5 ms·

> Another [official] said that the NSA has a poor audit capability, which is frustrating efforts to complete a damage assessment. Wow. The NSA spent untold bil

by skue 13y ago

> Another [official] said that the NSA has a poor audit capability, which is frustrating efforts to complete a damage assessment. Wow. The NSA spent untold billions building advanced tech to snoop others but never bothered to set up proper internal controls for their own systems? Of course this also raises the question, how can they continue to insist that there are reasonable controls in place to prevent abuse when they can't even determine what Snowden accessed, after he collected thousands of documents over a span of years?

desbest 13y ago
If you can read something, you can copy it.
- tytso 13y ago
  Sure, but why isn't all data encrypted at rest? And access to the keys heavily logged? There are ways to allow sysadmins access to backup, and repair file systems, and yet still not have any access to the (plaintext) data stored on those systems. Sure, eventually the key server (whether it's Kerberos style or X509 certificate style) is going to be something where a single trusted individual can do great harm (if by no other means than by checking in some obfuscated code that introduces a bug that releases keys, and then gets this past the code review process). But you can limit the damage that can be done by "thousands of sysadmins". It sounds like there are cloud services providers that are doing a better job at this today than the NSA. And we're supposed to trust them with their audit controls? P.S. My undergraduate thesis in 1990 designed a symmetric key system that would allow data at rest to be encrypted, such that access could be controlled (and logged) via single key server system in which you invested all of your trust. This is not rocket science...
mjn 13y ago
They do put some effort into internal controls, e.g. SELinux came from the NSA originally. But apparently not enough!
- eli 13y ago
  Someone has to be able to sudo on the box and administer the internal controls. It's pretty hard to audit that person.
  - rwmj 13y ago
    Wrong. Read about audit tools in RHEL. They are entirely designed to cope with this scenario.
  - Amadou 13y ago
    Since "root" in an SELinux configuration has just that one job, it is significantly easier to limit access to that privilege level to very specific cases which you can two-man or externally record ala the script command. Assuming, that is, the system was set up that way in the first place. Which is such a PITA that I totally believe they just skipped it.
  - stephengillie 13y ago
    That makes root sound like a gaping security hole. Almost all Windows installations disable the Administrator account and hand out permissions only where necessary.
Keyframe 13y ago
To be honest, we don't know that. All we have here is some offhand remarks by supposedly unnamed official.
staunch 13y ago
It's fundamentally nearly impossible to audit (or even control) what sysadmins do. You can try, but at the end of the day the most secure really is based on trust and it works remarkably well. NSA must have thousands of sysadmins (at least over the years) and we've got one that leaked things in a significant way. The system they use is not really broken, it's just embarrassing to them when it's proven imperfect. The best fix would be to simply avoid doing things that are likely to piss off ethical people like Snowden.
- smileysteve 13y ago
  > and we've got one that leaked things in a significant way. One that leaked to the public (Blew a Whistle). This in no way precludes previous leaks from leaking to a) Foreign Governments b) Businesses c) for Extortion purposes d) Personal use.
- jules 13y ago
  It's not impossible. The low tech proof that it's possible is to just put a camera on them and their screen. There are better ways, obviously.
  - staunch 13y ago
    A camera would not be even close to good enough. It's trivial to type commands in a window that is not visible on your screen, for example. Keyboard logging? Not even close to good enough since you could easily break commands up or write a script that does what you want in an obfuscated way.
- rwmj 13y ago
  This is nonsense. The whole point of the audit tools that we (Red Hat) ship is to audit the sysadmins. This includes: auditing off machine to secure sites under control of others; having the machine hard power-off if the audit log cannot be written/sent; extremely fine-grained auditing of every command used, file read/written, etc.
  - raverbashing 13y ago

by skue 13y ago

desbest 13y ago

If you can read something, you can copy it.

tytso 13y ago
Sure, but why isn't all data encrypted at rest? And access to the keys heavily logged? There are ways to allow sysadmins access to backup, and repair file systems, and yet still not have any access to the (plaintext) data stored on those systems. Sure, eventually the key server (whether it's Kerberos style or X509 certificate style) is going to be something where a single trusted individual can do great harm (if by no other means than by checking in some obfuscated code that introduces a bug that releases keys, and then gets this past the code review process). But you can limit the damage that can be done by "thousands of sysadmins". It sounds like there are cloud services providers that are doing a better job at this today than the NSA. And we're supposed to trust them with their audit controls? P.S. My undergraduate thesis in 1990 designed a symmetric key system that would allow data at rest to be encrypted, such that access could be controlled (and logged) via single key server system in which you invested all of your trust. This is not rocket science...

mjn 13y ago

They do put some effort into internal controls, e.g. SELinux came from the NSA originally. But apparently not enough!

eli 13y ago
Someone has to be able to sudo on the box and administer the internal controls. It's pretty hard to audit that person.
- rwmj 13y ago
  Wrong. Read about audit tools in RHEL. They are entirely designed to cope with this scenario.
- Amadou 13y ago
  Since "root" in an SELinux configuration has just that one job, it is significantly easier to limit access to that privilege level to very specific cases which you can two-man or externally record ala the script command. Assuming, that is, the system was set up that way in the first place. Which is such a PITA that I totally believe they just skipped it.
- stephengillie 13y ago
  That makes root sound like a gaping security hole. Almost all Windows installations disable the Administrator account and hand out permissions only where necessary.

Keyframe 13y ago

To be honest, we don't know that. All we have here is some offhand remarks by supposedly unnamed official.

staunch 13y ago

It's fundamentally nearly impossible to audit (or even control) what sysadmins do. You can try, but at the end of the day the most secure really is based on trust and it works remarkably well. NSA must have thousands of sysadmins (at least over the years) and we've got one that leaked things in a significant way. The system they use is not really broken, it's just embarrassing to them when it's proven imperfect. The best fix would be to simply avoid doing things that are likely to piss off ethical people like Snowden.

smileysteve 13y ago
> and we've got one that leaked things in a significant way. One that leaked to the public (Blew a Whistle). This in no way precludes previous leaks from leaking to a) Foreign Governments b) Businesses c) for Extortion purposes d) Personal use.
jules 13y ago
It's not impossible. The low tech proof that it's possible is to just put a camera on them and their screen. There are better ways, obviously.
- staunch 13y ago
  A camera would not be even close to good enough. It's trivial to type commands in a window that is not visible on your screen, for example. Keyboard logging? Not even close to good enough since you could easily break commands up or write a script that does what you want in an obfuscated way.
rwmj 13y ago
This is nonsense. The whole point of the audit tools that we (Red Hat) ship is to audit the sysadmins. This includes: auditing off machine to secure sites under control of others; having the machine hard power-off if the audit log cannot be written/sent; extremely fine-grained auditing of every command used, file read/written, etc.
- raverbashing 13y ago