5 ms·

As a sailor in the US Navy, let me quote from the Chairman's letter leading the OPM breach report (1), here he is addressing all federal CIOs: The effectivenes

As a sailor in the US Navy, let me quote from the Chairman's letter leading the OPM breach report (1), here he is addressing all federal CIOs: The effectiveness of our country's response depends on your answer to this question: Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans? I guarantee most Federal CIOs never even saw the report, and wouldn't believe the question actually applies to them. The folks at DDS did though (including Matt Cutts), and I'm willing to bet they have it pinned up on the wall. (1) https://oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Breach-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Generation.pdf https://oversight.house.gov/wp-content/uploads/2016/09/The-O...

duncan_bayne 10y ago
> Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans? Perhaps a better question is: can anyone be expected to properly secure data on that scale, against well-resourced malicious actors?
- jdavis703 10y ago
  Has Google ever suffered a breach on this scale? Having worked in IT in the government vs. the private sector, it really seems as though government could care less about security.
  - eric-hu 10y ago
    Does operation Aurora count by the Chinese government? It was a big enough deal to Google that they stopped operating a search engine within China's borders. https://en.m.wikipedia.org/wiki/Operation_Aurora https://en.m.wikipedia.org/wiki/Operation_Aurora https://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-to-sensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html https://www.washingtonpost.com/world/national-security/chine... How about when Google's data center links were tapped by the NSA? https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
    - jdavis703 10y ago
      I thought it was mostly IP and a couple of accounts that were taken. Nothing on the scale of millions of records taken? I could be wrong however.
      - barkingcat 10y ago
        It was a pretty serious breach as far as I remember. The assailing party was looking for specific accounts, and got what they were looking for. Just because they didn't take millions of records didn't mean that they didn't have access to them. Google right after the NSA reveal started doubling up on their efforts to use encrypted links between servers within their data centers, leading me to believe that it could have been a lot worse - just get access to some non-critical host, and if the traffic is unencrypted, just hang out with a packet sniffer and just record all traffic passing by. Google is much more vigilant with their security (not that they weren't before, just even more so) - It's better to not underestimate the extent of breaches.
  - Zombieball 10y ago
    When I search my email on haveibeenpwned.com, one of my results is the following: Bitcoin Security Forum Gmail Dump: In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum. Whilst commonly reported as 5M "Gmail passwords", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct, albeit a number of years old. Compromised data: Email addresses, Passwords
  - duncan_bayne 10y ago
    Yes. By the NSA in fact: https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
  - ascotan 10y ago
    Most US companies have security breaches all the time. However, unless a social security number, health information or credit card is accessed there are no real reporting rules. Most companies do not disclose attempted/successful cyberattacks on their networks. Therefore, if google isn't storing large numbers of credit cards, social security numbers of health records they probably will never tell you wether or not they had their servers breached.
kmfrk 10y ago
Take the violated trust in the CIO top of the Navy releasing this news on the day before Thanksgiving.
deleted 10y ago
[deleted]
rasz_pl 10y ago
I bet quite a big number of those federal CIOs got their "education" from: "Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research" http://www.washington.edu/research/centers/126 http://www.washington.edu/research/centers/126 http://www.uwb.edu/ciac http://www.uwb.edu/ciac https://www.pce.uw.edu/certificates/information-security-and-risk-management https://www.pce.uw.edu/certificates/information-security-and... Taught by a ~70 year old woman with lit major, MBA, fake IT Phd and zero real IT knowledge https://www.coursera.org/instructor/~115 https://www.coursera.org/instructor/~115 I took three classes wasting my time listening to >50 year old industry veterans(LAX airport CISO boasting how he doesnt know _anything_ about computers etc) tell me CIO role is to get a piece of paper stating you delegated responsibility and obey all the federal/industry pat on the back standards (PCI, HIPAA, SOX).

duncan_bayne 10y ago

> Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans? Perhaps a better question is: can anyone be expected to properly secure data on that scale, against well-resourced malicious actors?

jdavis703 10y ago
Has Google ever suffered a breach on this scale? Having worked in IT in the government vs. the private sector, it really seems as though government could care less about security.
- eric-hu 10y ago
  Does operation Aurora count by the Chinese government? It was a big enough deal to Google that they stopped operating a search engine within China's borders. https://en.m.wikipedia.org/wiki/Operation_Aurora https://en.m.wikipedia.org/wiki/Operation_Aurora https://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-to-sensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html https://www.washingtonpost.com/world/national-security/chine... How about when Google's data center links were tapped by the NSA? https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
  - jdavis703 10y ago
    I thought it was mostly IP and a couple of accounts that were taken. Nothing on the scale of millions of records taken? I could be wrong however.
    - barkingcat 10y ago
      It was a pretty serious breach as far as I remember. The assailing party was looking for specific accounts, and got what they were looking for. Just because they didn't take millions of records didn't mean that they didn't have access to them. Google right after the NSA reveal started doubling up on their efforts to use encrypted links between servers within their data centers, leading me to believe that it could have been a lot worse - just get access to some non-critical host, and if the traffic is unencrypted, just hang out with a packet sniffer and just record all traffic passing by. Google is much more vigilant with their security (not that they weren't before, just even more so) - It's better to not underestimate the extent of breaches.
- Zombieball 10y ago
  When I search my email on haveibeenpwned.com, one of my results is the following: Bitcoin Security Forum Gmail Dump: In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum. Whilst commonly reported as 5M "Gmail passwords", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct, albeit a number of years old. Compromised data: Email addresses, Passwords
- duncan_bayne 10y ago
  Yes. By the NSA in fact: https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- ascotan 10y ago
  Most US companies have security breaches all the time. However, unless a social security number, health information or credit card is accessed there are no real reporting rules. Most companies do not disclose attempted/successful cyberattacks on their networks. Therefore, if google isn't storing large numbers of credit cards, social security numbers of health records they probably will never tell you wether or not they had their servers breached.

kmfrk 10y ago

Take the violated trust in the CIO top of the Navy releasing this news on the day before Thanksgiving.

deleted 10y ago

[deleted]

rasz_pl 10y ago

I bet quite a big number of those federal CIOs got their "education" from: "Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research" http://www.washington.edu/research/centers/126 http://www.washington.edu/research/centers/126 http://www.uwb.edu/ciac http://www.uwb.edu/ciac https://www.pce.uw.edu/certificates/information-security-and-risk-management https://www.pce.uw.edu/certificates/information-security-and... Taught by a ~70 year old woman with lit major, MBA, fake IT Phd and zero real IT knowledge https://www.coursera.org/instructor/~115 https://www.coursera.org/instructor/~115 I took three classes wasting my time listening to >50 year old industry veterans(LAX airport CISO boasting how he doesnt know _anything_ about computers etc) tell me CIO role is to get a piece of paper stating you delegated responsibility and obey all the federal/industry pat on the back standards (PCI, HIPAA, SOX).