4 ms·

Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (po

by mokus 11y ago

Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (potential to cause "exceptionally grave harm" if compromised). I really think Archuleta and Seymour should be brought up on criminal charges for mishandling information that should have been classified Top Secret and likely also should have been associated with a special-access program. Even if the records for an individual person don't rise to that level, 20-ish million of them together absolutely do. That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.

x0x0 11y ago
Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
- toyg 11y ago
  The political and economic capital. Big stack updates like this cost a pretty penny. Who's going to advocate for increased taxation to secure a bunch of admin databases?

by mokus 11y ago

x0x0 11y ago

Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...

toyg 11y ago
The political and economic capital. Big stack updates like this cost a pretty penny. Who's going to advocate for increased taxation to secure a bunch of admin databases?