10 ms·

What about the other side of this? Instead of seeking backdoors and using them to spy on Americans, the NSA should be stepping up their game and securing vital

What about the other side of this? Instead of seeking backdoors and using them to spy on Americans, the NSA should be stepping up their game and securing vital infrastructure and domestic businesses against these attacks.

partiallypro 5y ago
Most of these are private companies, the NSA doesn't really have a role there.
ocdtrekkie 5y ago
Generally speaking, you'll find the federal government has a litany of agencies, on both the offensive and defensive side of... everything. There are absolutely government resources working on securing American infrastructure. And shifting from one to the other appears to be happening, to some degree: https://breakingdefense.com/2021/06/dod-budget-appears-to-cut-cyber-offense-beef-up-defenses/ https://breakingdefense.com/2021/06/dod-budget-appears-to-cu...
- graphtrader 5y ago
  At this point though we need to have entire new branch of the military. Otherwise, I just don't see how we are taking this serious enough. The way the Air Force specializes in the air. It is just incredible how we are always fighting the last war. From 9/11, instead of learning we need to constantly stay on top of a shifting battlefield we learned to fight Islamic terrorism. Not good.
LegitShady 5y ago
I agree, but I also don't mind the idea of drone striking ransomware guys...
- spookthesunset 5y ago
  Forum spammers too.... they are parasites who cost website owners tons and tons of time.
axlee 5y ago
I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore cash, thank you. The industry should be magnitudes larger than it is currently, and we shouldn't encourage corporate recklessness by socializing the costs.
- cpncrunch 5y ago
  The ones sitting on that cash (MS, Apple, Google) arent at risk.
- paxys 5y ago
  In a lot of cases along with the "megacorps" there is also critical national infrastructure going down.
- papito 5y ago
  Sure, but they are up against state-sponsored, highly trained actors, and that's not a fair fight. This requires the resources of the US Government as their bodyguard.
  - ddingus 5y ago
    Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?
    - papito 5y ago
      Well, obviously.
      - ddingus 5y ago
        Oh I think so too, but I really don't think that's obvious too many of the people impacted by all of this.
    - throwaway3699 5y ago
      Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?
viraptor 5y ago
They do that already. They're not going to come to your company and configure things for you, but they'll report vulnerabilities (https://www.cnet.com/news/major-windows-10-security-flaw-reported-nsa-same-day-windows-7-support-ended/ https://www.cnet.com/news/major-windows-10-security-flaw-rep...), give guidance on policies (https://us-cert.cisa.gov/ncas/current-activity/2021/02/26/nsa-releases-guidance-zero-trust-security-model https://us-cert.cisa.gov/ncas/current-activity/2021/02/26/ns...), create security frameworks (https://web.archive.org/web/20201022103915/https://www.nsa.gov/what-we-do/research/selinux/ https://web.archive.org/web/20201022103915/https://www.nsa.g...) and many other things.
Kalium 5y ago
Let's say you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA. They say your systems are vulnerable as hell. That you're very likely going to be breached in a quite expensive way very soon. It could shut down all the pipes on which Big Pipeline Co depends! They offer to patch your systems for you. Do you accept, knowing that your staff will have to hand over hundreds to thousands of credentials? Knowing that the employees of the NSA care more about patching than if your systems work afterwards, and you have no real recourse if they screw up? If you don't accept, what would you prefer the NSA do to secure your company's systems?
- derefr 5y ago
  The NSA’s mission-statement in domestic civic cybersecurity is to ensure the flow of commerce, i.e. to protect GDP. They aren’t going to patch things in a way that makes them not do their jobs any more. That’d be an “attack on commerce” just as much as exploiting the vuln would be.
  - Kalium 5y ago
    That's true in broad strokes, but I'm trying to portray things from the position of an executive. Having a bunch of outsiders that you have no real influence over in charge of your systems is terrifying. The alternatives are a regulatory system for information security or offering advice and hoping companies implement it. There's a lot of advice on offer.
- quantico 5y ago
  The law should require certain minimums of security for infrastructure deemed vital, like oil pipelines. If entertainment companies and HIPPA can ensure those they work with practice good cybersecurity, why can't the government do the same?
  - Kalium 5y ago
    https://www.energy.gov/national-security-safety/cybersecurity https://www.energy.gov/national-security-safety/cybersecurit... There's already branches of cabinet-level departments that try to do this. In my opinion they're having about the same level of efficacy as one might expect in any other set of large-scale changes in very large old companies with a wide variety of internal systems and needs. If you look you'll find a plethora of government-led attempts to secure various critical industries. You'll also note that entertainment companies and hospitals are routinely breached. There's perhaps room to question if they are indeed practicing good cybersecurity.
tw04 5y ago
What exactly do you expect the NSA to do? This is entirely preventable. Something as simple as an offsite tape backup completely thwarts the attack. Do you want the NSA to send agents out to every Fortune 500 with a blank check so taxpayers can pay for a sane backup strategy to stop a problem we solved 30 years ago?
- inter_netuser 5y ago
  Backup Act of 2021
- op03 5y ago
  Wasn't NSA involved in finding Osama or Suleimani? Find them, then send In Tom Cruise, drone strike what have you. Israel isnt targeted cuz thats what their response woule be to this type of stuff. Are Russia or China going to react any different from Iran or Pakistan? They currently think they are untouchable. That needs to change.
- the-pigeon 5y ago
  "Something as simple as an offsite tape backup completely thwarts the attack." Not true when they are also blackmailing companies to not release their internal data. Even something as simple as a companies customer base and contracts with them can do a huge amount of damage to the company if it's publicly released. So paying a 2 million dollar ransom is the more profitable choice for the company. Even if the company isn't doing anything illegal or that it's ashamed of.
kersplody 5y ago
The DHS in conjunction with the FBI is supposed to be protecting our critical systems from foreign attackers -- and they are failing spectacularly. New laws and new approaches will be required to even begin to make headway, especially where private companies' operations intersect with national security issues. When should the feds be allowed to access my network to verify my assets are secure. The NSA's charter is foreign signals intelligence (including computer networks), not law enforcement -- They can't spy on Americans in America except under extraordinary circumstances (Must have a FISA warrant and that person must be talking to one of a few thousand foreign bad actors). And even then, the collected data is not court admissible. Only the FBI and other law enforcement agencies can spy on Americans in America in legally admissible ways using court orders. The real issue here is when exploits should be weaponized or shared with industry. Should we prioritize the protection of our networks or should we penetrate the networks of our adversaries? This is a tricky political question that needs to be seriously addressed, the status quo is broken.

partiallypro 5y ago

Most of these are private companies, the NSA doesn't really have a role there.

ocdtrekkie 5y ago

Generally speaking, you'll find the federal government has a litany of agencies, on both the offensive and defensive side of... everything. There are absolutely government resources working on securing American infrastructure. And shifting from one to the other appears to be happening, to some degree: https://breakingdefense.com/2021/06/dod-budget-appears-to-cut-cyber-offense-beef-up-defenses/ https://breakingdefense.com/2021/06/dod-budget-appears-to-cu...

graphtrader 5y ago
At this point though we need to have entire new branch of the military. Otherwise, I just don't see how we are taking this serious enough. The way the Air Force specializes in the air. It is just incredible how we are always fighting the last war. From 9/11, instead of learning we need to constantly stay on top of a shifting battlefield we learned to fight Islamic terrorism. Not good.

LegitShady 5y ago

I agree, but I also don't mind the idea of drone striking ransomware guys...

spookthesunset 5y ago
Forum spammers too.... they are parasites who cost website owners tons and tons of time.

axlee 5y ago

I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore cash, thank you. The industry should be magnitudes larger than it is currently, and we shouldn't encourage corporate recklessness by socializing the costs.

cpncrunch 5y ago
The ones sitting on that cash (MS, Apple, Google) arent at risk.
paxys 5y ago
In a lot of cases along with the "megacorps" there is also critical national infrastructure going down.
papito 5y ago
Sure, but they are up against state-sponsored, highly trained actors, and that's not a fair fight. This requires the resources of the US Government as their bodyguard.
- ddingus 5y ago
  Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?
  - papito 5y ago
    Well, obviously.
    - ddingus 5y ago
      Oh I think so too, but I really don't think that's obvious too many of the people impacted by all of this.
  - throwaway3699 5y ago
    Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?

viraptor 5y ago

They do that already. They're not going to come to your company and configure things for you, but they'll report vulnerabilities (https://www.cnet.com/news/major-windows-10-security-flaw-reported-nsa-same-day-windows-7-support-ended/ https://www.cnet.com/news/major-windows-10-security-flaw-rep...), give guidance on policies (https://us-cert.cisa.gov/ncas/current-activity/2021/02/26/nsa-releases-guidance-zero-trust-security-model https://us-cert.cisa.gov/ncas/current-activity/2021/02/26/ns...), create security frameworks (https://web.archive.org/web/20201022103915/https://www.nsa.gov/what-we-do/research/selinux/ https://web.archive.org/web/20201022103915/https://www.nsa.g...) and many other things.

Kalium 5y ago

Let's say you're a CEO at Big Pipeline Co. One day your phone rings. It's the NSA. They say your systems are vulnerable as hell. That you're very likely going to be breached in a quite expensive way very soon. It could shut down all the pipes on which Big Pipeline Co depends! They offer to patch your systems for you. Do you accept, knowing that your staff will have to hand over hundreds to thousands of credentials? Knowing that the employees of the NSA care more about patching than if your systems work afterwards, and you have no real recourse if they screw up? If you don't accept, what would you prefer the NSA do to secure your company's systems?

derefr 5y ago
The NSA’s mission-statement in domestic civic cybersecurity is to ensure the flow of commerce, i.e. to protect GDP. They aren’t going to patch things in a way that makes them not do their jobs any more. That’d be an “attack on commerce” just as much as exploiting the vuln would be.
- Kalium 5y ago
  That's true in broad strokes, but I'm trying to portray things from the position of an executive. Having a bunch of outsiders that you have no real influence over in charge of your systems is terrifying. The alternatives are a regulatory system for information security or offering advice and hoping companies implement it. There's a lot of advice on offer.
quantico 5y ago
The law should require certain minimums of security for infrastructure deemed vital, like oil pipelines. If entertainment companies and HIPPA can ensure those they work with practice good cybersecurity, why can't the government do the same?
- Kalium 5y ago
  https://www.energy.gov/national-security-safety/cybersecurity https://www.energy.gov/national-security-safety/cybersecurit... There's already branches of cabinet-level departments that try to do this. In my opinion they're having about the same level of efficacy as one might expect in any other set of large-scale changes in very large old companies with a wide variety of internal systems and needs. If you look you'll find a plethora of government-led attempts to secure various critical industries. You'll also note that entertainment companies and hospitals are routinely breached. There's perhaps room to question if they are indeed practicing good cybersecurity.

tw04 5y ago

What exactly do you expect the NSA to do? This is entirely preventable. Something as simple as an offsite tape backup completely thwarts the attack. Do you want the NSA to send agents out to every Fortune 500 with a blank check so taxpayers can pay for a sane backup strategy to stop a problem we solved 30 years ago?

inter_netuser 5y ago
Backup Act of 2021
op03 5y ago
Wasn't NSA involved in finding Osama or Suleimani? Find them, then send In Tom Cruise, drone strike what have you. Israel isnt targeted cuz thats what their response woule be to this type of stuff. Are Russia or China going to react any different from Iran or Pakistan? They currently think they are untouchable. That needs to change.
the-pigeon 5y ago
"Something as simple as an offsite tape backup completely thwarts the attack." Not true when they are also blackmailing companies to not release their internal data. Even something as simple as a companies customer base and contracts with them can do a huge amount of damage to the company if it's publicly released. So paying a 2 million dollar ransom is the more profitable choice for the company. Even if the company isn't doing anything illegal or that it's ashamed of.

kersplody 5y ago

The DHS in conjunction with the FBI is supposed to be protecting our critical systems from foreign attackers -- and they are failing spectacularly. New laws and new approaches will be required to even begin to make headway, especially where private companies' operations intersect with national security issues. When should the feds be allowed to access my network to verify my assets are secure. The NSA's charter is foreign signals intelligence (including computer networks), not law enforcement -- They can't spy on Americans in America except under extraordinary circumstances (Must have a FISA warrant and that person must be talking to one of a few thousand foreign bad actors). And even then, the collected data is not court admissible. Only the FBI and other law enforcement agencies can spy on Americans in America in legally admissible ways using court orders. The real issue here is when exploits should be weaponized or shared with industry. Should we prioritize the protection of our networks or should we penetrate the networks of our adversaries? This is a tricky political question that needs to be seriously addressed, the status quo is broken.