4 ms·

There is no "root access" implied in this article. Read about RBAC to understand this.

betterunix 13y ago
It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Log in as a user and you get "Hotel California" security -- you cannot escape your role. Log in as an administrator and you are not confined to any role and can just walk all over everything. Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user.
- stcredzero 13y ago
  > It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Presenting that as "impersonation" to the general public is deceptive, regardless of whether it is intended to be or not.
  - AsymetricCom 13y ago
    deception is what Snowden used to gain roles he couldn't have otherwise. It perfectly fits the definition of impersonation. By using someone else's credentials he broke the separation of duty enforcement of the RBAC model, thus he could probably escalate his privileges once he had that access. The superior who gave out his credentials probably didn't comprehend RBAC and thought he was just cutting out some red tape to chase down terrorists.
    - stcredzero 13y ago
      I thought that Snowden's whole point was that, "cutting out some red tape to chase down terrorists" could also enable bad actors in the agency to do bad things.
- AsymetricCom 13y ago
  >Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user. This is called "seperation of duties" and it's covered in the RBAC security model.
stcredzero 13y ago
If RBAC is supposed to guard against abuses, even by sysadmins, but was implemented in a way that sysadmins could get around it, and there were no effective mechanisms to prevent that, then it's all just "security theater." If Snowden pointed this out to his bosses and was ignored, then he had a legitimate reason to blow the whistle.
- betterunix 13y ago
  It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc. What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC). It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about. Finally there is the matter of auditing. It is OK to have a sysadmin who can transition to an unauthorized security level if the audit logs record it and if you frequently inspect those logs. Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.
  - stcredzero 13y ago
    (EDIT: > It is not really security theater if you consider all the other systems If it's ineffective and just serves as bureaucratic window-dressing, then it is security theater.) > What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. What specific information are you using to come to this conclusion? Also, if you put this in the context of the OP, then RBAC is immaterial to the Snowden case. That makes the article smell even more like deliberate spin-doctoring. > Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win. Then the question is, "Were they watching admins like Snowden well enough?"

It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Log in as a user and you get "Hotel California" security -- you cannot escape your role. Log in as an administrator and you are not confined to any role and can just walk all over everything. Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user.

stcredzero 13y ago
> It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Presenting that as "impersonation" to the general public is deceptive, regardless of whether it is intended to be or not.
- AsymetricCom 13y ago
  deception is what Snowden used to gain roles he couldn't have otherwise. It perfectly fits the definition of impersonation. By using someone else's credentials he broke the separation of duty enforcement of the RBAC model, thus he could probably escalate his privileges once he had that access. The superior who gave out his credentials probably didn't comprehend RBAC and thought he was just cutting out some red tape to chase down terrorists.
  - stcredzero 13y ago
    I thought that Snowden's whole point was that, "cutting out some red tape to chase down terrorists" could also enable bad actors in the agency to do bad things.
AsymetricCom 13y ago
>Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user. This is called "seperation of duties" and it's covered in the RBAC security model.

stcredzero 13y ago

If RBAC is supposed to guard against abuses, even by sysadmins, but was implemented in a way that sysadmins could get around it, and there were no effective mechanisms to prevent that, then it's all just "security theater." If Snowden pointed this out to his bosses and was ignored, then he had a legitimate reason to blow the whistle.

betterunix 13y ago
It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc. What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC). It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about. Finally there is the matter of auditing. It is OK to have a sysadmin who can transition to an unauthorized security level if the audit logs record it and if you frequently inspect those logs. Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.
- stcredzero 13y ago
  (EDIT: > It is not really security theater if you consider all the other systems If it's ineffective and just serves as bureaucratic window-dressing, then it is security theater.) > What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. What specific information are you using to come to this conclusion? Also, if you put this in the context of the OP, then RBAC is immaterial to the Snowden case. That makes the article smell even more like deliberate spin-doctoring. > Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win. Then the question is, "Were they watching admins like Snowden well enough?"