7 ms·

I'd like to point out to the folks up at arms that anyone would even consider a job at the NSA, that they might not fully understand the dualilty of the NSA. Th

I'd like to point out to the folks up at arms that anyone would even consider a job at the NSA, that they might not fully understand the dualilty of the NSA. The SIGINT (signals intelligence) mission of the NSA is constantly in the news and is what folks mostly associate with the NSA. However, it's other mission of Information Assurance/Central Security Service gets little notice which is responsible for defensive security. The hopelessly conflicted nature the NSA is reflected in the title of the NSA's website which is NSA/CSS, and it describes the director of the NSA as "dual-hatted". The CSS/IA portion of the NSA is responsible for protecting the Dept. of Defense from cyber attack. It also helps government agencies, academic instituitions, critical infrastructure providers, and other companies (particularly government contractors) secure their infrastructure from cyber attacks. It also develops standards around the protection of systems and communication links. Unfortunately, this work is tarnished by the SIGINT role of the NSA. Very understandably this leads to a lot of mistrust, like when the NSA proposes cryptography algorithms for example. It also works closely with the NSS who helps produce NIST security standards. Just thought I'd point out the two hats of the NSA, since many folks don't know about this duality. There was some talk about splitting the NSA's dual missions into two agencies, but sadly that died off years ago with nothing being done.

daydream 4y ago
My understanding is the SIGINT and CSS groups are essentially two separate organizations, somewhat firewalled from each other, with separate reporting chains all the way up to the director of the NSA. Is that true?
- Rebelgecko 4y ago
  I think that's been somewhat less true since the NSA21 reorg, which merged IAD with some of NSA's sigint groups.
deleted 4y ago
[deleted]
michael1999 4y ago
I got the impression that old crook Poindexter and friends decided to go all-offence all the time at the turn of the century. I remember the arguments that since COTS was the future, and industry practices could never be practically hardened without rebuilding our entire software foundations, it was time to give up. The exploit market became regularized, deep, and liquid, and the TIA vision was the mission. Leaving the OPM twisting in the wind for total compromise reinforces the impression that if anyone at the NSA is actually focused on defence, they aren't doing a very good job. That's more than a generation of attack first, defend last. The S-box fix for DES was 50 years ago. Recent crypto contributions seem much less benevolent. I'm an outsider, and can't really know. I don't doubt your good will, but everything in my career from the Clipper chip fiasco, through Microsoft's incomprehensible 20 year fascination with code-signing in place of actually effective methods, and on up to the present day reinforces this impression.
- infamia 4y ago
  I think it's important not to let the negative activities of some people in government, cause us to negatively paint people negatively who are doing good and necessary work. Admittedly, this is becoming more difficult as these lines are blurred.
  - michael1999 4y ago
    There is no fancy latin name for the error of giving known liars the benefit of the doubt, but there should be. Poindexter and friends betrayed the constitution, and set the tone for the organization as all-offence, all-the-time. It's not a fallacy to believe the stated goals of senior officials set the direction for organizations. I am 100% confident that there are employees at the NSA tasked with defence that are diligent and motivated. I am 90% confident their budgets and other institutional support are a small fraction of the offence side of the house. I am less confident, but still believe that at least some defence activities are compromised by the offensive mission. The stink around Dual_EC_DRBG was the public suspecting that even the defence side of the house is lying to us, and is acting as cover for the offence side. I don't see how the NSA can ever recover that credibility after room 641A. That's a stink that's hard to wash off.
halJordan 4y ago
The dual hatted nature of DIRNSA has nothing to do with defense vs offense. General Nakasone is in fact a commissioned officer in the US Army. His dual hat is the fact that he is the DIRNSA but also the commanding general of USCYBERCOM. These are his two hats. Also the CSS is also misunderstood in your comment, and has little to nothing to do with the NSA's defensive role.
- infamia 4y ago
  > Also the CSS is also misunderstood in your comment, and has little to nothing to do with the NSA's defensive role. Thank you for the corrections! My limited understanding is that CSS works with standards groups to enhance the state of the art, which has a strong defensive component (e.g. help everyone secure their communications and data). I'd be interested to hear if this is incorrect.

daydream 4y ago

My understanding is the SIGINT and CSS groups are essentially two separate organizations, somewhat firewalled from each other, with separate reporting chains all the way up to the director of the NSA. Is that true?

Rebelgecko 4y ago
I think that's been somewhat less true since the NSA21 reorg, which merged IAD with some of NSA's sigint groups.

deleted 4y ago

[deleted]

michael1999 4y ago

I got the impression that old crook Poindexter and friends decided to go all-offence all the time at the turn of the century. I remember the arguments that since COTS was the future, and industry practices could never be practically hardened without rebuilding our entire software foundations, it was time to give up. The exploit market became regularized, deep, and liquid, and the TIA vision was the mission. Leaving the OPM twisting in the wind for total compromise reinforces the impression that if anyone at the NSA is actually focused on defence, they aren't doing a very good job. That's more than a generation of attack first, defend last. The S-box fix for DES was 50 years ago. Recent crypto contributions seem much less benevolent. I'm an outsider, and can't really know. I don't doubt your good will, but everything in my career from the Clipper chip fiasco, through Microsoft's incomprehensible 20 year fascination with code-signing in place of actually effective methods, and on up to the present day reinforces this impression.

infamia 4y ago
I think it's important not to let the negative activities of some people in government, cause us to negatively paint people negatively who are doing good and necessary work. Admittedly, this is becoming more difficult as these lines are blurred.
- michael1999 4y ago
  There is no fancy latin name for the error of giving known liars the benefit of the doubt, but there should be. Poindexter and friends betrayed the constitution, and set the tone for the organization as all-offence, all-the-time. It's not a fallacy to believe the stated goals of senior officials set the direction for organizations. I am 100% confident that there are employees at the NSA tasked with defence that are diligent and motivated. I am 90% confident their budgets and other institutional support are a small fraction of the offence side of the house. I am less confident, but still believe that at least some defence activities are compromised by the offensive mission. The stink around Dual_EC_DRBG was the public suspecting that even the defence side of the house is lying to us, and is acting as cover for the offence side. I don't see how the NSA can ever recover that credibility after room 641A. That's a stink that's hard to wash off.

halJordan 4y ago

The dual hatted nature of DIRNSA has nothing to do with defense vs offense. General Nakasone is in fact a commissioned officer in the US Army. His dual hat is the fact that he is the DIRNSA but also the commanding general of USCYBERCOM. These are his two hats. Also the CSS is also misunderstood in your comment, and has little to nothing to do with the NSA's defensive role.

infamia 4y ago
> Also the CSS is also misunderstood in your comment, and has little to nothing to do with the NSA's defensive role. Thank you for the corrections! My limited understanding is that CSS works with standards groups to enhance the state of the art, which has a strong defensive component (e.g. help everyone secure their communications and data). I'd be interested to hear if this is incorrect.