3 ms·

> The assessment, seen by Reuters and first reported by Breaking Defense, comes just months after defense drone and software maker Anduril was awarded a $100 mi

by dmix 1y ago

> The assessment, seen by Reuters and first reported by Breaking Defense, comes just months after defense drone and software maker Anduril was awarded a $100 million to create a prototype of NGC2 with partners including Palantir, Microsoft and several smaller contractors. > Army chief information officer and Chiulli’s supervisor, said in a statement to Reuters that the report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them. So it's a brand new prototype and this is a run of the mill cybersecurity review while it undergoes some internal testing?

rohan_ 1y ago
yeah i don't understand - they spent a few months building a prototype... do people not understand what a prototype is? This sounds like a nothingburger.
- DaveZale 1y ago
  Yup, that's the job of the folks at Fort Carson: find the flaws in the prototype. I often hear and feel the booms when they are testing. The percussive shocks travel many miles through the shale to under my house.
- TimorousBestie 1y ago
  Bolting on security after the fact is not exactly the preferred strat. Especially when the cost of busted security in this context is “exceptionally grave damage.”
- zdragnar 1y ago
  I think btown's sibling comment has it right. It's not even a prototype if it isn't demonstrating some aspect of its core capabilities. Given this line from the article: Despite the early September memo’s scathing critique, Leonel Garciga, Army chief information officer and Chiulli’s supervisor, said in a statement to Reuters that the report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them. and Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone Army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document. it seems like there was a SIGNIFICANT mismatch in expectations between the team delivering the prototype and the people receiving it. Everyone's time was wasted as a result.
btown 1y ago
> The report says the system allows any authorized user to access all applications and data regardless of their clearance level or operational need. As a result, “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions. Given that segmentation of data access is a core part of the pitch (see e.g. https://www.palantir.com/docs/gotham https://www.palantir.com/docs/gotham) - if security controls were intentionally omitted from the prototype scope, that seems like a reckless scoping decision to make. And if security controls were unintentionally bypassed, this speaks to insufficient red-teaming of the prototype before launch. I couldn't be more pleased that this is coming to light, though. Perhaps it opens decisionmakers' eyes to the dangers of over-centralizing military operations on a system that simultaneously allows operators to diffuse accountability to a semi-autonomous target-calling system, and is foundationally connected to surveillance-state systems tracking U.S. citizens. Entire genres of movies posit the negative outcomes of this kind of system on civilians and military personnel alike; they are cautionary tales to Not Create The Torment Nexus. Sometimes decentralized, human-in-the-loop, need-to-look-the-target-in-the-eyes operational coordination is a feature, not a bug.
- mrtnmrtn 1y ago
  « Enterprise security We reject the notion of gating, pay-walling, or upselling core security controls like audit logging, single sign-on, and multi-factor authentication. Whether you’re a small business or a federal agency, you get access to every core enterprise security feature in our standard offering: Mandatory encryption of all data, both in transit and at rest, that uses robust, modern cryptography standards. Strong authentication and identity protection controls, including single sign-on and multi-factor authentication. Strong authorization controls, including mandatory and discretionary access controls. Robust security audit logging for detecting and investigating potential abuse. Highly extensible information governance, management, and privacy controls to meet the needs of any use case. »
- Spooky23 1y ago
  The real question is: did the product manager shave his beard?
- 1y ago
derektank 1y ago
I was sort of inclined to agree coming into reading this (my understanding is that this is a prototype round, and other contractors have received awards, prior to a downselect round where one contractor will be selected for full production) but if it's true that, "We cannot control who sees what, we cannot see what users are doing," that seems like a bearish signal. Access control and user level logging seem like kind of basic feature requirements for a military C2 system? And Lattice isn't a completely immature product either IIRC.

by dmix 1y ago

rohan_ 1y ago

yeah i don't understand - they spent a few months building a prototype... do people not understand what a prototype is? This sounds like a nothingburger.

DaveZale 1y ago
Yup, that's the job of the folks at Fort Carson: find the flaws in the prototype. I often hear and feel the booms when they are testing. The percussive shocks travel many miles through the shale to under my house.
TimorousBestie 1y ago
Bolting on security after the fact is not exactly the preferred strat. Especially when the cost of busted security in this context is “exceptionally grave damage.”
zdragnar 1y ago
I think btown's sibling comment has it right. It's not even a prototype if it isn't demonstrating some aspect of its core capabilities. Given this line from the article: Despite the early September memo’s scathing critique, Leonel Garciga, Army chief information officer and Chiulli’s supervisor, said in a statement to Reuters that the report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them. and Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone Army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document. it seems like there was a SIGNIFICANT mismatch in expectations between the team delivering the prototype and the people receiving it. Everyone's time was wasted as a result.

btown 1y ago

> The report says the system allows any authorized user to access all applications and data regardless of their clearance level or operational need. As a result, “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions. Given that segmentation of data access is a core part of the pitch (see e.g. https://www.palantir.com/docs/gotham https://www.palantir.com/docs/gotham) - if security controls were intentionally omitted from the prototype scope, that seems like a reckless scoping decision to make. And if security controls were unintentionally bypassed, this speaks to insufficient red-teaming of the prototype before launch. I couldn't be more pleased that this is coming to light, though. Perhaps it opens decisionmakers' eyes to the dangers of over-centralizing military operations on a system that simultaneously allows operators to diffuse accountability to a semi-autonomous target-calling system, and is foundationally connected to surveillance-state systems tracking U.S. citizens. Entire genres of movies posit the negative outcomes of this kind of system on civilians and military personnel alike; they are cautionary tales to Not Create The Torment Nexus. Sometimes decentralized, human-in-the-loop, need-to-look-the-target-in-the-eyes operational coordination is a feature, not a bug.

mrtnmrtn 1y ago
« Enterprise security We reject the notion of gating, pay-walling, or upselling core security controls like audit logging, single sign-on, and multi-factor authentication. Whether you’re a small business or a federal agency, you get access to every core enterprise security feature in our standard offering: Mandatory encryption of all data, both in transit and at rest, that uses robust, modern cryptography standards. Strong authentication and identity protection controls, including single sign-on and multi-factor authentication. Strong authorization controls, including mandatory and discretionary access controls. Robust security audit logging for detecting and investigating potential abuse. Highly extensible information governance, management, and privacy controls to meet the needs of any use case. »
Spooky23 1y ago
The real question is: did the product manager shave his beard?
1y ago

derektank 1y ago

I was sort of inclined to agree coming into reading this (my understanding is that this is a prototype round, and other contractors have received awards, prior to a downselect round where one contractor will be selected for full production) but if it's true that, "We cannot control who sees what, we cannot see what users are doing," that seems like a bearish signal. Access control and user level logging seem like kind of basic feature requirements for a military C2 system? And Lattice isn't a completely immature product either IIRC.