Slashdot Mirror
NSA Considers Its Networks Compromised
Orome1 writes "Debora Plunkett, head of the NSA's Information Assurance Directorate, has confirmed what many security experts suspected to be true: no computer network can be considered completely and utterly impenetrable — not even that of the NSA. 'There's no such thing as "secure" any more,' she said to the attendees of a cyber security forum sponsored by the Atlantic and Government Executive media organizations, and confirmed that the NSA works under the assumption that various parts of their systems have already been compromised, and is adjusting its actions accordingly."
What I can't fathom is that there is still people out there believing that a firewall is all the protection they need. Or that it is a protection they need, even.
Not Secure After-all
Security is achievable provided you start with good parameters. Believing your systems are "unhackable" is silly. No physical security is impenetrable, why would electronic security be different? But what you can do is make the cost of breaching that security more than the value of whatever it is being protected. Keep in mind though that what you're protecting also includes access, not just the data itself.
Problem is, in the private sector you have all these companies trying to control the internet, instead of keeping it as a public commons. The net result is that the cost to access it is often the main price consideration, at least in the United States.
#fuckbeta #iamslashdot #dicemustdie
The idea of sticking all my data out in cyberspace on somebody else's servers always seemed a little fluffy anyway.
Is the one buried a mile under ground in 100' radius of concrete connected to nothing. Preferably in an undisclosed location. Even then, it is only as secure as the guards protecting it.
They probably figured it out a long time ago, what they're doing now is admitting it.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
Not quite true. There are useful non-networked machines. And they can still be compromised, if you can just get access to some removeable media that's going to end up connected.
In other words, no internal trust. You eliminate all assumptions in-house with the requisite sandboxes, minimal privileges, etc. Like prison: no one is your friend, you merely have alliances that can be severed at the moment that trust is no longer needed.
The best thing about a boolean is even if you are wrong, you are only off by a bit.
Complete security is a fleeting deception. What we need is RESILIENCY to cope with the attacks (physical or cyber) which will inevitably occur. Wise people have known that for approximately forever (that's how we got this thing called the Internet, after all).
Any good security policy assumes that, if the system has not already been penetrated, it will be soon. There must be procedures for detecting intrusions, repairing weaknesses and plugging holes, and compartmentalizing data so as to minimize damage once a part of the system has been breached. And there needs to be ongoing R&D into the various techniques the enemy could use to break into systems and applicable countermeasures.
What scares me is that the NSA is "adjusting its actions accordingly". They should have been thinking this way from day zero.
Have gnu, will travel.
So to me this raises a fundamental philosophical question: why keep secrets at all, as a government?
Because we need the military to protect us. You wouldn't want an enemy country to know all about the military operations in your country. And before you propose to completely eliminate the military, remember 1939.
If you've played around with any rootkits you know how devious an attacker can be with your system. If you read about the Gawker story, they had a couple signals that their systems were compromised but nothing catastrophic had happened so they carried on their merry way.
This is how most businesses are approaching IT security: if it ain't broke, don't fix it.
It almost takes a govt organization to sit down and say "wait a minute, we could be hacked and not even know it". Especially a very, very high profile target like the NSA. They're facing legions of hackers funded by foreign governments. This isn't the dawn of the Internet anymore, it has to be taken seriously.
They didn't say their networks are compromised. To be on the safe side, they just assume they are.
What considering "the assumption that various parts of their systems have already been compromised" means is that you go away from that model.
There can be multiple levels, walls between various areas, zones according to task, etc. And the auditing system can be much more complex than a firewall.
Think of something like the "unusual activity" trigger software for your credit card. Low ranking security person reading a low level cable? -fine. Reading 10000 cables in one hour? very unusual.
The NSA know their stuff, I see this talk not as someone admitting that they are compromised, but as someone talking shop.
What? You mean there's another option?
Any network administrator worth half their income should always consider their LAN to be compromised. That's why you use secure transfer protocols to transfer any data containing any sensitive information between company systems. That's why you have active network monitors that turn off network ports when they encounter an unknown MAC address. That's why you don't allow anonymous logins to your active directory, and you strictly control access to everything by at least department.
Security is done in layers. Firewalls can and will be breached. If it is, your goal is to slow the attacker down until you can detect the breach and close it. Honeypot servers, data encryption, network segmentation, network resource security, all of these things are vital.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
I was going to post essentially the same thing. There are secrets that are secret for a reason that isn't evil of nefarious. Take the list of critical US infrastructure that Wikileaks published. There is nothing to be gained by having 100% transparency on that and everything to lose since it's basically a blue print on how to attack the US.
If I read the post correctly, the NSA did not say their computer network had been compromised, They said they worked under the assumption that it had been. The two are not the same thing. Any intelligence organization must work under the assumption that it has been penetrated. This does not mean that the organization does not do everything in its power to avoid this, but that, knowing the opposition is trying to penetrate, the best assumption operationally is that the penetration has already occurred.
Being paranoid? Which is what they should be don't you think?
This is not the funny you're looking for.
'Hope for the best, assume the worst' should be the mantra for everyone working in any kind of security. Glad to see the NSA living up to that.
I wonder, though, if the prominence of Wikileaks had anything to do with this, and I don't mean specifically, as in they anticipate a lot of NSA-related document drops in the near future, but more generally, as in the landscape has changed and Wikileaks is a signifier.
Linux, you magnificent bastard, I read the fucking manual!
Well you see it's like this... As a former soldier I'd have been a bit miffed to be say, escorting a convoy, only to discover that bad people with guns knew my route, numbers of troops, and level of armament. It really ruins your day when bad people show up in precisely the right place with way more troops and guns than you have. Especially if they set up explosives. That takes things to whole new level of "ruined day". And before you comment on my simplistic view of "bad people", please understand that my overall opinion of you shifts dramatically toward "bad" when you start shooting at me. As far as I am concerned anyone who shoots at me is by definition a "bad person", no matter what their initial motivation may have been.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
The fact that we outsource chip fabrication ought to be a clue as to why they can't pretend any more.
OT: It's even money that every piece of military hardware with computers has an illicit kill switch embedded in it.
Game over USA.
Take the list of critical US infrastructure that Wikileaks published. There is nothing to be gained by having 100% transparency on that and everything to lose since it's basically a blue print on how to attack the US.
Do you really think the bad guys don't know these things?
I remember when I was a kid there was a nuclear weapons store a few miles from where we lived. Everyone knew it was there, the USSR could see it on their satellite photos, but strangely it was completely missing from any official maps of the area. Who was that secrecy supposed to be protecting?
Do you really think the bad guys don't know these things?
Suspecting it and actually confirming it for them with an official US government document are two separate things. And you still haven't given a reason why it should be released.
Your analogy is a bit of a stretch, and a bit off topic...
To make an analogy of your analogy, it's as if you are trying to equate someone who assumes they already been exposed to the cold virus and is trying to drink lots of juice, eat chicken soup, and look for symptoms to validate the assumption that their health has compromised to someone who assumes their wife is sleeping with the mailman so he shoots the mailman.
Suspecting it and actually confirming it for them with an official US government document are two separate things.
Assuming that bin Laden actually believes said document and doesn't assume it's disinformation.
And you still haven't given a reason why it should be released.
Because if someone sees they're working at a place which is officially listed as 'critical infrastructure' then they might take security more seriously? Or, horrors, someone completely unrelated to the operations might come up with a way to make it less critical?
There are plenty of reasons why this openness be a good thing rather than a bad thing. For example, I was reading an anecdote by a British airbase worker a while back saying how he was on occasion left to 'protect' a nuclear-armed bomber by himself at night and all he had as a weapon was a pickaxe handle. You could argue that letting people know that the RAF was so broke that all it could do to prevent people from stealing nuclear weapons was send a guy out to stand by the plane with a pickaxe handle would be an invitation to anyone to come and steal some, but you could equally well argue that if the population of Britain knew that was the RAF's idea of nuclear security then the politicos would be forced to provide some actual real security within days of that information getting out.
It always makes sense to operate based on the assumption that you may already be compromised. If you take a look at your data, and you think that impenetrable firewall is going to keep people from accessing it, you're delusional. Security, or lack thereof, is measured in time. If what you're securing is important, the question is not can this information be accessed but how long until it can be accessed. Compartmentalization is an important part of any security plan. Finding ways of keeping people out is something the security field has been working on for ages. Have different passwords for everything. Change passwords regularly. Audit data accesses. Watch for suspicious behavior. Keep off-site backup of data and forensics information. Create different subnets and VLANs to segregate traffic. Train all employees in basic security measures. Ensure that no employees are above security - no backdoors, everything audited. I'd say the most important thing to recognize, though, is exactly what they said: unless a resource is sitting in a heavily-guarded Faraday-cage, inside a vault, turned off, and not connected to anything else, it can not be considered 100% secure. Everything else is risk management.
They didn't say their networks are compromised. To be on the safe side, they just assume they are.
Yep it's a RIAA/MPAA model. Assume guilt until proven otherwise, in this case compromised until proven otherwise. Makes you wonder what the NSA is really good for.
Wow...you've leaped from a national security organization adopting a policy of extreme care to a comparison with the recording industry lawsuits. Do you have some sort of associative-compulsive disorder or are you really stating there is any relationship between the two? Or are you just bitter?
Advice: on VPS providers
Iran thought that, but sneakernets are capable of transmitting viruses behind airwalls.
Hoist Number One and Number Six.