Slashdot Mirror
NSA Considers Its Networks Compromised
Orome1 writes "Debora Plunkett, head of the NSA's Information Assurance Directorate, has confirmed what many security experts suspected to be true: no computer network can be considered completely and utterly impenetrable — not even that of the NSA. 'There's no such thing as "secure" any more,' she said to the attendees of a cyber security forum sponsored by the Atlantic and Government Executive media organizations, and confirmed that the NSA works under the assumption that various parts of their systems have already been compromised, and is adjusting its actions accordingly."
What I can't fathom is that there is still people out there believing that a firewall is all the protection they need. Or that it is a protection they need, even.
Not Secure After-all
Security is achievable provided you start with good parameters. Believing your systems are "unhackable" is silly. No physical security is impenetrable, why would electronic security be different? But what you can do is make the cost of breaching that security more than the value of whatever it is being protected. Keep in mind though that what you're protecting also includes access, not just the data itself.
Problem is, in the private sector you have all these companies trying to control the internet, instead of keeping it as a public commons. The net result is that the cost to access it is often the main price consideration, at least in the United States.
#fuckbeta #iamslashdot #dicemustdie
The idea of sticking all my data out in cyberspace on somebody else's servers always seemed a little fluffy anyway.
Is the one buried a mile under ground in 100' radius of concrete connected to nothing. Preferably in an undisclosed location. Even then, it is only as secure as the guards protecting it.
They probably figured it out a long time ago, what they're doing now is admitting it.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
In other words, no internal trust. You eliminate all assumptions in-house with the requisite sandboxes, minimal privileges, etc. Like prison: no one is your friend, you merely have alliances that can be severed at the moment that trust is no longer needed.
The best thing about a boolean is even if you are wrong, you are only off by a bit.
Complete security is a fleeting deception. What we need is RESILIENCY to cope with the attacks (physical or cyber) which will inevitably occur. Wise people have known that for approximately forever (that's how we got this thing called the Internet, after all).
Any good security policy assumes that, if the system has not already been penetrated, it will be soon. There must be procedures for detecting intrusions, repairing weaknesses and plugging holes, and compartmentalizing data so as to minimize damage once a part of the system has been breached. And there needs to be ongoing R&D into the various techniques the enemy could use to break into systems and applicable countermeasures.
What scares me is that the NSA is "adjusting its actions accordingly". They should have been thinking this way from day zero.
Have gnu, will travel.
So to me this raises a fundamental philosophical question: why keep secrets at all, as a government?
Because we need the military to protect us. You wouldn't want an enemy country to know all about the military operations in your country. And before you propose to completely eliminate the military, remember 1939.
If you've played around with any rootkits you know how devious an attacker can be with your system. If you read about the Gawker story, they had a couple signals that their systems were compromised but nothing catastrophic had happened so they carried on their merry way.
This is how most businesses are approaching IT security: if it ain't broke, don't fix it.
It almost takes a govt organization to sit down and say "wait a minute, we could be hacked and not even know it". Especially a very, very high profile target like the NSA. They're facing legions of hackers funded by foreign governments. This isn't the dawn of the Internet anymore, it has to be taken seriously.
They didn't say their networks are compromised. To be on the safe side, they just assume they are.
What considering "the assumption that various parts of their systems have already been compromised" means is that you go away from that model.
There can be multiple levels, walls between various areas, zones according to task, etc. And the auditing system can be much more complex than a firewall.
Think of something like the "unusual activity" trigger software for your credit card. Low ranking security person reading a low level cable? -fine. Reading 10000 cables in one hour? very unusual.
The NSA know their stuff, I see this talk not as someone admitting that they are compromised, but as someone talking shop.
What? You mean there's another option?
Any network administrator worth half their income should always consider their LAN to be compromised. That's why you use secure transfer protocols to transfer any data containing any sensitive information between company systems. That's why you have active network monitors that turn off network ports when they encounter an unknown MAC address. That's why you don't allow anonymous logins to your active directory, and you strictly control access to everything by at least department.
Security is done in layers. Firewalls can and will be breached. If it is, your goal is to slow the attacker down until you can detect the breach and close it. Honeypot servers, data encryption, network segmentation, network resource security, all of these things are vital.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
'Hope for the best, assume the worst' should be the mantra for everyone working in any kind of security. Glad to see the NSA living up to that.
I wonder, though, if the prominence of Wikileaks had anything to do with this, and I don't mean specifically, as in they anticipate a lot of NSA-related document drops in the near future, but more generally, as in the landscape has changed and Wikileaks is a signifier.
Linux, you magnificent bastard, I read the fucking manual!
Well you see it's like this... As a former soldier I'd have been a bit miffed to be say, escorting a convoy, only to discover that bad people with guns knew my route, numbers of troops, and level of armament. It really ruins your day when bad people show up in precisely the right place with way more troops and guns than you have. Especially if they set up explosives. That takes things to whole new level of "ruined day". And before you comment on my simplistic view of "bad people", please understand that my overall opinion of you shifts dramatically toward "bad" when you start shooting at me. As far as I am concerned anyone who shoots at me is by definition a "bad person", no matter what their initial motivation may have been.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
The fact that we outsource chip fabrication ought to be a clue as to why they can't pretend any more.
OT: It's even money that every piece of military hardware with computers has an illicit kill switch embedded in it.
Game over USA.
Do you really think the bad guys don't know these things?
Suspecting it and actually confirming it for them with an official US government document are two separate things. And you still haven't given a reason why it should be released.
It always makes sense to operate based on the assumption that you may already be compromised. If you take a look at your data, and you think that impenetrable firewall is going to keep people from accessing it, you're delusional. Security, or lack thereof, is measured in time. If what you're securing is important, the question is not can this information be accessed but how long until it can be accessed. Compartmentalization is an important part of any security plan. Finding ways of keeping people out is something the security field has been working on for ages. Have different passwords for everything. Change passwords regularly. Audit data accesses. Watch for suspicious behavior. Keep off-site backup of data and forensics information. Create different subnets and VLANs to segregate traffic. Train all employees in basic security measures. Ensure that no employees are above security - no backdoors, everything audited. I'd say the most important thing to recognize, though, is exactly what they said: unless a resource is sitting in a heavily-guarded Faraday-cage, inside a vault, turned off, and not connected to anything else, it can not be considered 100% secure. Everything else is risk management.
They didn't say their networks are compromised. To be on the safe side, they just assume they are.
Yep it's a RIAA/MPAA model. Assume guilt until proven otherwise, in this case compromised until proven otherwise. Makes you wonder what the NSA is really good for.
Wow...you've leaped from a national security organization adopting a policy of extreme care to a comparison with the recording industry lawsuits. Do you have some sort of associative-compulsive disorder or are you really stating there is any relationship between the two? Or are you just bitter?
Advice: on VPS providers
Iran thought that, but sneakernets are capable of transmitting viruses behind airwalls.
Hoist Number One and Number Six.