9 ms·

NSA is one of those orgs that very hard to asses their intent. On the one hand, they do things like this. And their hardening/setup guides or mitigation guides

NSA is one of those orgs that very hard to asses their intent. On the one hand, they do things like this. And their hardening/setup guides or mitigation guides are generally well done. On the other hand they have tried to knowingly commit faulty logic to RSA's RNG, have acted as an APT actor in the past, and used their toolsets to surveil their own people... Which leads me to believe moves like this, especially with the press coverage, are more political than genuine and it was only disclosed because an adversary is aware of it. Because if the ends justified the means, they have held on to 0 days as well for their own purposes in the past. And are generally tight lipped on their policies for disclosure. https://www.schneier.com/blog/archives/2021/03/chinese-hackers-stole-an-nsa-windows-exploit-in-2014.html https://www.schneier.com/blog/archives/2021/03/chinese-hacke... https://www.schneier.com/blog/archives/2020/10/the-nsa-is-refusing-to-disclose-its-policy-on-backdooring-commercial-products.html https://www.schneier.com/blog/archives/2020/10/the-nsa-is-re... https://www.wired.com/2016/08/hackers-claim-auction-data-stolen-nsa-linked-spies/ https://www.wired.com/2016/08/hackers-claim-auction-data-sto...

klyrs 6y ago
If a friendly NSA agent offered to help tidy up around the house, it would certainly be a kindness. But it's definitely the sort of gift horse you want to look in the mouth. After all, they were just "helping out" securing random number generators, but Shumow and Ferguson discovered that they may have been helping themselves out, too. http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf
hk1337 6y ago
Trust but verify.
HillRat 6y ago
Really, NSA is captive to the law that bureaucracies do exactly what you tell them to do. NSA is budgeted to conduct cyber offense and governmental defense, so private-sector defense is outside the mission; in fact, it conflicts with the former even as it connects with the latter. So NSA is only going to help you if the risks to its defensive mission outweigh the value to its offensive mission (not that organizations have rigorous tests for these things, but whoever yells the loudest is usually a good proxy for it). The best approach, IMO, is to take cyberdefense out of NSA entirely and give someone like CISA an active mission to maximize whole-of-nation digital defense. While this doesn’t entirely mitigate moral hazard between the offensive/defensive mission balance, at least you’ve got competing budgets that have an incentive to work against each other.
TechBro8615 6y ago
From what I’ve observed, large organizations tend to be driven by relatively small groups of people. It’s often hard to identify who exactly is in those groups, but the fact remains that humans can only take so much complexity, so it gets blame shifted across increasingly smaller groups of people until it arrives at the “core” of an organization. It would be interesting to know who the is in that core group of people at the NSA.

klyrs 6y ago

If a friendly NSA agent offered to help tidy up around the house, it would certainly be a kindness. But it's definitely the sort of gift horse you want to look in the mouth. After all, they were just "helping out" securing random number generators, but Shumow and Ferguson discovered that they may have been helping themselves out, too. http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf

hk1337 6y ago

Trust but verify.

HillRat 6y ago

Really, NSA is captive to the law that bureaucracies do exactly what you tell them to do. NSA is budgeted to conduct cyber offense and governmental defense, so private-sector defense is outside the mission; in fact, it conflicts with the former even as it connects with the latter. So NSA is only going to help you if the risks to its defensive mission outweigh the value to its offensive mission (not that organizations have rigorous tests for these things, but whoever yells the loudest is usually a good proxy for it). The best approach, IMO, is to take cyberdefense out of NSA entirely and give someone like CISA an active mission to maximize whole-of-nation digital defense. While this doesn’t entirely mitigate moral hazard between the offensive/defensive mission balance, at least you’ve got competing budgets that have an incentive to work against each other.

TechBro8615 6y ago

From what I’ve observed, large organizations tend to be driven by relatively small groups of people. It’s often hard to identify who exactly is in those groups, but the fact remains that humans can only take so much complexity, so it gets blame shifted across increasingly smaller groups of people until it arrives at the “core” of an organization. It would be interesting to know who the is in that core group of people at the NSA.