5 ms·

Part of me was hoping to see some sign of hacktivisim, not for any particular political stance, but because most of us probably agree the federal government has

Part of me was hoping to see some sign of hacktivisim, not for any particular political stance, but because most of us probably agree the federal government has been slacking off as far as security goes. An eye-opening event might be beneficial. "it appeared the domain controller credentials had expired on Monday when offices were closed for the federal Presidents Day holiday" Oh, well that's not nearly as exciting. Still a dismal sign of the state of "cyber security" though.

Arizhel 10y ago
Are they slacking off, or are they simply unable to hire competent people, or perhaps is the bureaucracy such that competent people are unable to do their jobs effectively?
- BinaryIdiot 10y ago
  After contracting in the DoD space for about 6 years I'd say it's, for sure, all 3 plus a mixture of contractors who only make money if they fill all the seats on a contract (so even if you're useless, slowing down the process as long as you're a butt in the seat you're making them money).
- dredmorbius 10y ago
  Or unwilling.
frik 10y ago
What operating system do these agencies use? I thought some hardened Unix, but "domain controller" sounds like Windows network.
- matthewbadeau 10y ago
  They're using Windows. One of their Systems Administrators forgot to update the CRLs for the Domain Controllers, thereby locking out anyone from logging in with their smart card. This is not really a new thing and has happened dozens of times over the past decade and a half to various government agencies.
  - lostboys67 10y ago
    Should they not have to use the card every time ?
- compuguy 10y ago
  Windows servers, and a whole lot of RHEL.
smsm42 10y ago
One would think in 2017 there would be some kind of solution that allows to track all certs in the org and raise alert well before the cert actually expired (of course, nothing can prevent admins from ignoring the alerts). But given how many cert screwups happen around, looks like it's not happening. Maybe somebody should create a startup doing this? ;)
- linkregister 10y ago
  I think ScaleFT attempts to do this, but only for linux servers.
  - russell_h 10y ago
    ScaleFT founder here. We're actually more focused on issuing certs to authenticate SSH and RDP clients, similar to what Google, Facebook, etc do. We keep track of the host keys for those services, and use them for key pinning, but we don't look for other X.509 certs on servers where our agent is installed.
- rvanlaar 10y ago
  I'm working a saas platform which does that. Till now a lot of techies I interviewed say they don't need such a service. Would you have use for it?
- kefka 10y ago
  Yeah. It's called Acmetool, LetsEncrypt, Cron, and Nagios. Problem solved. Free certs, automated, cronned, and externally monitored. What else do you need? Oh thats right. The feds forbid LE. Alright boys and girls, go back to your $499 Comodo certs.
  - discreditable 10y ago
    Except DHS's issues relate to certificates in a Windows environment, where Let's Encrypt does not have very good support. On top of that, I'd imagine their Active Directory domain controllers are not in the public DNS and they don't want them to be.

Arizhel 10y ago

Are they slacking off, or are they simply unable to hire competent people, or perhaps is the bureaucracy such that competent people are unable to do their jobs effectively?

BinaryIdiot 10y ago
After contracting in the DoD space for about 6 years I'd say it's, for sure, all 3 plus a mixture of contractors who only make money if they fill all the seats on a contract (so even if you're useless, slowing down the process as long as you're a butt in the seat you're making them money).
dredmorbius 10y ago
Or unwilling.

frik 10y ago

What operating system do these agencies use? I thought some hardened Unix, but "domain controller" sounds like Windows network.

matthewbadeau 10y ago
They're using Windows. One of their Systems Administrators forgot to update the CRLs for the Domain Controllers, thereby locking out anyone from logging in with their smart card. This is not really a new thing and has happened dozens of times over the past decade and a half to various government agencies.
- lostboys67 10y ago
  Should they not have to use the card every time ?
compuguy 10y ago
Windows servers, and a whole lot of RHEL.

smsm42 10y ago

One would think in 2017 there would be some kind of solution that allows to track all certs in the org and raise alert well before the cert actually expired (of course, nothing can prevent admins from ignoring the alerts). But given how many cert screwups happen around, looks like it's not happening. Maybe somebody should create a startup doing this? ;)

linkregister 10y ago
I think ScaleFT attempts to do this, but only for linux servers.
- russell_h 10y ago
  ScaleFT founder here. We're actually more focused on issuing certs to authenticate SSH and RDP clients, similar to what Google, Facebook, etc do. We keep track of the host keys for those services, and use them for key pinning, but we don't look for other X.509 certs on servers where our agent is installed.
rvanlaar 10y ago
I'm working a saas platform which does that. Till now a lot of techies I interviewed say they don't need such a service. Would you have use for it?
kefka 10y ago
Yeah. It's called Acmetool, LetsEncrypt, Cron, and Nagios. Problem solved. Free certs, automated, cronned, and externally monitored. What else do you need? Oh thats right. The feds forbid LE. Alright boys and girls, go back to your $499 Comodo certs.
- discreditable 10y ago
  Except DHS's issues relate to certificates in a Windows environment, where Let's Encrypt does not have very good support. On top of that, I'd imagine their Active Directory domain controllers are not in the public DNS and they don't want them to be.