"Once you get past the perimeter, all bets are off" is the military's approach to security. This pervasive thinking has caused a lot of nightmares in infosec wi

"Once you get past the perimeter, all bets are off" is the military's approach to security. This pervasive thinking has caused a lot of nightmares in infosec with the likes of Lockheed introducing "cyber killchain" to big corporations. They focus on the perimeter and who gets access and how. They essentially have RBAC but not mandatory access control. Your role gets you past a perimeter or a security control but access to data is granted implicitly not explicitly. What the infosec community has learned is that defense is best done "in depth" or "layered". Even if he needed that information for his work and permission was given to him explicitly why was he allowed to download files? Why was he able to get any sort of electronics in or out of any facility that stored top secret information? How come there was no DLP or hard to defeat watermarking on documents? Document canaries to detect a leak? I mean even in a typical corporate O365 deployment, you can classify documents so that they are encrypted by MSIP so even if you take the document home and open it, you need to authenticate to decrypt it (and that is logged of course), he can take screenshots but you can monitor that too and he needs to get that screenshot out (and hopefully TS clearance computers don't have internet access or USB ports or mass storage device support). I don't agree that the problem is a million people have clearance. That clearance should mean you will be allowed to request access to documente and have that granted if you need those specific docs, it shouldn't mean access is implied. And a bit controversial take: this is why the USG can't go easy or forget about assange or snowden and others. They can make a case in court or convince a jury they had no option but to leak classified info but DoJ would be incompetent if it didn't go after all leakers regardless of context.