3 ms·

What the hell are these people doing over there? The NSA really needs a "security section" that actively monitors the usage of resources of its employees. That

What the hell are these people doing over there? The NSA really needs a "security section" that actively monitors the usage of resources of its employees. That someone could be siphoning terabytes of classified information over the span of decades is just beyond comprehension.

OscarCunningham 10y ago
They need an NSASA.
pg_is_a_butt 10y ago
not trusting themselves creates a legal action whereby those being spied on could argue the congressional actions did not use trusted actors and are thus invalid. you're all idiots.
x1798DE 10y ago
> That someone could be siphoning terabytes of classified information over the span of decades is just beyond comprehension. I don't know how ridiculous this is. Security is an ever-evolving field, and a lot of these stringent controls weren't necessarily in place decades ago - for example, what fraction of places were banning USB flash drives even 10 years ago? The NSA isn't superhuman, and security is hard. I have no love for the agency, but it's not like only complete morons are susceptible to deep insiders exfiltrating data over the course of decades.
- ythl 10y ago
  > and security is hard. Security experts act like it's very trivial and basic to get a fully secure shop up and running if we simply do everything they say. When something fails, the security expert gets fired, and a new one comes on board who will inevitably call the old one "incompetent" and claim that super basic and trivial things were not being followed. Repeat ad infinitum. Some organizations/companies are more vulnerable than others, but I have yet to see one that cannot be compromised by a determined/patient adversary.
  - oldmanjay 10y ago
    When a rebuttal starts with a strawman, what are the odds it's going to improve from that point?
- L_226 10y ago
  I have firsthand knowledge that a certain Australian three letter agency was filling USB ports for non-cleared staff with silicone gel, more than 10 years ago.
scarmig 10y ago
I'm sure they do have it, as well as systems to prevent exfiltration of data. Clearly they're not working as well as we'd hope, but they're not idiots over there.
- hackinthebochs 10y ago
  They do seem to be idiots regarding their own internal security. That's the only explanation I can think of. For an organization that is on the forefront of offensive cyberwarefare, they could have been on the forefront of internal security as well. But they aren't.
  - grandalf 10y ago
    I wonder if there is social pressure exerted by everyone to assume that someone who has made it through the vetting process is low risk... Imagine a group of clergy members, how likely is it that they'd want part of their group dynamic to be defending themselves against suspicion of atheism or doubt? It would seem that the identity aspect of feeling like one was on the defensive might create a psychological blind spot where everyone was pleased/relieved not to have to constantly prove his/her loyalty, thus establishing an implicit trustworthiness rather than an explicit one that would be psychologically challenging. Imagine showing up at work every day and someone reviewing your code with the suspicion that you might have intended to harm the business... regardless of one's level of competence this would be unpleasant, and humans avoid unpleasant things. I don't have security clearance of any expertise with it, just musing about it.
    - hammock 10y ago
      Counterpoint: Every spy novel ever says "trust nobody;" that sentiment seems like a pretty engrained part of spook culture already.
fredgrott 10y ago
I think back to one of Zed Shaw's talks on what ACL is, its somewhat hard to get perfect ACL, Zed's video: https://vimeo.com/2723800 https://vimeo.com/2723800
RandomOpinion 10y ago
> The NSA really needs a "security section" that actively monitors the usage of resources of its employees And then what? What happens when somebody in the security section decides to do something nefarious? A security section for the security section? An infinite regress of watchers watching watchers? At the bottom of it all, you have to trust _someone_ eventually. And nobody yet has figured out how to guarantee that a person is or remains trustworthy.

OscarCunningham 10y ago

They need an NSASA.

pg_is_a_butt 10y ago

not trusting themselves creates a legal action whereby those being spied on could argue the congressional actions did not use trusted actors and are thus invalid. you're all idiots.

x1798DE 10y ago

> That someone could be siphoning terabytes of classified information over the span of decades is just beyond comprehension. I don't know how ridiculous this is. Security is an ever-evolving field, and a lot of these stringent controls weren't necessarily in place decades ago - for example, what fraction of places were banning USB flash drives even 10 years ago? The NSA isn't superhuman, and security is hard. I have no love for the agency, but it's not like only complete morons are susceptible to deep insiders exfiltrating data over the course of decades.

ythl 10y ago
> and security is hard. Security experts act like it's very trivial and basic to get a fully secure shop up and running if we simply do everything they say. When something fails, the security expert gets fired, and a new one comes on board who will inevitably call the old one "incompetent" and claim that super basic and trivial things were not being followed. Repeat ad infinitum. Some organizations/companies are more vulnerable than others, but I have yet to see one that cannot be compromised by a determined/patient adversary.
- oldmanjay 10y ago
  When a rebuttal starts with a strawman, what are the odds it's going to improve from that point?
L_226 10y ago
I have firsthand knowledge that a certain Australian three letter agency was filling USB ports for non-cleared staff with silicone gel, more than 10 years ago.

scarmig 10y ago

I'm sure they do have it, as well as systems to prevent exfiltration of data. Clearly they're not working as well as we'd hope, but they're not idiots over there.

hackinthebochs 10y ago
They do seem to be idiots regarding their own internal security. That's the only explanation I can think of. For an organization that is on the forefront of offensive cyberwarefare, they could have been on the forefront of internal security as well. But they aren't.
- grandalf 10y ago
  I wonder if there is social pressure exerted by everyone to assume that someone who has made it through the vetting process is low risk... Imagine a group of clergy members, how likely is it that they'd want part of their group dynamic to be defending themselves against suspicion of atheism or doubt? It would seem that the identity aspect of feeling like one was on the defensive might create a psychological blind spot where everyone was pleased/relieved not to have to constantly prove his/her loyalty, thus establishing an implicit trustworthiness rather than an explicit one that would be psychologically challenging. Imagine showing up at work every day and someone reviewing your code with the suspicion that you might have intended to harm the business... regardless of one's level of competence this would be unpleasant, and humans avoid unpleasant things. I don't have security clearance of any expertise with it, just musing about it.
  - hammock 10y ago
    Counterpoint: Every spy novel ever says "trust nobody;" that sentiment seems like a pretty engrained part of spook culture already.

fredgrott 10y ago

I think back to one of Zed Shaw's talks on what ACL is, its somewhat hard to get perfect ACL, Zed's video: https://vimeo.com/2723800 https://vimeo.com/2723800

RandomOpinion 10y ago

> The NSA really needs a "security section" that actively monitors the usage of resources of its employees And then what? What happens when somebody in the security section decides to do something nefarious? A security section for the security section? An infinite regress of watchers watching watchers? At the bottom of it all, you have to trust _someone_ eventually. And nobody yet has figured out how to guarantee that a person is or remains trustworthy.