3 ms·

I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There

I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators responsible for managing the 13 systems in our sample maintain a separate inventory spreadsheet of their systems from which they periodically update the information manually in the ITSDB. One system administrator told us he does not regularly enter new devices into the ITSDB as required because the database’s updating function sometimes does not work and he later forgets to enter the asset information. Other good notes Lack of training: > NIST requires that organizations provide security-related technical training specifically tailored for their assigned duties... As of April 2019, JPL did not have a role-based training program, provide additional IT security training for system administrators, nor fund their IT security certifications. Refusing to let Department of Homeland Security (DHS) complete a thorough post-intrusion assessment: >However, according to NASA SOC personnel, JPL was concerned with inadvertent access to its corporate network and feared disruption of mission operations. In addition, JPL was unfamiliar with DHS’s standard engagement procedures. Collectively, resolution of these issues resulted in DHS being unable to perform scans of the entire network until 4 months after the incident was detected. [1]: https://oig.nasa.gov/docs/IG-19-022.pdf https://oig.nasa.gov/docs/IG-19-022.pdf

Markovweaklink 7y ago
Thank you Samuel Adams
hcnews 7y ago
This is expected. Any manual work will have errors and lots of them. If you want a system to be robust, you have to engineer it in a way it stops working if one of the prerequisites aren't satisfied. It's costly but there's no way around it afaict. In this case, you wouldn't allow a device to access any information on the network without a proper certificate. The public systems need to learn from private companies in this regard.
- rossjudson 7y ago
  +100 here. Issue devices with hardware certs, and allow only cert-bearing devices on the network, period. Now you have precise and revocable control over what's on the network. Well, as long as you ensure SSH doesn't mess it up. ;) Combine that with security keys, and you're in a decent spot.
jeffmould 7y ago
Back in the early 90s I had a summer internship for a contractor at Goddard Space Flight Center. My job for the entire summer was to track down and inventory a list of 1000s of devices across the entire campus. At the time they were building a tracking database for all the devices on the campus. The printout I was handed on my first day had not been updated in several years. It basically contained a tracking ID, what building/room the device was supposedly located, and who it was assigned to. I spent every day walking building to building, room to room, interviewing employees, trying to track down devices. I never finished updating the list simply because I was never able to track down over half the devices. Outside of a few secure areas I did not have access to, I pretty much turned the campus upside down looking for devices. I can only imagine where all those devices ended up.
- cbsks 7y ago
  I interned at Goddard in 2006 and my PI had a rogue wireless access point for his interns to use. Apparently it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying. I remember some of my fellow interns complaining about having to work offline for the first month of their 10 week internship.
  - ryandrake 7y ago
    Another fellow Goddard intern checking in! But mine was back before anyone worried about “working offline” vs. “working online”. We just wrote our code—without needing to browse HN and StackOverflow every 10 minutes :-) We still had plenty of other non-Internet related red tape, bureaucracy, and other forms of Work Prevention to overcome and avoid though.
  - dvtrn 7y ago
    it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying "When people can't work with you, they will look for ways to work around you". - former IT boss of mine. Every time.
    - 7y ago
vinay_ys 7y ago
Most corp IT teams I have encountered used some sort of proprietary system for tracking inventory or other management activities. I wish there were robust open-source software stacks available to manage corp IT stuff. Also, I find it weird to let 3rd-party closed source network appliances (security scanners etc) to be simply plugged into your network and wait for them to produce reports.
- rossjudson 7y ago
  There are three perspectives on inventory: What you want to have, what you think you have, and what you actually have. Reconcile :)
deleted 7y ago
[deleted]
peterwwillis 7y ago
Nobody ever manually maintains inventory correctly. That's why automated systems are supposed to scan networks and inform the inventory of what is actually there, versus what is "supposed to be there". Lack of training doesn't matter at all. This is just a mechanism to blame people, it doesn't ensure security at all. And of course JPL doesn't have a mechanism to allow DHS to scan its entire network. Nobody has a big red button that says "please provide a back door in every single security policy we have for one party to do whatever they want". This whole report is bullshit designed to place blame. Why is anyone taking this seriously?
- jacquesm 7y ago
  > inform the inventory of what is actually there This works very well to identify stuff that actually answers and will yield devices that are not supposed to be there in the first place but someone planning mischief is not going to place a device that is easily identified like that.

Markovweaklink 7y ago

Thank you Samuel Adams

hcnews 7y ago

This is expected. Any manual work will have errors and lots of them. If you want a system to be robust, you have to engineer it in a way it stops working if one of the prerequisites aren't satisfied. It's costly but there's no way around it afaict. In this case, you wouldn't allow a device to access any information on the network without a proper certificate. The public systems need to learn from private companies in this regard.

rossjudson 7y ago
+100 here. Issue devices with hardware certs, and allow only cert-bearing devices on the network, period. Now you have precise and revocable control over what's on the network. Well, as long as you ensure SSH doesn't mess it up. ;) Combine that with security keys, and you're in a decent spot.

jeffmould 7y ago

Back in the early 90s I had a summer internship for a contractor at Goddard Space Flight Center. My job for the entire summer was to track down and inventory a list of 1000s of devices across the entire campus. At the time they were building a tracking database for all the devices on the campus. The printout I was handed on my first day had not been updated in several years. It basically contained a tracking ID, what building/room the device was supposedly located, and who it was assigned to. I spent every day walking building to building, room to room, interviewing employees, trying to track down devices. I never finished updating the list simply because I was never able to track down over half the devices. Outside of a few secure areas I did not have access to, I pretty much turned the campus upside down looking for devices. I can only imagine where all those devices ended up.

cbsks 7y ago
I interned at Goddard in 2006 and my PI had a rogue wireless access point for his interns to use. Apparently it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying. I remember some of my fellow interns complaining about having to work offline for the first month of their 10 week internship.
- ryandrake 7y ago
  Another fellow Goddard intern checking in! But mine was back before anyone worried about “working offline” vs. “working online”. We just wrote our code—without needing to browse HN and StackOverflow every 10 minutes :-) We still had plenty of other non-Internet related red tape, bureaucracy, and other forms of Work Prevention to overcome and avoid though.
- dvtrn 7y ago
  it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying "When people can't work with you, they will look for ways to work around you". - former IT boss of mine. Every time.
  - 7y ago

vinay_ys 7y ago

Most corp IT teams I have encountered used some sort of proprietary system for tracking inventory or other management activities. I wish there were robust open-source software stacks available to manage corp IT stuff. Also, I find it weird to let 3rd-party closed source network appliances (security scanners etc) to be simply plugged into your network and wait for them to produce reports.

rossjudson 7y ago
There are three perspectives on inventory: What you want to have, what you think you have, and what you actually have. Reconcile :)

deleted 7y ago

[deleted]

peterwwillis 7y ago

Nobody ever manually maintains inventory correctly. That's why automated systems are supposed to scan networks and inform the inventory of what is actually there, versus what is "supposed to be there". Lack of training doesn't matter at all. This is just a mechanism to blame people, it doesn't ensure security at all. And of course JPL doesn't have a mechanism to allow DHS to scan its entire network. Nobody has a big red button that says "please provide a back door in every single security policy we have for one party to do whatever they want". This whole report is bullshit designed to place blame. Why is anyone taking this seriously?

jacquesm 7y ago
> inform the inventory of what is actually there This works very well to identify stuff that actually answers and will yield devices that are not supposed to be there in the first place but someone planning mischief is not going to place a device that is easily identified like that.