4 ms·

How does the vendor make sure you're not doing anything malicious if they don't have the skills to understand the change? It sounds like the issue here isn't t

How does the vendor make sure you're not doing anything malicious if they don't have the skills to understand the change? It sounds like the issue here isn't that the vendor doing the escort is a Chinese national, it's that the engineer making the change is a Chinese national in China and they're using this escort system to check a box saying that because the changes themselves are being made by US nationals, they won't send PII or passwords back to China. But fundamentally a system where an untrusted person gets a less technical person to make a change for them seems inherently extremely high-risk.

beoberha 1y ago
Yep, I totally read the article incorrectly. You’re spot on and honestly I’ve asked myself the same question - though less from a national security perspective and more a “what’s the point of this extra tax to mitigate this incident”
- opello 1y ago
  It seems pretty reasonable to consider the national security perspective when it seems like the potential risk is organized, nation state actors, and the potential mitigation is only the actual depth of security practices at play. To put it another way, if the air gap is the only thing preventing the malicious system from doing its malicious thing, it seems like "defense in depth" is working but there's still a problem to solve. That is, making the malicious system not malicious. > anything actually requiring clearance is serviced by the airgapped clouds and only folks with clearance are able to operate there It seems like "operate" may be doing a lot of work here.
- stackskipton 1y ago
  >“what’s the point of this extra tax to mitigate this incident” My guess is ATO requires that only US Citizens make changes to the system. However, Microsoft did not want to hire skilled US citizens for pay reasons so they hire unskilled US citizens and get trained Chinese nationals to direct US citizens to make changes they require. So stockholders get another yacht because GovCloud is expensive but overhead is peanuts and national security be damned. US Government should announce that their ATO has been revoked but we don't do that.

beoberha 1y ago

Yep, I totally read the article incorrectly. You’re spot on and honestly I’ve asked myself the same question - though less from a national security perspective and more a “what’s the point of this extra tax to mitigate this incident”

opello 1y ago
It seems pretty reasonable to consider the national security perspective when it seems like the potential risk is organized, nation state actors, and the potential mitigation is only the actual depth of security practices at play. To put it another way, if the air gap is the only thing preventing the malicious system from doing its malicious thing, it seems like "defense in depth" is working but there's still a problem to solve. That is, making the malicious system not malicious. > anything actually requiring clearance is serviced by the airgapped clouds and only folks with clearance are able to operate there It seems like "operate" may be doing a lot of work here.
stackskipton 1y ago
>“what’s the point of this extra tax to mitigate this incident” My guess is ATO requires that only US Citizens make changes to the system. However, Microsoft did not want to hire skilled US citizens for pay reasons so they hire unskilled US citizens and get trained Chinese nationals to direct US citizens to make changes they require. So stockholders get another yacht because GovCloud is expensive but overhead is peanuts and national security be damned. US Government should announce that their ATO has been revoked but we don't do that.