4 ms·

If they don't audit what people have access to, who knows what those people are doing with it. That's even scarier than the NSA recording everything, that their

If they don't audit what people have access to, who knows what those people are doing with it. That's even scarier than the NSA recording everything, that their employees and contractors can do whatever they want with the info.

sp332 13y ago
I think they know Snowden accessed a lot of stuff, but they don't know what subset of it he took.
rdtsc 13y ago
But who audits those who set up audit systems? Presumably he was one of the "system administrators" from what I understand. I guess they haven't solved the problem technically yet as they have instituted "no lone zones" policy. They'll just have everyone work with an accountabil-a-buddy.
- 616c 13y ago
  If it was one of the standard Windows file servers, and not a SMB/CIFS appliance, the audit controls are very-detailed and fine-grained from 7/2008 up. Previous audit controls were so. You need to modify which ones you want logged, and then you would need some central sink to log all the Event Log events on all the servers, and review those of interest. I have never worked in an area with that level of paranoia. However, if NSA contractors are put under the same Federal Desktop Core Configuration requirements [0] at a minimum, I would imagine the client and/or server (if he was required to use Windows) are known, or the NSA contractors are not in compliance. What they do with that information is another story. That said, any admin could change local policy settings, reboot with the computer, and reconnect it to the domain later. I got clever with such things to disable security policies like those when troubleshooting lab computers. We shall never know how smart/dumb Snowden was and they were. [0] http://usgcb.nist.gov/usgcb/microsoft_content.html http://usgcb.nist.gov/usgcb/microsoft_content.html
lambda 13y ago
Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. Now, a big concern is that even if they do audit access to the wiretap data, there are still too many people who have "legitimate" access to it, and it is still hard to prevent a rogue sysadmin or programmer from bypassing those controls. Merely having all of that data makes it a high value target for attack.
- skue 13y ago
  > Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. This will clearly be NSA's response -- whether it's true or not -- but Snowden didn't just take random PowerPoints and internal training docs. If I'm not mistaken, he also took copies of FISA court documents and other highly classified materials that were never intended to be shared among NSA staff. I truly believe the lack of audits for these materials has destroyed NSA's credibility across the board: 1. We know that NSA hires/contracts incredibly smart and technically talented individuals who are experts at breaking into systems and avoiding detection. 2. The only way for NSA to provide reasonable controls in this environment is to create a culture of monitoring and accountability, and design all their systems from the ground up with auditing and security in mind. 3. But apparently they didn't do #2 (or never figured out how to enforce this for sysadmins), because Snowden repeatedly accessed restricted and highly classified material without an audit trail. I don't see how they can credibly admit a Snowden sized failure but still ask us to trust them with our personal data.
- revelation 13y ago
  Those PowerPoints are classified! Why would you think it's ok not to audit access?
coldcode 13y ago
If Snowden could take gobs of stuff without audit, so could everyone.

sp332 13y ago

I think they know Snowden accessed a lot of stuff, but they don't know what subset of it he took.

rdtsc 13y ago

But who audits those who set up audit systems? Presumably he was one of the "system administrators" from what I understand. I guess they haven't solved the problem technically yet as they have instituted "no lone zones" policy. They'll just have everyone work with an accountabil-a-buddy.

616c 13y ago
If it was one of the standard Windows file servers, and not a SMB/CIFS appliance, the audit controls are very-detailed and fine-grained from 7/2008 up. Previous audit controls were so. You need to modify which ones you want logged, and then you would need some central sink to log all the Event Log events on all the servers, and review those of interest. I have never worked in an area with that level of paranoia. However, if NSA contractors are put under the same Federal Desktop Core Configuration requirements [0] at a minimum, I would imagine the client and/or server (if he was required to use Windows) are known, or the NSA contractors are not in compliance. What they do with that information is another story. That said, any admin could change local policy settings, reboot with the computer, and reconnect it to the domain later. I got clever with such things to disable security policies like those when troubleshooting lab computers. We shall never know how smart/dumb Snowden was and they were. [0] http://usgcb.nist.gov/usgcb/microsoft_content.html http://usgcb.nist.gov/usgcb/microsoft_content.html

lambda 13y ago

Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. Now, a big concern is that even if they do audit access to the wiretap data, there are still too many people who have "legitimate" access to it, and it is still hard to prevent a rogue sysadmin or programmer from bypassing those controls. Merely having all of that data makes it a high value target for attack.

skue 13y ago
> Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. This will clearly be NSA's response -- whether it's true or not -- but Snowden didn't just take random PowerPoints and internal training docs. If I'm not mistaken, he also took copies of FISA court documents and other highly classified materials that were never intended to be shared among NSA staff. I truly believe the lack of audits for these materials has destroyed NSA's credibility across the board: 1. We know that NSA hires/contracts incredibly smart and technically talented individuals who are experts at breaking into systems and avoiding detection. 2. The only way for NSA to provide reasonable controls in this environment is to create a culture of monitoring and accountability, and design all their systems from the ground up with auditing and security in mind. 3. But apparently they didn't do #2 (or never figured out how to enforce this for sysadmins), because Snowden repeatedly accessed restricted and highly classified material without an audit trail. I don't see how they can credibly admit a Snowden sized failure but still ask us to trust them with our personal data.
revelation 13y ago
Those PowerPoints are classified! Why would you think it's ok not to audit access?

coldcode 13y ago

If Snowden could take gobs of stuff without audit, so could everyone.