only we had an agency in charge of protecting and securing these kinds of systems. It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Stolen stuff includes millions of fingerprints. Those are obviously not hashed, so that's just the raw data I imagine. They'll learn lesson to not rely on fingerprints as much. Maybe that's one good thing coming out of it. [+] CIA could still be affected, if for example some people there started at other agencies, or in the military (CIA likes to hire ex-Marines for example).

Godel_unicode 10y ago
> If only we had an agency in charge of protecting and securing these kinds of systems. Firstly, why do you insist in letting OPM off the hook? Secondly, even if we stipulate that OPM isn't at fault and that someone should have stopped this, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us
- rdtsc 10y ago
  > why do you insist in letting OPM off the hook? I am not. It failed massively. Letting it do what it kept doing before is not going to work. We have hard evidence of its failure. There is no point mentioning it, it is obvious. > , you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us So where was US-CERT all this time? It was active since 2003. It had more than a decade to ramp up and get up to speed. Why where all the electronic SF-86 forms stolen? You'd think out of all the places, they would protect, that would be close to the top. > before blindly blaming NSA Because they are probably the only ones that have the smarts to do it? Also isn't that their mission as well. https://www.nsa.gov/what-we-do/ https://www.nsa.gov/what-we-do/ . Second line is "Defends vital networks". OPM files with detailed and personal details on millions of current and past government workers who have clearance is pretty vital one would think.
deleted 10y ago
[deleted]
BoringCode 10y ago
One of NSA's primary missions is information assurance. I'm sure they have blue teams. But their mandate is pretty limited in regards to what they can do with civilian infrastructure.
- rdtsc 10y ago
  Technically DHS should do it. I don't see DHS having the expertise and brainpower for it.
linkregister 10y ago
> It seems NSA has spent all its budget on cool hacking tools and programs From the report: On March 20, 2014, US-CERT notified OPM that a third party had reported data exfiltration from the OPM's network. I think it's likely it was NSA that made the notification. Maybe not. Either way, what further could NSA have done about it? The NSA can't make another federal agency improve its computer security. At best it can perform audits: which it appears to have done; OPM had the lowest security posture of any agency. Should the NSA have prevented the exfiltration? How would that work? Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? Should the NSA have authority over civilian government agencies? What about hacking and wiping the intruders' endpoints? Sounds like an act of war to me, if those endpoints are on Chinese soil. I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.
- rdtsc 10y ago
  > The NSA can't make another federal agency improve its computer security. Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes. > Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? To the federal agencies. Cyber defence doesn't work with current bloated beaurocracy. Nobody seems to be in charge. > I doubt the vast majority of HN'ers want an increase in NSA's authority or scope. I don't know. I would rather them spend more time defending, wouldn't mind expanding their power and diverting more budget towards that.
  - BoringCode 10y ago
    > Nobody seems to be in charge. That's indeed the problem. There was a strong push for a while to put NSA in charge of civilian infosec infrastructure. But Congress didn't really want to put a combat support agency in that role. So DHS is technically in charge of that. But we still have the majority of federal agencies stuck fending for themselves when it comes to securing their networks. Without stronger action from Congress, this may never change.
deleted 10y ago
[deleted]
missed_out 10y ago
After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!
- rewrew 10y ago
  This kind of stupidity is why I think I can never take a gov't job. I don't think I'd last a week. Sorry you had to put up with it.
  - ridgeguy 10y ago
    Any reason why you think this is unique to government employment? My experience in both gov't and private sector work suggests it's ordinary human nature.
  - colinbartlett 10y ago
    What about things the US Digital Service or 18F? The image they present is that those teams are different and outside the standard government bureaucracy. I'm skeptical.
    - zacharycohn 10y ago
      Employee of 18F here, speaking unofficially. We care a lot about security - both from the technical side and from the policy compliance side!
      - Godel_unicode 10y ago
        > We care a lot about security Which is doubtless why you ignore the TIC guidelines, etc
      - rdtsc 10y ago
        How was recruitment?. Someone I know tried to get a got job there, got stuck in the queue forever. Was told to wait months. So eventually gave up and took another job.
throwawayReply 10y ago
241 pages and not one mention of NIST or FIPS.
- noahkunin 10y ago
  There's actual several mentions of NIST, ATOs, and FISMA, all of which implicitly cover FIPS by reference. #acronymheatdeath
unimpressive 10y ago
>It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Damn right. This is one of the aspects of the Snowden leaks that was underplayed. The NSA seems to think that the best defense is a good offense, and maybe they have good reasons for that but from the outside it seems like they're just overly affected with wanting to feel 'l33t'. https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0e5 https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0...
- superuser2 10y ago
  Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof." Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.
  - atdt 10y ago
    Re-orienting the NSA's mission to focus on improving security through public research and technology transfer (like SELinux) is the most viable option for stopping the current arms race. There seem to be a shortage of people at the NSA who have the visionary power to imagine a future in which computing is secure. Which is a shame, because it is a future we can realize; the building blocks are here.
- Kalium 10y ago
  As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together. In terms of defense, they've got a severe case of Congress-induces toothlessness.
batbomb 10y ago
NIST sets the standards (FIPS). Most programs for security guidelines seem to be descendants and ongoing implementations of HSPD-12. I believe the Office of the Inspector General would be in charge of auditing in some cases, but it's usually up to each individual agency.
kevin_thibedeau 10y ago
> Yet the all SF-86 forms Not quite all of them. OPM doesn't seem to keep track of any paper SF-86s that were phased out in favor of the first web site iteration around 2001. Those earlier records may be safe. The image PDF isn't searchable so I couldn't confirm this.
- rdtsc 10y ago
  Yap, 2000 or sounds about right.
jonnybgood 10y ago
Correct me if I'm wrong, but I thought NSA is only in charge of protecting classified systems. OPM data wasn't in a classified system.
treebeard901 10y ago
At least you can change your password. Good luck getting new fingerprints.

by rdtsc 10y ago

Godel_unicode 10y ago

> If only we had an agency in charge of protecting and securing these kinds of systems. Firstly, why do you insist in letting OPM off the hook? Secondly, even if we stipulate that OPM isn't at fault and that someone should have stopped this, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us

rdtsc 10y ago
> why do you insist in letting OPM off the hook? I am not. It failed massively. Letting it do what it kept doing before is not going to work. We have hard evidence of its failure. There is no point mentioning it, it is obvious. > , you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us So where was US-CERT all this time? It was active since 2003. It had more than a decade to ramp up and get up to speed. Why where all the electronic SF-86 forms stolen? You'd think out of all the places, they would protect, that would be close to the top. > before blindly blaming NSA Because they are probably the only ones that have the smarts to do it? Also isn't that their mission as well. https://www.nsa.gov/what-we-do/ https://www.nsa.gov/what-we-do/ . Second line is "Defends vital networks". OPM files with detailed and personal details on millions of current and past government workers who have clearance is pretty vital one would think.

deleted 10y ago

[deleted]

BoringCode 10y ago

One of NSA's primary missions is information assurance. I'm sure they have blue teams. But their mandate is pretty limited in regards to what they can do with civilian infrastructure.

rdtsc 10y ago
Technically DHS should do it. I don't see DHS having the expertise and brainpower for it.

linkregister 10y ago

> It seems NSA has spent all its budget on cool hacking tools and programs From the report: On March 20, 2014, US-CERT notified OPM that a third party had reported data exfiltration from the OPM's network. I think it's likely it was NSA that made the notification. Maybe not. Either way, what further could NSA have done about it? The NSA can't make another federal agency improve its computer security. At best it can perform audits: which it appears to have done; OPM had the lowest security posture of any agency. Should the NSA have prevented the exfiltration? How would that work? Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? Should the NSA have authority over civilian government agencies? What about hacking and wiping the intruders' endpoints? Sounds like an act of war to me, if those endpoints are on Chinese soil. I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.

rdtsc 10y ago
> The NSA can't make another federal agency improve its computer security. Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes. > Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? To the federal agencies. Cyber defence doesn't work with current bloated beaurocracy. Nobody seems to be in charge. > I doubt the vast majority of HN'ers want an increase in NSA's authority or scope. I don't know. I would rather them spend more time defending, wouldn't mind expanding their power and diverting more budget towards that.
- BoringCode 10y ago
  > Nobody seems to be in charge. That's indeed the problem. There was a strong push for a while to put NSA in charge of civilian infosec infrastructure. But Congress didn't really want to put a combat support agency in that role. So DHS is technically in charge of that. But we still have the majority of federal agencies stuck fending for themselves when it comes to securing their networks. Without stronger action from Congress, this may never change.

deleted 10y ago

[deleted]

missed_out 10y ago

After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

rewrew 10y ago
This kind of stupidity is why I think I can never take a gov't job. I don't think I'd last a week. Sorry you had to put up with it.
- ridgeguy 10y ago
  Any reason why you think this is unique to government employment? My experience in both gov't and private sector work suggests it's ordinary human nature.
- colinbartlett 10y ago
  What about things the US Digital Service or 18F? The image they present is that those teams are different and outside the standard government bureaucracy. I'm skeptical.
  - zacharycohn 10y ago
    Employee of 18F here, speaking unofficially. We care a lot about security - both from the technical side and from the policy compliance side!
    - Godel_unicode 10y ago
      > We care a lot about security Which is doubtless why you ignore the TIC guidelines, etc
    - rdtsc 10y ago
      How was recruitment?. Someone I know tried to get a got job there, got stuck in the queue forever. Was told to wait months. So eventually gave up and took another job.

throwawayReply 10y ago

241 pages and not one mention of NIST or FIPS.

noahkunin 10y ago
There's actual several mentions of NIST, ATOs, and FISMA, all of which implicitly cover FIPS by reference. #acronymheatdeath

unimpressive 10y ago

>It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Damn right. This is one of the aspects of the Snowden leaks that was underplayed. The NSA seems to think that the best defense is a good offense, and maybe they have good reasons for that but from the outside it seems like they're just overly affected with wanting to feel 'l33t'. https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0e5 https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0...

superuser2 10y ago
Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof." Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.
- atdt 10y ago
  Re-orienting the NSA's mission to focus on improving security through public research and technology transfer (like SELinux) is the most viable option for stopping the current arms race. There seem to be a shortage of people at the NSA who have the visionary power to imagine a future in which computing is secure. Which is a shame, because it is a future we can realize; the building blocks are here.
Kalium 10y ago
As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together. In terms of defense, they've got a severe case of Congress-induces toothlessness.

batbomb 10y ago

NIST sets the standards (FIPS). Most programs for security guidelines seem to be descendants and ongoing implementations of HSPD-12. I believe the Office of the Inspector General would be in charge of auditing in some cases, but it's usually up to each individual agency.

kevin_thibedeau 10y ago

> Yet the all SF-86 forms Not quite all of them. OPM doesn't seem to keep track of any paper SF-86s that were phased out in favor of the first web site iteration around 2001. Those earlier records may be safe. The image PDF isn't searchable so I couldn't confirm this.

rdtsc 10y ago
Yap, 2000 or sounds about right.

jonnybgood 10y ago

Correct me if I'm wrong, but I thought NSA is only in charge of protecting classified systems. OPM data wasn't in a classified system.

treebeard901 10y ago

At least you can change your password. Good luck getting new fingerprints.