3 ms·

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations

by jascii 7y ago

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations seem pretty basic best practices stuff. In my experience, research labs tend to be creative spaces with a focus on collaboration and information security is not foremost on peoples mind. I guess that will have to change.

jascii 7y ago
It's kind of interesting to read in the report how the JPL was not compliant with several NIST guidelines (800-53 and others) what it does not mention is how this situation persisted despite the required audits for federal organizations..
- molecule 7y ago
  There’s a significant distinction between federal organizations and federally-funded organizations— JPL is the latter.
ozim 7y ago
Recommendations suck, they just write couple of times that administrators should update "Information Technology Security Database" and that they failed to do that. That should be automated. They have all those "CISO", "SAISO", "OCIO" and "CIO" but there is no one who knows how to setup automated nmap scan for a network range? Then trigger someone and add it to some inventory like "hey there is some new raspberry pi in network" should you maybe check it?
- Avamander 7y ago
  It's not like you can easily detect a rogue RPi with just nmap. It's trivial not to respond to anything sent to you. You have to start looking at ARP, but that's not iron-clad either.
  - emilburzo 7y ago
    arpwatch worked pretty flawlessly when I needed something like that https://en.wikipedia.org/wiki/Arpwatch https://en.wikipedia.org/wiki/Arpwatch
  - ozim 7y ago
    But that is not the point, point is they make admins do stuff manually. Getting kids to brush teeth every morning and evening is hard, getting bunch of IT admins to do something, what seems pointless, every day is close to impossible. Setting up something that scans network every day is trivial by comparison.

by jascii 7y ago

jascii 7y ago

It's kind of interesting to read in the report how the JPL was not compliant with several NIST guidelines (800-53 and others) what it does not mention is how this situation persisted despite the required audits for federal organizations..

molecule 7y ago
There’s a significant distinction between federal organizations and federally-funded organizations— JPL is the latter.

ozim 7y ago

Recommendations suck, they just write couple of times that administrators should update "Information Technology Security Database" and that they failed to do that. That should be automated. They have all those "CISO", "SAISO", "OCIO" and "CIO" but there is no one who knows how to setup automated nmap scan for a network range? Then trigger someone and add it to some inventory like "hey there is some new raspberry pi in network" should you maybe check it?

Avamander 7y ago
It's not like you can easily detect a rogue RPi with just nmap. It's trivial not to respond to anything sent to you. You have to start looking at ARP, but that's not iron-clad either.
- emilburzo 7y ago
  arpwatch worked pretty flawlessly when I needed something like that https://en.wikipedia.org/wiki/Arpwatch https://en.wikipedia.org/wiki/Arpwatch
- ozim 7y ago
  But that is not the point, point is they make admins do stuff manually. Getting kids to brush teeth every morning and evening is hard, getting bunch of IT admins to do something, what seems pointless, every day is close to impossible. Setting up something that scans network every day is trivial by comparison.