3 ms·

I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate syst

I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?

jeffbee 5y ago
DoD only has idiotic requirements like there has to be a fence around their private racks, not useful requirements like the global database isn’t open to the world.
- deleted 5y ago
  [deleted]
- dharmab 5y ago
  Azure runs their Gov and China clouds as separate infrastructures with separate capabilities.
reallydontask 5y ago
I'd guess that the azure us gov cloud defaults to stuff not being open to the web, so if you spin up an azure function this is only available internally, but this is a guess
nonameiguess 5y ago
Nope. Look here (https://docs.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope#azure-government-services-by-audit-scope https://docs.microsoft.com/en-us/azure/azure-government/comp...) and search for Cosmos and you'll see this service is only approved for DoD Impact Level II systems. That is the lowest impact level the DoD offers and includes only systems exposed to the public, like the websites for recruiting and career descriptions. Any system handling controlled unclassified information or PII would not have been allowed to use this service. And when you're talking about "most secret" contracts, those are all classified systems, which are on totally separate networks in totally separate private data centers located on military installations. Unless you've figured out how to break strong symmetric encryption using hardware-generated, hardware-loaded, pre-shared keys controlled in military arms rooms, that means you need physical access. It doesn't necessarily mean you need to break into a military installation. You can always try to break into a contractor SCIF instead, but that still isn't all that easy. My wife once saw some AT&T contractors digging too close to the wrong fiber line at her facility when she was working for the Navy at a contractor site and unmarked black SUVs were there to take those guys away to God knows where within two minutes. That said, I don't doubt people try. When I was at Raytheon working at a secure facility, a Chinese company bought the property across the street, built a hotel at exactly the same height with windows facing us, and it was conspicuously almost always empty. I don't think demand for hotel rooms was financing that place.
- csharptwdec19 5y ago
  > My wife once saw some AT&T contractors digging too close to the wrong fiber line at her facility when she was working for the Navy at a contractor site and unmarked black SUVs were there to take those guys away to God knows where within two minutes. I used to do design/permitting for fiber networks and going around DOD areas/Fiber was always fun. You wind up having to submit your routes, and get vague feedback as to what you need to move, but never how far away/etc. Usually your best bet is to just go to the other side of the road if possible.

I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?

jeffbee 5y ago

DoD only has idiotic requirements like there has to be a fence around their private racks, not useful requirements like the global database isn’t open to the world.

deleted 5y ago
[deleted]
dharmab 5y ago
Azure runs their Gov and China clouds as separate infrastructures with separate capabilities.

reallydontask 5y ago

I'd guess that the azure us gov cloud defaults to stuff not being open to the web, so if you spin up an azure function this is only available internally, but this is a guess

nonameiguess 5y ago

Nope. Look here (https://docs.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope#azure-government-services-by-audit-scope https://docs.microsoft.com/en-us/azure/azure-government/comp...) and search for Cosmos and you'll see this service is only approved for DoD Impact Level II systems. That is the lowest impact level the DoD offers and includes only systems exposed to the public, like the websites for recruiting and career descriptions. Any system handling controlled unclassified information or PII would not have been allowed to use this service. And when you're talking about "most secret" contracts, those are all classified systems, which are on totally separate networks in totally separate private data centers located on military installations. Unless you've figured out how to break strong symmetric encryption using hardware-generated, hardware-loaded, pre-shared keys controlled in military arms rooms, that means you need physical access. It doesn't necessarily mean you need to break into a military installation. You can always try to break into a contractor SCIF instead, but that still isn't all that easy. My wife once saw some AT&T contractors digging too close to the wrong fiber line at her facility when she was working for the Navy at a contractor site and unmarked black SUVs were there to take those guys away to God knows where within two minutes. That said, I don't doubt people try. When I was at Raytheon working at a secure facility, a Chinese company bought the property across the street, built a hotel at exactly the same height with windows facing us, and it was conspicuously almost always empty. I don't think demand for hotel rooms was financing that place.

csharptwdec19 5y ago
> My wife once saw some AT&T contractors digging too close to the wrong fiber line at her facility when she was working for the Navy at a contractor site and unmarked black SUVs were there to take those guys away to God knows where within two minutes. I used to do design/permitting for fiber networks and going around DOD areas/Fiber was always fun. You wind up having to submit your routes, and get vague feedback as to what you need to move, but never how far away/etc. Usually your best bet is to just go to the other side of the road if possible.