4 ms·

> The issue is they should be sounding the alarm on whatever broad class of system vulnerabilities they find. Sounds like the IAD mission. Examples: - https:/

> The issue is they should be sounding the alarm on whatever broad class of system vulnerabilities they find. Sounds like the IAD mission. Examples: - https://github.com/iadgov/Pass-the-Hash-Guidance/blob/master/README.md https://github.com/iadgov/Pass-the-Hash-Guidance/blob/master... - https://www.iad.gov/iad/library/reports/nsa-methodology-for-adversary-obstruction.cfm https://www.iad.gov/iad/library/reports/nsa-methodology-for-... I mention that first one especially because Pas-The-Hash was a major reason the most recent ransomware outbreak was able to get onto already-patched machines.

joe_the_user 9y ago
My gawd, Firefox is telling the iad's security certificate is broken. Now if there was ever a sign the world is going to heck, that would be it.
- tripzilch 9y ago
  on this page they try to explain: https://www.nsa.gov/what-we-do/information-assurance/ https://www.nsa.gov/what-we-do/information-assurance/ > Note: The IAD.Gov website uses TLS 1.2, supported by a Department of Defense (DoD) PKI certificate, to ensure confidentiality and integrity for all users. IAD.Gov website users will need to have the current DoD Root and Intermediate Certificate Authorities (CA) loaded into their browsers to avoid receiving untrusted website notifications. I mean it still doesn't make sense ... Where it says "for all users" it should say "for those who have this certificate installed" because that's what the warning is about. And "to avoid receiving untrusted website notifications" should read "for a more secure connection" because, you know, what's the goal here, really? :)