4 ms·
I present a 4th scenario: These systems are on 'known good networks' staffed by people who have some of the most extensive vetting you can get. These are the
by count 13y ago
I present a 4th scenario:
These systems are on 'known good networks' staffed by people who have some of the most extensive vetting you can get.
These are the folks who invented (or funded the development of) RBAC and the like. SELinux came out of NSA, for example. The tech exists, but it's a hastle to work with. If you've got fully-cleared, all-known-good actors, why bother?
It's not like it's on the internet, or accessible in some fashion.
- rdl 13y ago"Maybe they also put too much faith in the vetting process and external shell and less on protections within the chewy center." They put a lot of effort into screening staff, but they're also the most attractive target for well-funded adversaries (Russia, China, etc.). The only stuff I've ever seen come out of NSA and actually used by anyone in government that hasn't been crap has been hardware. SELinux, etc. are a sideshow. Their OS protections as deployed elsewhere in government are primarily COTS or were developed by external contractors (HBSS, etc.), and are actually shittier in a lot of ways than best commercial practice.
- joshfraser 13y agoI can see why trust their people and their vetting process. They get to read your email and snoop through your browsing history before they hire you.