3 ms·

Doesn’t this represent a gross failure of the NSA? Preventing this kind of thing seems like their entire purpose.

by zepto 6y ago

TheAdamAndChe 6y ago
The attack surface of the government is incredibly, extremely massive. It's pretty much impossible to stop every single intrusion attempt. When combined with nation-state backing, it's nearly impossible to stop widespread compromise as it's currently structured. Personally, I assume that MAD applies to this system to ensure that no rational nation would leverage this access for anything beyond intelligence-gathering.
- zepto 6y ago
  Seems like “intelligence gathering” could include all kinds of bribery and manipulation. I.e. a massive set of new assets
astockwell 6y ago
Paradoxically, the more gross the failure, the less responsibility large organizations seem to take. Thinking of Equifax, or PG&E and the wildfires. Maybe this is the real rotten core that needs changing. Orgs need to be held to account. And that points to an even deeper core -> we are the ones who need to change, to actually hold orgs to account.
- noizejoy 6y ago
  “Too big to fail” has been mentioned often as a danger to a well working society. But then again, as long as there is reasonably rapid evolution in society, I have no idea how one might curtail organizations from becoming too big. At best it would become another game of Whac-a-mole[0] between regulators and organizations, with regulators more often on the losing side than not. [0] https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage
  - tw25460241 6y ago
    The market process and diseconomies of scale tend to constrain the size of firms, so much so that "bigness" is a strong indicator that a firm is instead being propped up by the political process, e.g., bailouts, regulatory capture.
- skybrian 6y ago
  What does it mean to "hold orgs to account?" Let's unpack this. When some organization promises to do a thing and they fail to do the thing, then sure, you can blame them for breaking their promise. This doesn't fix anything though. To fix things you need to talk about preparedness. Whose job is it to prepare? Do they know what to do? Do they have the resources to do it? Increased penalties for failure aren't going to fix it. And especially, deciding afterwards that someone should have known it's their problem isn't going to fix it.
  - astockwell 6y ago
    I agree on all fronts. Preparedness is the clearest way. But our economy (and capitalism in general) don't reward preparedness, in fact they often punish for it. I read some article about how building slack into systems is equal to building resiliency into them. How can we build an economy that aligns incentives to be resilient?
    - physicsgraph 6y ago
      The same applies to pandemic preparedness. There is no incentive for a hospital to over-provision beds that are empty most of the time. Looking for examples of cultures and organizations that over-provision, the military might be an example. Why do we translate worry about physical attacks into action but not cyber attacks or environmental harm?
      - Leherenn 6y ago
        Because we have had millennia to observe the effects of physical attacks, but the other 2 are much more recent? We haven't yet learnt the hard way.
    - tw25460241 6y ago
      The underwriting of business ventures goes back at least three centuries, and the market process aligns incentives pretty well. But if you think you can price over/under-preparedness better, that sounds like a profit opportunity for you.
- _carbyau_ 6y ago
  How to do that though? See these people, using the Insurance companies stickler for the small print against them: https://www.abc.net.au/news/2020-12-15/australians-fight-insurance-industry-for-coronavirus-loss-claims/12972046 https://www.abc.net.au/news/2020-12-15/australians-fight-ins... In short, the insurance companies have a phrase where they don't have to pay out for business losses caused by disease as specified by a certain law. But that law got wiped from the books and replaced with a new law. And the terms of insurance for most of the companies never got updated and so are irrelevant on that point. So the insurance companies should pay up for business losses due to covid. They are now saying "never mind the exact lettering of the agreement, go by the spirit of it"....
Scipio_Afri 6y ago
Going based on this Washington Post article, it seems its a DHS system called Einstein, which according to a GAO investigation/report was found to have had issues: https://www.washingtonpost.com/national-security/ruusian-hackers-outsmarted-us-defenses/2020/12/15/3deed840-3f11-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/ruusian-hac... I think I found the full report here: https://www.gao.gov/assets/700/696283.pdf https://www.gao.gov/assets/700/696283.pdf "In that report, we also noted that NCPS was partially, but not fully, meeting most of its stated system objectives.34 Although the system’s intrusion detection capabilities provided the ability to detect known patterns of malicious activity on agency networks, it was limited in its capabilities to identify potential threats using anomaly-based detection. We also reported that although DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities.The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities. The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities." It almost seems like a roadmap for an APT... :|

Doesn’t this represent a gross failure of the NSA? Preventing this kind of thing seems like their entire purpose.

by zepto 6y ago

Doesn’t this represent a gross failure of the NSA? Preventing this kind of thing seems like their entire purpose.

The attack surface of the government is incredibly, extremely massive. It's pretty much impossible to stop every single intrusion attempt. When combined with nation-state backing, it's nearly impossible to stop widespread compromise as it's currently structured. Personally, I assume that MAD applies to this system to ensure that no rational nation would leverage this access for anything beyond intelligence-gathering.

zepto 6y ago
Seems like “intelligence gathering” could include all kinds of bribery and manipulation. I.e. a massive set of new assets

astockwell 6y ago

Paradoxically, the more gross the failure, the less responsibility large organizations seem to take. Thinking of Equifax, or PG&E and the wildfires. Maybe this is the real rotten core that needs changing. Orgs need to be held to account. And that points to an even deeper core -> we are the ones who need to change, to actually hold orgs to account.

noizejoy 6y ago
“Too big to fail” has been mentioned often as a danger to a well working society. But then again, as long as there is reasonably rapid evolution in society, I have no idea how one might curtail organizations from becoming too big. At best it would become another game of Whac-a-mole[0] between regulators and organizations, with regulators more often on the losing side than not. [0] https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage
- tw25460241 6y ago
  The market process and diseconomies of scale tend to constrain the size of firms, so much so that "bigness" is a strong indicator that a firm is instead being propped up by the political process, e.g., bailouts, regulatory capture.
skybrian 6y ago
What does it mean to "hold orgs to account?" Let's unpack this. When some organization promises to do a thing and they fail to do the thing, then sure, you can blame them for breaking their promise. This doesn't fix anything though. To fix things you need to talk about preparedness. Whose job is it to prepare? Do they know what to do? Do they have the resources to do it? Increased penalties for failure aren't going to fix it. And especially, deciding afterwards that someone should have known it's their problem isn't going to fix it.
- astockwell 6y ago
  I agree on all fronts. Preparedness is the clearest way. But our economy (and capitalism in general) don't reward preparedness, in fact they often punish for it. I read some article about how building slack into systems is equal to building resiliency into them. How can we build an economy that aligns incentives to be resilient?
  - physicsgraph 6y ago
    The same applies to pandemic preparedness. There is no incentive for a hospital to over-provision beds that are empty most of the time. Looking for examples of cultures and organizations that over-provision, the military might be an example. Why do we translate worry about physical attacks into action but not cyber attacks or environmental harm?
    - Leherenn 6y ago
      Because we have had millennia to observe the effects of physical attacks, but the other 2 are much more recent? We haven't yet learnt the hard way.
  - tw25460241 6y ago
    The underwriting of business ventures goes back at least three centuries, and the market process aligns incentives pretty well. But if you think you can price over/under-preparedness better, that sounds like a profit opportunity for you.
_carbyau_ 6y ago
How to do that though? See these people, using the Insurance companies stickler for the small print against them: https://www.abc.net.au/news/2020-12-15/australians-fight-insurance-industry-for-coronavirus-loss-claims/12972046 https://www.abc.net.au/news/2020-12-15/australians-fight-ins... In short, the insurance companies have a phrase where they don't have to pay out for business losses caused by disease as specified by a certain law. But that law got wiped from the books and replaced with a new law. And the terms of insurance for most of the companies never got updated and so are irrelevant on that point. So the insurance companies should pay up for business losses due to covid. They are now saying "never mind the exact lettering of the agreement, go by the spirit of it"....

Scipio_Afri 6y ago

Going based on this Washington Post article, it seems its a DHS system called Einstein, which according to a GAO investigation/report was found to have had issues: https://www.washingtonpost.com/national-security/ruusian-hackers-outsmarted-us-defenses/2020/12/15/3deed840-3f11-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/ruusian-hac... I think I found the full report here: https://www.gao.gov/assets/700/696283.pdf https://www.gao.gov/assets/700/696283.pdf "In that report, we also noted that NCPS was partially, but not fully, meeting most of its stated system objectives.34 Although the system’s intrusion detection capabilities provided the ability to detect known patterns of malicious activity on agency networks, it was limited in its capabilities to identify potential threats using anomaly-based detection. We also reported that although DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities.The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities. The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities." It almost seems like a roadmap for an APT... :|