4 ms·
> It seems NSA has spent all its budget on cool hacking tools and programs From the report: On March 20, 2014, US-CERT notified OPM that a third party had repo
by linkregister 10y ago
> It seems NSA has spent all its budget on cool hacking tools and programs
From the report: On March 20, 2014, US-CERT notified OPM that a third party had reported data exfiltration from the OPM's network.
I think it's likely it was NSA that made the notification. Maybe not. Either way, what further could NSA have done about it? The NSA can't make another federal agency improve its computer security. At best it can perform audits: which it appears to have done; OPM had the lowest security posture of any agency.
Should the NSA have prevented the exfiltration? How would that work? Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? Should the NSA have authority over civilian government agencies? What about hacking and wiping the intruders' endpoints? Sounds like an act of war to me, if those endpoints are on Chinese soil.
I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.
- rdtsc 10y ago> The NSA can't make another federal agency improve its computer security. Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes. > Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? To the federal agencies. Cyber defence doesn't work with current bloated beaurocracy. Nobody seems to be in charge. > I doubt the vast majority of HN'ers want an increase in NSA's authority or scope. I don't know. I would rather them spend more time defending, wouldn't mind expanding their power and diverting more budget towards that.
- BoringCode 10y ago> Nobody seems to be in charge. That's indeed the problem. There was a strong push for a while to put NSA in charge of civilian infosec infrastructure. But Congress didn't really want to put a combat support agency in that role. So DHS is technically in charge of that. But we still have the majority of federal agencies stuck fending for themselves when it comes to securing their networks. Without stronger action from Congress, this may never change.
- Godel_unicode 10y ago> Without stronger action from Congress, this may never change. You should go read the cybersecurity act passed in December of 2015, and realize that DHS is now authorized to force agencies to use it's security and offerings.
- ethbro 10y agoBecause when I think of technical sophistication, I think of DHS.
- BoringCode 10y agoExactly, they simply have never had the institutional knowledge required to secure government networks.
- linkregister 10y agoTheir hostile attitude towards computer security pay incentives practically guarantees nobody will jump ship from IOC or TAO. This problem will likely only be resolved by a big media stink.
- atdt 10y ago> The NSA can't make another federal agency improve its computer security. Maybe not directly. But the NSA could play a much more positive role in information security generally by moving out of the shadows and making more of its research public. The expertise that the NSA has acquired in securing information needs to be widely disseminated to work its way into engineering curricula and praxis, and that won't happen as long as the NSA communicates by whispering.
- linkregister 10y agoYes, maybe they should release a kernel security scheme for Linux that incorporates some lessons learned. Maybe they could call it SELinux.
- atdt 10y agoI mentioned SELinux in a previous comment along the same vein.