5 ms·

Notice that the email from the deputy CIO mentions SCuBA.This is the "Secure Cloud Business Application Project" from CISA.If you look at two of the required po

Notice that the email from the deputy CIO mentions SCuBA.This is the "Secure Cloud Business Application Project" from CISA.If you look at two of the required policies you will find this: "A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role."[1] and "Privileged users SHALL be provisioned with finer grained roles instead of Global Administrator."[2] So at least for the agency-wide removal of security administrator roles, that would seem to be unrelated to anything DOGE was doing. The NLRB was supposed to be doing that anyway. [1] https://www.cisa.gov/resources-tools/services/m365-entra-id#MSAAD71v1 https://www.cisa.gov/resources-tools/services/m365-entra-id#... [2] https://www.cisa.gov/resources-tools/services/m365-entra-id#MSAAD72v1 https://www.cisa.gov/resources-tools/services/m365-entra-id#...

GranularRecipe 1y ago
Is this a new policy? Otherwise, why this sudden and broad implementation so that "suddenly none of the IT employees at the agency could do their jobs properly anymore" (according to the source).
- pcaharrier 1y ago
  It's pretty new, yes. The binding operational directive from CISA only came down in December. Agencies are in the midst of running the assessment tools and implementing the changes right now. See here: https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services https://www.cisa.gov/news-events/directives/bod-25-01-implem....
ImPostingOnHN 1y ago
The policy you linked doesn't say "agency-wide removal of security administrator roles". It discusses a limit. That says nothing about how many there were here, how it suddenly changed, how elmu's DOGE was able to gain administrator access despite these restrictions, how elmu's DOGE administrators were chosen, etc.
- pcaharrier 1y ago
  Yes, a limit of eight. Meaning that if there were more than eight across the agency, the rest were supposed to be removed by order of CISA. So the binding operational directive is a plausible, alternate explanation of the facts reported in the article. Again, I didn't just do a google search and come up with this; the Deputy CIO specifically mentioned SCuBA in the email that's put in the article. It's not my fault that neither Krebs (nor anyone else, apparently) decided to look into what the email meant by "SCUBA."
  - ImPostingOnHN 1y ago
    > Meaning that if there were more than eight... That seems like a big "if". What I'm asking is, how many were there before elmu's DOGE started compromising systems? Was it more than 8? If not, that would not be a valid justification for the DCIO to cite. Did elmu's DOGE make sure not to grant themselves administrative access (because that would make it more than 8)? How many remain? Is it 8? Do the current administrators match the ones which existed before elmu's DOGE started compromising systems?
jabiko 1y ago
This is about the Global Administrator role. I don't believe that the employee had this role to begin with. Otherwise this quote wouldn't make sense: > [...] top-tier user privileges that neither Berulis nor his boss possessed However, my guess would be that this is the role that DOGE employees requested to be assigned as it is the role with the highest level of privileges.

GranularRecipe 1y ago

Is this a new policy? Otherwise, why this sudden and broad implementation so that "suddenly none of the IT employees at the agency could do their jobs properly anymore" (according to the source).

pcaharrier 1y ago
It's pretty new, yes. The binding operational directive from CISA only came down in December. Agencies are in the midst of running the assessment tools and implementing the changes right now. See here: https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services https://www.cisa.gov/news-events/directives/bod-25-01-implem....

ImPostingOnHN 1y ago

The policy you linked doesn't say "agency-wide removal of security administrator roles". It discusses a limit. That says nothing about how many there were here, how it suddenly changed, how elmu's DOGE was able to gain administrator access despite these restrictions, how elmu's DOGE administrators were chosen, etc.

pcaharrier 1y ago
Yes, a limit of eight. Meaning that if there were more than eight across the agency, the rest were supposed to be removed by order of CISA. So the binding operational directive is a plausible, alternate explanation of the facts reported in the article. Again, I didn't just do a google search and come up with this; the Deputy CIO specifically mentioned SCuBA in the email that's put in the article. It's not my fault that neither Krebs (nor anyone else, apparently) decided to look into what the email meant by "SCUBA."
- ImPostingOnHN 1y ago
  > Meaning that if there were more than eight... That seems like a big "if". What I'm asking is, how many were there before elmu's DOGE started compromising systems? Was it more than 8? If not, that would not be a valid justification for the DCIO to cite. Did elmu's DOGE make sure not to grant themselves administrative access (because that would make it more than 8)? How many remain? Is it 8? Do the current administrators match the ones which existed before elmu's DOGE started compromising systems?

jabiko 1y ago

This is about the Global Administrator role. I don't believe that the employee had this role to begin with. Otherwise this quote wouldn't make sense: > [...] top-tier user privileges that neither Berulis nor his boss possessed However, my guess would be that this is the role that DOGE employees requested to be assigned as it is the role with the highest level of privileges.