4 ms·

I don't think the laptop was specifically targeted. People generally don't follow the rules and walk around with too much information that isn't secure. They're

I don't think the laptop was specifically targeted. People generally don't follow the rules and walk around with too much information that isn't secure. They're bamboozled with phishing and like to click on rar files that have their FEDEX shipping documents for a package they never sent. Or they have a developer image on their laptop that isn't locked down and download Warez or Torrent and visit Porno sites. Until there are consequences when this kind of thing happens, like people getting fired or severe penalties, I'm afraid it will just continue. It's either some 15 year old kid in Eastern Europe or the Chinese and Russians have some more info to build dossiers on the American Armed Forces.

cm2187 10y ago
Windows 10 "the most secure OS in history" still hides file extensions by default, so that virus.pdf.exe appears as virus.pdf!
- SCHiM 10y ago
  If you're running defaults then you're already negligent. Not because defaults are necessarily bad (secure defaults ftw). But because you can always do better by tailoring your systems to your specific situation.
  - cm2187 10y ago
    My point is rather that I am vigilant enough to check the actual extension of the file when I know it comes from a dodgy source (and to distrust the defaults in the first place). But what about a non technical user to who if the OS says it's a PDF, has the icon of a PDF, then it must be a PDF.
akerro 10y ago
>People generally don't follow the rules and walk around with too much information that isn't secure. 1 : >A NASA inspector general report this year determined 48 NASA laptops and mobile computing devices were lost or stolen between April 2009 and April 2011, many containing sensitive data. http://www.reuters.com/article/us-space-nasa-security-idUSBRE8AE05F20121115 http://www.reuters.com/article/us-space-nasa-security-idUSBR... 2: Personally identifiable information of "at least" 10,000 NASA employees and contractors remains at risk of compromise following last month's theft of an agency laptop, a spokesman told Computerworld via email Thursday. http://www.computerworld.com/article/2493084/security0/nasa-breach-update--stolen-laptop-had-data-on-10-000-users.html http://www.computerworld.com/article/2493084/security0/nasa-... 3: NASA decides to encrypt all their laptops, because PEOPLE STORE SENSITIVE INFORMATION UNENCRYPTED on laptops that they take home. https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12).pdf https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12)....
- beowulf_cluster 10y ago
  Regarding 3: The encryption scheme we put into place probably isn't going to slow down a motivated actor. We have master decryption passphrases that are regularly disseminated among the admins and could foreseeably end up in the wild (if nothing else, it wouldn't be difficult to social engineer). And recently, we've started transitioning to new encryption software. Our implementation of the software prohibits more than one encryption passphrase per machine. So, in order to share machines between employees, organizations have begun sharing the same passphrase across all the organization's machines. Source: HPES employee working on NASA ACES contract

cm2187 10y ago

Windows 10 "the most secure OS in history" still hides file extensions by default, so that virus.pdf.exe appears as virus.pdf!

SCHiM 10y ago
If you're running defaults then you're already negligent. Not because defaults are necessarily bad (secure defaults ftw). But because you can always do better by tailoring your systems to your specific situation.
- cm2187 10y ago
  My point is rather that I am vigilant enough to check the actual extension of the file when I know it comes from a dodgy source (and to distrust the defaults in the first place). But what about a non technical user to who if the OS says it's a PDF, has the icon of a PDF, then it must be a PDF.

akerro 10y ago

>People generally don't follow the rules and walk around with too much information that isn't secure. 1 : >A NASA inspector general report this year determined 48 NASA laptops and mobile computing devices were lost or stolen between April 2009 and April 2011, many containing sensitive data. http://www.reuters.com/article/us-space-nasa-security-idUSBRE8AE05F20121115 http://www.reuters.com/article/us-space-nasa-security-idUSBR... 2: Personally identifiable information of "at least" 10,000 NASA employees and contractors remains at risk of compromise following last month's theft of an agency laptop, a spokesman told Computerworld via email Thursday. http://www.computerworld.com/article/2493084/security0/nasa-breach-update--stolen-laptop-had-data-on-10-000-users.html http://www.computerworld.com/article/2493084/security0/nasa-... 3: NASA decides to encrypt all their laptops, because PEOPLE STORE SENSITIVE INFORMATION UNENCRYPTED on laptops that they take home. https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12).pdf https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12)....

beowulf_cluster 10y ago
Regarding 3: The encryption scheme we put into place probably isn't going to slow down a motivated actor. We have master decryption passphrases that are regularly disseminated among the admins and could foreseeably end up in the wild (if nothing else, it wouldn't be difficult to social engineer). And recently, we've started transitioning to new encryption software. Our implementation of the software prohibits more than one encryption passphrase per machine. So, in order to share machines between employees, organizations have begun sharing the same passphrase across all the organization's machines. Source: HPES employee working on NASA ACES contract