How The NSA Secures Computers

An Anonymous Reader wrote to mention an NSA site covering secure configuration guidelines for a number of operating systems. From the site: "NSA initiatives in enhancing software security cover both proprietary and open source software, and we have successfully used both proprietary and open source models in our research activities. NSA's work to enhance the security of software is motivated by one simple consideration: use our resources as efficiently as possible to give NSA's customers the best possible security options in the most widely employed products."

Comments

Re:Crushing defeat.

[cperciva]

Why do they treat our tax money so callously?

It's cheaper to replace a 3 year old disk array than it is to do all the paperwork necessary to prove that it was never used.

Because the data they protect is very sensitive

[Sycraft-fu]

The problem is that if you start to allow some things to be sold without being destroyed, the possibility that something is classified incorrectly, and thus has data on it increases. When you are dealing with TS/SCI shit, you just don't take the risk.

When it comes to spy games, there's no such thing as "parinoid enough".

Re:Crushing defeat.

[Crouty]

As your posting clearly shows even the fact that the disks were not used is an information worth keeping secret.

^BumP^

[TubeSteak]

Lol, this probably isn't as far from the truth as we think.

Part of it is that they pretty much have to spend their budget, or it'll get reduced during the next cycle.

The other thing is, lets say that they rip out all the HD's and RAM in order to auction off the hardware... well, someone has to do that, someone has to file a bunch of paperwork (in triplicate, everything is in triplicate), someone else is going to file the paperwork that's just been generated, someone else has to make sure the HD's & RAM get destroyed, more paperwork...

The costs can snowball very quickly. It may seriously be cheaper to de-mill the stuff and buy it again.

Re:Crushing defeat.

[Decker-Mage]

The problem here, familiar to anyone that has dealt with the classified security system regulations, is that as soon as that equipment went in the door it became classified equipment of some certain level. Forever after that equipment, whether it had data on it or not, is set at the level of classification, period. You can never use it with equipment of a lesser classification nor can you declassify it (which in the eyes of the requlations is using it with unclassified equipment). If you can't deal with it, sorry, but that's the way the system works and it isn't going to change as one mistake can cost not just the country but real lives.