4 ms·

Chilling testimony where the OPM director is being grilled. Apparently this information was accessed due to mere OPM incompetence. One has to wonder how she's

Chilling testimony where the OPM director is being grilled. Apparently this information was accessed due to mere OPM incompetence. One has to wonder how she's not fired yet: http://adam.curry.com/enc/20150618193418_opmdirectorkatherinearchulettacyberencryptionconsultant.mp3 http://adam.curry.com/enc/20150618193418_opmdirectorkatherin...

jacobolus 11y ago
This audio clip doesn’t prove anything about her personal competence, and the congressman grilling her is grandstanding. What’s she supposed to say? If the OPM shut down their systems until everything was rewritten from scratch up to some security auditors’ standards, the same congressman would be flipping tables because all the agencies relying on OPM’s systems’ operation would also grind to a halt, costing the precious taxpayers X gajilion dollars per day. Anyone else put in as director of the OPM would have done the same thing she did, and high-level decisions are being made as an institution based on internal discussion, not imposed from top down. There’s really nothing satisfactory that someone in her position is going to be able to say after an incident like this other than “we’re doing a thorough investigation of the break in and we’re doing everything we can to fix this as soon as possible.” Does the OPM undervalue security? Clearly. That’s an institutional problem though, not the director’s personal problem. More generally, most institutions don’t sufficiently value security, including government agencies everywhere in the world at every level, corporations, etc. Doing security right is expensive, and fixing up systems from the 70s and 80s without service interruption is really really expensive. As another commenter mentioned, it would be pretty great if we could divert some substantial portion of the ridiculous budget the NSA has been getting to build a massive database of everyones nude photos and web search history toward securing domestic computer systems instead.
deleted 11y ago
[deleted]

jacobolus 11y ago

This audio clip doesn’t prove anything about her personal competence, and the congressman grilling her is grandstanding. What’s she supposed to say? If the OPM shut down their systems until everything was rewritten from scratch up to some security auditors’ standards, the same congressman would be flipping tables because all the agencies relying on OPM’s systems’ operation would also grind to a halt, costing the precious taxpayers X gajilion dollars per day. Anyone else put in as director of the OPM would have done the same thing she did, and high-level decisions are being made as an institution based on internal discussion, not imposed from top down. There’s really nothing satisfactory that someone in her position is going to be able to say after an incident like this other than “we’re doing a thorough investigation of the break in and we’re doing everything we can to fix this as soon as possible.” Does the OPM undervalue security? Clearly. That’s an institutional problem though, not the director’s personal problem. More generally, most institutions don’t sufficiently value security, including government agencies everywhere in the world at every level, corporations, etc. Doing security right is expensive, and fixing up systems from the 70s and 80s without service interruption is really really expensive. As another commenter mentioned, it would be pretty great if we could divert some substantial portion of the ridiculous budget the NSA has been getting to build a massive database of everyones nude photos and web search history toward securing domestic computer systems instead.

deleted 11y ago

[deleted]