6 ms·

>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's ci

>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened. The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy. For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns. Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA. >What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection? * Keep it offline/airgapped. * Store the most dangerous data on paper with hashes replicated online to insure integrity. * Delete information you don't need anymore. * Do not have a centralized repository of data to reduce risk of catastrophic exposure. There are always trade offs between usability, functionality and security. [1]: https://twitter.com/ethan_heilman/status/510993743156375552 https://twitter.com/ethan_heilman/status/510993743156375552 [2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses

meesterdude 11y ago
Thank you for this. great write up, and totally on point. > * Keep it offline/airgapped. Agreeable, but what about physical access? What about compromised individuals, or nefarious agents? > * Store the most dangerous data on paper with hashes replicated online to insure integrity. Interesting; i guess that reduces the accessibility of the information, so it's harder for you and harder for someone else. Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) > * Do not have a centralized repository of data to reduce risk of catastrophic exposure. Also a great point too; and pretty contrary to how we typically design systems. Thanks again!
- EthanHeilman 11y ago
  > what about physical access? What about compromised individuals, or nefarious agents? Always a risk and a very hard problem to solve since someone always needs access and that person can be compromised. Detecting and preventing this is what counter-intelligence is for, but counter-intelligence is never a guarantee of security. You can trade off usability for security to slow the speed at which an attacker can copy everything giving you more time to detect the activity. This only makes sense if they information is exceptionally important to protect. That being said, even paper can be stolen in large quantities. Jonathan Pollard managed to steal quite a bit of classified paper from the US during his tenure. The Israeli's needed multiple highspeed copying machines to keep up with his output [1]. One could imagine a system in which records are stored in multiple places and people only have access to the local files. No one agent could compromise the entire system. Then again, you might be so secure you protect the information from yourself and may not be able to "connect the dots" which is probably what you have the information for in the first place. As Snowden suggested, "The Two Man Rule" [2] can also make enemies spies jobs harder. While it is true a determined attacker can overcome it by gaining the other parties credentials, such actions raise the risk the spy being caught. A very silly idea: I've been told on older nuclear armed submarines the device used to launch the missiles must be carried from one part of the sub to another to begin the launch sequence. The device was extremely heavy and awkward requiring multiple people to move it and making the movement of it very obvious and loud. Thus, they accidentally achieved an additional "Two Man Rule". Perhaps if very secret information was encrypted and then stored on heavy large objects which could only be read/decrypted at another location in the building than it would be difficult to quickly steal and decrypt many of the files. A computational version of this would be a cipher that requires massive resources (memory, CPU) to decrypt. This is likely more fantasy than reality, but at least enemies spies would have to break a sweat. >Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) I've been working on a blog post on it, but I don't really have enough content to flesh it out and make it worth reading at the moment. [1]: https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=PT66&dq=Jonathan+Pollard+xerox&source=bl&ots=O38QZx4Gg4&sig=hu-D_Sv2wGjhMcyJN4XglJZNc0Y&hl=en&sa=X&ved=0CCYQ6AEwAWoVChMIydO4y5eNxgIVBRSSCh10yQAX#v=onepage&q=Jonathan%20Pollard%20xerox&f=false https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=P... [2]: https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
munin 11y ago
all of your points totally undermine the benefits of centralization and computerization. perhaps that is the point and that there are some things that should just not be digitized or made "easy to do," but security people also recognize that security is often not the end goal. creating a usable system where the reward outweighs the risk is the goal. if the reward, despite this risk/vulnerability, is still very high, then we'll probably keep doing it. your points are what you would want to do if you wanted to make an ideally secure system, but nobody wants only an ideally secure system...
- EthanHeilman 11y ago
  100% agree! Typically you do not want to trade off usability for security, but there are situations in which you do. The question then becomes how much do you trade off and are there solutions that give you similar gains but don't involve trade offs? I'm just proposing some tools which might be useful when security is significantly more important than other considerations.
  - munin 11y ago
    I don't think that this is a case where you want to trade off security for usability, and I don't think that generally those cases exist. You always want more usability. The problems that OPM has are massive, their solutions need to scale. Solutions like what you propose make their solutions stop scaling. Security people (and armchair security people especially) think that security is the end goal. Security is never the end goal. The mission is the end goal. Security is only useful in so much as it helps you achieve the mission. Sometimes security needs to get out of the way when the mission needs to get done. It is always a tradeoff. The personnel clearance system is already such a tradeoff, a background investigation system that needs to scale to millions of people. Good luck making it "ideally secure." There were data hygiene and application/network security best practices that OPM should have followed. In hindsight, they would have been way cheaper than the response to a breach like this. Responding by taking all the systems offline would most likely be far more expensive to the system as a whole than a future breach.
    - 11y ago

meesterdude 11y ago

Thank you for this. great write up, and totally on point. > * Keep it offline/airgapped. Agreeable, but what about physical access? What about compromised individuals, or nefarious agents? > * Store the most dangerous data on paper with hashes replicated online to insure integrity. Interesting; i guess that reduces the accessibility of the information, so it's harder for you and harder for someone else. Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) > * Do not have a centralized repository of data to reduce risk of catastrophic exposure. Also a great point too; and pretty contrary to how we typically design systems. Thanks again!

EthanHeilman 11y ago
> what about physical access? What about compromised individuals, or nefarious agents? Always a risk and a very hard problem to solve since someone always needs access and that person can be compromised. Detecting and preventing this is what counter-intelligence is for, but counter-intelligence is never a guarantee of security. You can trade off usability for security to slow the speed at which an attacker can copy everything giving you more time to detect the activity. This only makes sense if they information is exceptionally important to protect. That being said, even paper can be stolen in large quantities. Jonathan Pollard managed to steal quite a bit of classified paper from the US during his tenure. The Israeli's needed multiple highspeed copying machines to keep up with his output [1]. One could imagine a system in which records are stored in multiple places and people only have access to the local files. No one agent could compromise the entire system. Then again, you might be so secure you protect the information from yourself and may not be able to "connect the dots" which is probably what you have the information for in the first place. As Snowden suggested, "The Two Man Rule" [2] can also make enemies spies jobs harder. While it is true a determined attacker can overcome it by gaining the other parties credentials, such actions raise the risk the spy being caught. A very silly idea: I've been told on older nuclear armed submarines the device used to launch the missiles must be carried from one part of the sub to another to begin the launch sequence. The device was extremely heavy and awkward requiring multiple people to move it and making the movement of it very obvious and loud. Thus, they accidentally achieved an additional "Two Man Rule". Perhaps if very secret information was encrypted and then stored on heavy large objects which could only be read/decrypted at another location in the building than it would be difficult to quickly steal and decrypt many of the files. A computational version of this would be a cipher that requires massive resources (memory, CPU) to decrypt. This is likely more fantasy than reality, but at least enemies spies would have to break a sweat. >Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?) I've been working on a blog post on it, but I don't really have enough content to flesh it out and make it worth reading at the moment. [1]: https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=PT66&dq=Jonathan+Pollard+xerox&source=bl&ots=O38QZx4Gg4&sig=hu-D_Sv2wGjhMcyJN4XglJZNc0Y&hl=en&sa=X&ved=0CCYQ6AEwAWoVChMIydO4y5eNxgIVBRSSCh10yQAX#v=onepage&q=Jonathan%20Pollard%20xerox&f=false https://books.google.com/books?id=MDZlAgAAQBAJ&pg=PT66&lpg=P... [2]: https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule

munin 11y ago

all of your points totally undermine the benefits of centralization and computerization. perhaps that is the point and that there are some things that should just not be digitized or made "easy to do," but security people also recognize that security is often not the end goal. creating a usable system where the reward outweighs the risk is the goal. if the reward, despite this risk/vulnerability, is still very high, then we'll probably keep doing it. your points are what you would want to do if you wanted to make an ideally secure system, but nobody wants only an ideally secure system...

EthanHeilman 11y ago
100% agree! Typically you do not want to trade off usability for security, but there are situations in which you do. The question then becomes how much do you trade off and are there solutions that give you similar gains but don't involve trade offs? I'm just proposing some tools which might be useful when security is significantly more important than other considerations.
- munin 11y ago
  I don't think that this is a case where you want to trade off security for usability, and I don't think that generally those cases exist. You always want more usability. The problems that OPM has are massive, their solutions need to scale. Solutions like what you propose make their solutions stop scaling. Security people (and armchair security people especially) think that security is the end goal. Security is never the end goal. The mission is the end goal. Security is only useful in so much as it helps you achieve the mission. Sometimes security needs to get out of the way when the mission needs to get done. It is always a tradeoff. The personnel clearance system is already such a tradeoff, a background investigation system that needs to scale to millions of people. Good luck making it "ideally secure." There were data hygiene and application/network security best practices that OPM should have followed. In hindsight, they would have been way cheaper than the response to a breach like this. Responding by taking all the systems offline would most likely be far more expensive to the system as a whole than a future breach.
  - 11y ago