6 ms·
> Especially if they can just slip the janitor $10,000 to put a USB labelled "Barely Legal Gone Wild" into the machine while vaccumming. Part of Defensive Dept
by na85 5y ago
> Especially if they can just slip the janitor $10,000 to put a USB labelled "Barely Legal Gone Wild" into the machine while vaccumming.
Part of Defensive Depth includes vetting and requiring the janitor who cleans the SCIF to themselves also hold a security clearance.
Your cited example is also why Counterintelligence is a thing. It's not enough to trust your processes; you also have to probe them.
When I was in the military I met a guy whose job was to pentest (among other things) nuclear weapons facilities and NORAD defense installations, specifically their computer equipment. He had some pretty wild stories; suffice it to say the ladder trick doesn't work when you are trying to access an ICBM solo.
- alksjdalkj 5y ago> Part of Defensive Depth includes vetting and requiring the janitor who cleans the SCIF to themselves also hold a security clearance. Sure, but no amount of vetting is going to be perfect. Maybe the vetting missed something, maybe some circumstance changed between now and the most recent re-up, maybe instead of $10k it's $10M, etc. A better solution is to physically disable the USB ports.
- na85 5y ago>A better solution is to physically disable the USB ports. It's not an either/or situation.
- kingcharles 5y agoEveryone will break. Even the janitor who passed clearance. Threaten his wife, see how long he cares about his clearance. When the government was trying to break me I was all macho, "I ain't saying shit", until the second they threatened to hurt my wife, then I was a little bitch who would have woofed and begged for treats had they asked.
- ahazred8ta 5y agoThere are security testers in DC with a good track record of getting into government buildings. "Who are you and what are you doing here?" "I've brought chocolate cake." "Oooo!!"