3 ms·
Why would an American government database ever need access from outside the US? Under what circumstances couldn't a simple IP rule prevent such a silly transfer
by mindfulplay 7y ago
Why would an American government database ever need access from outside the US? Under what circumstances couldn't a simple IP rule prevent such a silly transfer of data?
I could never wrap my head around government databases (that need to be secured) using using AWS or other cloud with default security.
- rubidium 7y agoNot strongly disagreeing, but some ideas: Embassies, CIA, etc...
- nine_k 7y agoCost-saving. Governmental contracting is a lowest-bidder game, and budgets are variously limited.
- celticninja 7y agoYes but security requirements are usually inckuded
- nl 7y agoI'm not a US citizen but have lots of US based servers. In-fact it is cheaper to get US based IPs than anywhere else.
- chrisseaton 7y ago> Why would an American government database ever need access from outside the US? The US collaborates with allies and they share resources and intelligence data.
- caseysoftware 7y agoIn the case of the OPM database, it was outsourced to an outsourcer to an outsourcer who was administering the data from China. What's not discussed in this article is that as administrators, they had full read/write access to the system so we must assume that it is tainted. While this article cites 2014, I believe investigators concluded the attackers/admins had access starting sometime in 2009. I covered the implications of it when the news broke in 2015: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w...
- pjc50 7y agoIt's completely trivial for non-US people and companies to rent US servers and make the request from there. Or just compromise something. "Government AWS" exists, and may well be better than letting non-experts build their own.