3 ms·

> One of the goals of the National Security Agency (NSA) is to advance the state of cybersecurity Don't forget the NSA does both offense and defense. More so o

> One of the goals of the National Security Agency (NSA) is to advance the state of cybersecurity Don't forget the NSA does both offense and defense. More so offense from what I've gathered. Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0] [0] https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS

godelski 4y ago
It's important to remember this because those two subgroups are often in contention with one another. This is why you see high ranking members of the NSA (or other groups) advocating for strong encryption as well as high ranking members advocating against encryption. It is always clear who is who by what they are advocating for. But we definitely have a bias for hearing red team instead of blue team. I hope that shifts, because blue team is far more important (and a substantially more difficult problem).
13of40 4y ago
To be fair, a lot of the people involved in the offensive side find their forever homes in defensive cybersecurity orgs in the private sector. If you take a long view of it, the offensive/defensive split is a lot less ominous.
- docandrew 4y ago
  The tools are similar too. There’s a very thin line between defensive cyber tools and malware sometimes.
rocket_surgeron 4y ago
>Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0] A bit like spinning off many military/space technological advances for civilian applications while keeping the juicy bits secret, no? I like GPS. I also like that the US has the best GPS-guided munitions.
- yucky 4y ago
  > Millions of innocent civilians in the middle east aren't as happy about it though.
halJordan 4y ago
In the interest of both sides there's a much more real and concrete Vulnerabilities Equities Process, that has been used to report zero days. https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Process https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Pro... https://www.wired.com/story/nsa-windows-10-vulnerability-disclosure/ https://www.wired.com/story/nsa-windows-10-vulnerability-dis...

godelski 4y ago

It's important to remember this because those two subgroups are often in contention with one another. This is why you see high ranking members of the NSA (or other groups) advocating for strong encryption as well as high ranking members advocating against encryption. It is always clear who is who by what they are advocating for. But we definitely have a bias for hearing red team instead of blue team. I hope that shifts, because blue team is far more important (and a substantially more difficult problem).

13of40 4y ago

To be fair, a lot of the people involved in the offensive side find their forever homes in defensive cybersecurity orgs in the private sector. If you take a long view of it, the offensive/defensive split is a lot less ominous.

docandrew 4y ago
The tools are similar too. There’s a very thin line between defensive cyber tools and malware sometimes.

rocket_surgeron 4y ago

>Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0] A bit like spinning off many military/space technological advances for civilian applications while keeping the juicy bits secret, no? I like GPS. I also like that the US has the best GPS-guided munitions.

yucky 4y ago
> Millions of innocent civilians in the middle east aren't as happy about it though.

halJordan 4y ago

In the interest of both sides there's a much more real and concrete Vulnerabilities Equities Process, that has been used to report zero days. https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Process https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Pro... https://www.wired.com/story/nsa-windows-10-vulnerability-disclosure/ https://www.wired.com/story/nsa-windows-10-vulnerability-dis...