6 ms·

What a mess, but does highlight the fact that you know, when you gather a lot of information on people, you become a target. They really just do all the hard wo

What a mess, but does highlight the fact that you know, when you gather a lot of information on people, you become a target. They really just do all the hard work, and make it easy for the criminals. Obviously, a huge blunder of government, totally irresponsible and reckless that such a massive breach was even possible. And it happened in dec 2014, and they only just now found out. A team of amateurs could do better than that. I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened. But it's clear that's not what their priorities are. Really, just disgusted by this. That said, what did they do wrong? what should they have done, that they didn't do? Getting hacked seems like an eventuality at some level. What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection? Seems like you'd have to partition up your data at some level, maybe encrypt it at rest; but I don't know how far one has to go.

EthanHeilman 11y ago
>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened. The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy. For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns. Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA. >What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection? * Keep it offline/airgapped. * Store the most dangerous data on paper with hashes replicated online to insure integrity. * Delete information you don't need anymore. * Do not have a centralized repository of data to reduce risk of catastrophic exposure. There are always trade offs between usability, functionality and security. [1]: https://twitter.com/ethan_heilman/status/510993743156375552 https://twitter.com/ethan_heilman/status/510993743156375552 [2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses
- meesterdude 11y ago
  Thank you for this. great write up, and totally on point. > * Keep it offline/airgapped. Agreeable, but what about physical access? What about compromised individuals, or nefarious agents? > * Store the most dangerous data on paper with hashes replicated online to insure integrity. Interesting; i guess that reduces the accessibility of the information, so it's harder for you and harder for someone else. Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) > * Do not have a centralized repository of data to reduce risk of catastrophic exposure. Also a great point too; and pretty contrary to how we typically design systems. Thanks again!
  - EthanHeilman 11y ago
    > what about physical access? What about compromised individuals, or nefarious agents? Always a risk and a very hard problem to solve since someone always needs access and that person can be compromised. Detecting and preventing this is what counter-intelligence is for, but counter-intelligence is never a guarantee of security. You can trade off usability for security to slow the speed at which an attacker can copy everything giving you more time to detect the activity. This only makes sense if they information is exceptionally important to protect. That being said, even paper can be stolen in large quantities. Jonathan Pollard managed to steal quite a bit of classified paper from the US during his tenure. The Israeli's needed multiple highspeed copying machines to keep up with his output [1]. One could imagine a system in which records are stored in multiple places and people only have access to the local files. No one agent could compromise the entire system. Then again, you might be so secure you protect the information from yourself and may not be able to "connect the dots" which is probably what you have the information for in the first place. As Snowden suggested, "The Two Man Rule" [2] can also make enemies spies jobs harder. While it is true a determined attacker can overcome it by gaining the other parties credentials, such actions raise the risk the spy being caught. A very silly idea: I've been told on older nuclear armed submarines the device used to launch the missiles must be carried from one part of the sub to another to begin the launch sequence. The device was extremely heavy and awkward requiring multiple people to move it and making the movement of it very obvious and loud. Thus, they accidentally achieved an additional "Two Man Rule". Perhaps if very secret information was encrypted and then stored on heavy large objects which could only be read/decrypted at another location in the building than it would be difficult to quickly steal and decrypt many of the files. A computational version of this would be a cipher that requires massive resources (memory, CPU) to decrypt. This is likely more fantasy than reality, but at least enemies spies would have to break a sweat. >Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) I've been working on a blog post on it, but I don't really have enough content to flesh it out and make it worth reading at the moment. [1]: https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=PT66&dq=Jonathan+Pollard+xerox&source=bl&ots=O38QZx4Gg4&sig=hu-D_Sv2wGjhMcyJN4XglJZNc0Y&hl=en&sa=X&ved=0CCYQ6AEwAWoVChMIydO4y5eNxgIVBRSSCh10yQAX#v=onepage&q=Jonathan%20Pollard%20xerox&f=false https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=P... [2]: https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
pdkl95 11y ago
> when you gather a lot of information on people, you become a target The uncomfortable truth for many HN readers is that this is also true for all of that user data that businesses are currently aggregating: from the data people trust an online service to manage to the modern version of "library records" we call analytics. Thee is value in all of this, or it wouldn't be worth paying to collect/store it. Unfortunately, even if the data is collected with the best intentions, the fact that the database exists creates a target that must secured. It also creates an "attractive nuisance" for governments holding national security letters and PRISM. Those are troubling enough, but gathering data about people has another risk that is rarely addressed: moral hazard. There is always the temptation to sell that data to the highest bidder, which we have seen happen many times as businesses look to find new ways to "monetize" their users.
- a3n 11y ago
  I suspect a lot of this data that's commercially collected, directly by services and indirectly by advertising and analytics networks, will eventually end up in the digital storage closet, forgotten and eventually discovered by criminals just rooting around. Especially after acquisitions.
zaphar 11y ago
For the sf-86 data it really should have been stored on an air gapped network, encrypted, with physical security. That type of data is far too valuable to leave connected to a publicly accessible network in any way.
guscost 11y ago
This is said with tongue in cheek, but they could have bought that CyFIR product a year earlier.

EthanHeilman 11y ago

>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened. The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy. For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns. Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA. >What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection? * Keep it offline/airgapped. * Store the most dangerous data on paper with hashes replicated online to insure integrity. * Delete information you don't need anymore. * Do not have a centralized repository of data to reduce risk of catastrophic exposure. There are always trade offs between usability, functionality and security. [1]: https://twitter.com/ethan_heilman/status/510993743156375552 https://twitter.com/ethan_heilman/status/510993743156375552 [2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses

meesterdude 11y ago
Thank you for this. great write up, and totally on point. > * Keep it offline/airgapped. Agreeable, but what about physical access? What about compromised individuals, or nefarious agents? > * Store the most dangerous data on paper with hashes replicated online to insure integrity. Interesting; i guess that reduces the accessibility of the information, so it's harder for you and harder for someone else. Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) > * Do not have a centralized repository of data to reduce risk of catastrophic exposure. Also a great point too; and pretty contrary to how we typically design systems. Thanks again!
- EthanHeilman 11y ago
  > what about physical access? What about compromised individuals, or nefarious agents? Always a risk and a very hard problem to solve since someone always needs access and that person can be compromised. Detecting and preventing this is what counter-intelligence is for, but counter-intelligence is never a guarantee of security. You can trade off usability for security to slow the speed at which an attacker can copy everything giving you more time to detect the activity. This only makes sense if they information is exceptionally important to protect. That being said, even paper can be stolen in large quantities. Jonathan Pollard managed to steal quite a bit of classified paper from the US during his tenure. The Israeli's needed multiple highspeed copying machines to keep up with his output [1]. One could imagine a system in which records are stored in multiple places and people only have access to the local files. No one agent could compromise the entire system. Then again, you might be so secure you protect the information from yourself and may not be able to "connect the dots" which is probably what you have the information for in the first place. As Snowden suggested, "The Two Man Rule" [2] can also make enemies spies jobs harder. While it is true a determined attacker can overcome it by gaining the other parties credentials, such actions raise the risk the spy being caught. A very silly idea: I've been told on older nuclear armed submarines the device used to launch the missiles must be carried from one part of the sub to another to begin the launch sequence. The device was extremely heavy and awkward requiring multiple people to move it and making the movement of it very obvious and loud. Thus, they accidentally achieved an additional "Two Man Rule". Perhaps if very secret information was encrypted and then stored on heavy large objects which could only be read/decrypted at another location in the building than it would be difficult to quickly steal and decrypt many of the files. A computational version of this would be a cipher that requires massive resources (memory, CPU) to decrypt. This is likely more fantasy than reality, but at least enemies spies would have to break a sweat. >Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) I've been working on a blog post on it, but I don't really have enough content to flesh it out and make it worth reading at the moment. [1]: https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=PT66&dq=Jonathan+Pollard+xerox&source=bl&ots=O38QZx4Gg4&sig=hu-D_Sv2wGjhMcyJN4XglJZNc0Y&hl=en&sa=X&ved=0CCYQ6AEwAWoVChMIydO4y5eNxgIVBRSSCh10yQAX#v=onepage&q=Jonathan%20Pollard%20xerox&f=false https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=P... [2]: https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule

pdkl95 11y ago

> when you gather a lot of information on people, you become a target The uncomfortable truth for many HN readers is that this is also true for all of that user data that businesses are currently aggregating: from the data people trust an online service to manage to the modern version of "library records" we call analytics. Thee is value in all of this, or it wouldn't be worth paying to collect/store it. Unfortunately, even if the data is collected with the best intentions, the fact that the database exists creates a target that must secured. It also creates an "attractive nuisance" for governments holding national security letters and PRISM. Those are troubling enough, but gathering data about people has another risk that is rarely addressed: moral hazard. There is always the temptation to sell that data to the highest bidder, which we have seen happen many times as businesses look to find new ways to "monetize" their users.

a3n 11y ago
I suspect a lot of this data that's commercially collected, directly by services and indirectly by advertising and analytics networks, will eventually end up in the digital storage closet, forgotten and eventually discovered by criminals just rooting around. Especially after acquisitions.

zaphar 11y ago

For the sf-86 data it really should have been stored on an air gapped network, encrypted, with physical security. That type of data is far too valuable to leave connected to a publicly accessible network in any way.

guscost 11y ago

This is said with tongue in cheek, but they could have bought that CyFIR product a year earlier.