3 ms·

The article uses the Russia election situation as an example, but one doesn't need a clearance -- or any classified information, for that matter -- in order to

The article uses the Russia election situation as an example, but one doesn't need a clearance -- or any classified information, for that matter -- in order to prevent a large number of these recent "hacks" or, at the least, make the attackers work much harder to be successful. When companies can't even be bothered to install security updates on public-facing applications or web sites (cf. Equifax), is anyone really surprised that they're being broken into and having all their private data stolen? In my experience, these public/private information sharing "partnerships" are heavily weighted in the government's favor. That is, the private companies share their detailed, specific data with the government but the information that the government shares with the private companies is laughable. When I was on the "receiving end", it was typically bulletins and notifications that were vague and lacked enough detail to actually be useful or actionable (and even those were limited with regard to distribution). It's been a few years since I was involved with that stuff so perhaps things have changed. I would be really surprised if they have, though. In addition, it seems to me that this is a good way for the government to get these tech companies to "go along with" some of their "requests". Oh, you have some private data that the government would like to have access to but you don't want to turn it over? Or, the government has a "black box" they want you to install in your network but you don't want to? Boy, it sure would be a shame if your employees' security clearances got denied, wouldn't it?

nataz 9y ago
In order to conduct an appropriate vulnerability assessment, you need to be able to classify your adversaries capabilities and motivations. That's hard to do with out some kind of privileged information. Only then can you get down to the stuff that most people think of when they talk about "security" - e.g. the risk mitigation and countermeasures. Edit - added text To continue the point, the Russia example is important. Individual commercial ventures are not set up to handle state level attacks. Any company that thinks they are is going to be in for a rude awakening. Worse, companies like Google and Facebook are going to be vulnerable by their very design and function. Sure, the credit bureau hacks are bad, but truthfully that's only the tip of the iceberg as far as consequences. I'm not discounting your point that you may have found government cooperation unhelpful, but I will say if you are one of these large companies that could be the target of a state level actor, you are going to want a state level actor on your side. And in the US that means you are going to have to have employees with access, which means you are going to need to have a government sponsor for clearances.

nataz 9y ago

In order to conduct an appropriate vulnerability assessment, you need to be able to classify your adversaries capabilities and motivations. That's hard to do with out some kind of privileged information. Only then can you get down to the stuff that most people think of when they talk about "security" - e.g. the risk mitigation and countermeasures. Edit - added text To continue the point, the Russia example is important. Individual commercial ventures are not set up to handle state level attacks. Any company that thinks they are is going to be in for a rude awakening. Worse, companies like Google and Facebook are going to be vulnerable by their very design and function. Sure, the credit bureau hacks are bad, but truthfully that's only the tip of the iceberg as far as consequences. I'm not discounting your point that you may have found government cooperation unhelpful, but I will say if you are one of these large companies that could be the target of a state level actor, you are going to want a state level actor on your side. And in the US that means you are going to have to have employees with access, which means you are going to need to have a government sponsor for clearances.