3 ms·

Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their

by lambda 13y ago

Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. Now, a big concern is that even if they do audit access to the wiretap data, there are still too many people who have "legitimate" access to it, and it is still hard to prevent a rogue sysadmin or programmer from bypassing those controls. Merely having all of that data makes it a high value target for attack.

skue 13y ago
> Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. This will clearly be NSA's response -- whether it's true or not -- but Snowden didn't just take random PowerPoints and internal training docs. If I'm not mistaken, he also took copies of FISA court documents and other highly classified materials that were never intended to be shared among NSA staff. I truly believe the lack of audits for these materials has destroyed NSA's credibility across the board: 1. We know that NSA hires/contracts incredibly smart and technically talented individuals who are experts at breaking into systems and avoiding detection. 2. The only way for NSA to provide reasonable controls in this environment is to create a culture of monitoring and accountability, and design all their systems from the ground up with auditing and security in mind. 3. But apparently they didn't do #2 (or never figured out how to enforce this for sysadmins), because Snowden repeatedly accessed restricted and highly classified material without an audit trail. I don't see how they can credibly admit a Snowden sized failure but still ask us to trust them with our personal data.
revelation 13y ago
Those PowerPoints are classified! Why would you think it's ok not to audit access?

by lambda 13y ago

skue 13y ago

> Remember, there is a difference between not auditing access to their internal fileservers that they keep their PowerPoints on, and not auditing access to their wiretap data. This will clearly be NSA's response -- whether it's true or not -- but Snowden didn't just take random PowerPoints and internal training docs. If I'm not mistaken, he also took copies of FISA court documents and other highly classified materials that were never intended to be shared among NSA staff. I truly believe the lack of audits for these materials has destroyed NSA's credibility across the board: 1. We know that NSA hires/contracts incredibly smart and technically talented individuals who are experts at breaking into systems and avoiding detection. 2. The only way for NSA to provide reasonable controls in this environment is to create a culture of monitoring and accountability, and design all their systems from the ground up with auditing and security in mind. 3. But apparently they didn't do #2 (or never figured out how to enforce this for sysadmins), because Snowden repeatedly accessed restricted and highly classified material without an audit trail. I don't see how they can credibly admit a Snowden sized failure but still ask us to trust them with our personal data.

revelation 13y ago

Those PowerPoints are classified! Why would you think it's ok not to audit access?