5 ms·

>It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (e

>It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Damn right. This is one of the aspects of the Snowden leaks that was underplayed. The NSA seems to think that the best defense is a good offense, and maybe they have good reasons for that but from the outside it seems like they're just overly affected with wanting to feel 'l33t'. https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0e5 https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0...

superuser2 10y ago
Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof." Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.
- atdt 10y ago
  Re-orienting the NSA's mission to focus on improving security through public research and technology transfer (like SELinux) is the most viable option for stopping the current arms race. There seem to be a shortage of people at the NSA who have the visionary power to imagine a future in which computing is secure. Which is a shame, because it is a future we can realize; the building blocks are here.
Kalium 10y ago
As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together. In terms of defense, they've got a severe case of Congress-induces toothlessness.
- BoringCode 10y ago
  Here's the kicker, technically NSA can't even do offense (attack). That's what US Cybercom is for. The NSA primary missions are SIGNIT and IA as a combat support agency. So they can gather information on foreign adversaries (and defend DoD networks), but they don't have the mandate to actually perform cyberwarfare. Or for that matter defend civilian networks against attack.
  - Kalium 10y ago
    NSA and USCC is a distinction without a difference. They've even got the same head honcho.
    - BoringCode 10y ago
      Both organizations focus on similar concepts (after all exploitation and attack are two sides of the same coin). But there is a legal distinction which is important. NSA legally cannot do all that CYBERCOM can do.
      - Kalium 10y ago
        You're absolutely correct, it's legally a massive difference. In practice, they're more or less the same people groups of the same people. So I tend to view the distinction between the two as something of a legal fiction.

superuser2 10y ago

Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof." Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.

atdt 10y ago
Re-orienting the NSA's mission to focus on improving security through public research and technology transfer (like SELinux) is the most viable option for stopping the current arms race. There seem to be a shortage of people at the NSA who have the visionary power to imagine a future in which computing is secure. Which is a shame, because it is a future we can realize; the building blocks are here.

Kalium 10y ago

As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together. In terms of defense, they've got a severe case of Congress-induces toothlessness.

BoringCode 10y ago
Here's the kicker, technically NSA can't even do offense (attack). That's what US Cybercom is for. The NSA primary missions are SIGNIT and IA as a combat support agency. So they can gather information on foreign adversaries (and defend DoD networks), but they don't have the mandate to actually perform cyberwarfare. Or for that matter defend civilian networks against attack.
- Kalium 10y ago
  NSA and USCC is a distinction without a difference. They've even got the same head honcho.
  - BoringCode 10y ago
    Both organizations focus on similar concepts (after all exploitation and attack are two sides of the same coin). But there is a legal distinction which is important. NSA legally cannot do all that CYBERCOM can do.
    - Kalium 10y ago
      You're absolutely correct, it's legally a massive difference. In practice, they're more or less the same people groups of the same people. So I tend to view the distinction between the two as something of a legal fiction.