Slashdot Mirror
How The NSA Secures Computers
An Anonymous Reader wrote to mention an NSA site covering secure configuration guidelines for a number of operating systems. From the site: "NSA initiatives in enhancing software security cover both proprietary and open source software, and we have successfully used both proprietary and open source models in our research activities. NSA's work to enhance the security of software is motivated by one simple consideration: use our resources as efficiently as possible to give NSA's customers the best possible security options in the most widely employed products."
The NSA has customers? How long do you think it'll be before Microsoft tries to 'aquire' them as the latest 'innovation' in computer security? :D
... but there are also a few guides to the applications security available: http://www.nsa.gov/snac/downloads_all.cfm
my favorite are Cisco IOS and Microsoft CA guides
As an employee of IBM (I work on enterprise storage products) I have this anecdotal story to relate:
The NSA buys lots of our gear, the large multi-terabyte enterprise-class disk storage arrays. In the case I heard about, there were a small handful of boxes. We keep track of the code loaded on each of them for support reasons, so we have a good sense of where each box is and what it's doing.
Our warranty on those arrays is 3 years.
At the end of the warranty period, it is the policy of the NSA to replace the gear outright and start fresh. What we learned was, these boxes had never been put into operation and sat on their shop floor as "excess capacity" (happens in the larger shops, it's a good idea). They had never been attached as storage to their mainframes.
The NSA crushed them. Brand new, unused and perfectly functional with ZERO data on them. Crushed to scrap.
That hurts, guys. It really does. My tax dollars paid for them, my sweat and tears makes them run, and the gov't just hauls them outside and crushes them when they can't get support via the original warranty terms. They will never let a shred of data leave their shop for fear of losing control of classified info, but damn, these never had any!
Why do they treat our tax money so callously?
the guide to securing Windows XP is actually a link to http://distrowatch.com/ so you can choose one of the many different options they have laid out for you.
My UID is a palindrome, that must be good for some type of prize.
I've read through the NSA's guidelines for securing Mac OS X before; as I recall their instructions included things like deleting the audio input drivers, so software can't record audio in the room by using the built-in microphone. Interesting stuff.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Holy shit, have we just slashdotted the NSA? I can't reach the article.
Careful now you might piss of some Vietnamese twins in South Africa if you mention that again.
The problem is that if you start to allow some things to be sold without being destroyed, the possibility that something is classified incorrectly, and thus has data on it increases. When you are dealing with TS/SCI shit, you just don't take the risk.
When it comes to spy games, there's no such thing as "parinoid enough".
So, since the NSA doesn't provide instructions on how to secure a Linux computer, they're either saying Linux is so good it doesn't need to be secured (yay slashdot mentality) or its red commie software that no freedom-loving american would dare use
Part of it is that they pretty much have to spend their budget, or it'll get reduced during the next cycle.
The other thing is, lets say that they rip out all the HD's and RAM in order to auction off the hardware... well, someone has to do that, someone has to file a bunch of paperwork (in triplicate, everything is in triplicate), someone else is going to file the paperwork that's just been generated, someone else has to make sure the HD's & RAM get destroyed, more paperwork...
The costs can snowball very quickly. It may seriously be cheaper to de-mill the stuff and buy it again.
[Fuck Beta]
o0t!
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Unless you have weak passwords, then this is not much of of a problem.
In the sshd_config you may disable password logins, and login using a certificate. In addition, you may specify which users/groups that may login:
Many of those automated attempts to bruteforce sshd is run from a Linux machine, so a simple fix (if you use the OpenBSD packet filter that is ported to NetBSD) is qute simply to drop all packets to sshd that is sendt from a Linux computer.
I have done some digging into the less accessible files in the OS, and was quite surprised to find US government things buried deep within the OS. The first thing I found were two images of key cards, and the code to support their use. The other fun thing I ran into were large emblems of the army, navy, air force, marines, FBI, noaa, coast guard, DoD, public health service, and several other US government departments. Clearly OS X has some built-in support for use in US government roles. (no images from non-US governments were found) This is in client as well as server. I'd love to know how to enable those features. Anyone happen to run across this info anywhere?
/System/Library/CoreServices/SecurityAgentPlugins/ SCLoginPlugin.bundle/Contents/Resources/)
(for those interested, in 10.3, do Go, Go to Folder...
I work for the Department of Redundancy Department.
This is not remotely new. These things have been around for YEARS, and Slashdot covered them at that time. They were written for the use of other government agencies to secure their systems when using the listed products, but they also have a great deal of value to the public. They follow all the things we've been told over the years -- put up layered defenses, stop using old, broken protocols, use those with better hashes, disable unneeded services, reduce your attack surface... Or do you believe that these are things meant to make it easier for attackers to get in?
The guides are a valuable learning tool, too, and a number of companies have followed the idea. In fact, when Microsoft wrote its own guide for securing Windows 2003, the NSA decided that it was comprehensive enough that they didn't have to write one themselves. NSA even went so far as to mirror it themselves, presumably for government convenience.
The pace of the documentation has slowed significantly; for a while, there was a new guide coming out every month or two. But every so often, they cover new topics such as evaluating wireless IDS, as well as some other more esoteric titles like So Your Boss Bought you a New Laptop...How do you identify and disable wireless capabilities. You can see a complete list of titles here.
Go try reading the original material before criticizing it. You might actually learn something and be able to earn your karma through something other than a cheap shot.
You can never go home again... but I guess you can shop there.