The OPM Data Breach [pdf] • Hacker News Board

Re: The OPM Data Breach [pdf]

#91

Post by jessaustin » Fri, Sep 09, 2016, 4:26 AM UTC

wrs wrote: post #88

missed_out wrote: post #33

Earlier quoted context omitted.

After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

Seriously? I don't think I've ever seen a security policy where it was not written that you cannot share passwords!

This was probably at State Department. They have difficulty communicating security guidelines to staff and management.

Re: The OPM Data Breach [pdf]

#92

Post by Godel_unicode » Fri, Sep 09, 2016, 5:00 AM UTC

ztratar wrote: post #47

tptacek wrote: post #27

Earlier quoted context omitted.

I simply disagree with you.

If you're disagreeing that you "need" to provide proof as a duty, then you're correct. If you're disagreeing that you "need" to provide proof because your claim is substantiated intrinsically, then you're being pompous and lazy.

This. HN famous != Claims need not be backed by evidence.

Re: The OPM Data Breach [pdf]

#93

Post by Godel_unicode » Fri, Sep 09, 2016, 5:06 AM UTC

rdtsc wrote: post #11

If only we had an agency in charge of protecting and securing these kinds of systems. It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Stolen stuff includes…

> If only we had an agency in charge of protecting and securing these kinds of systems.

Firstly, why do you insist in letting OPM off the hook?

Secondly, even if we stipulate that OPM isn't at fault and that someone should have stopped this, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us

Re: The OPM Data Breach [pdf]

#94

Post by Godel_unicode » Fri, Sep 09, 2016, 5:11 AM UTC

BoringCode wrote: post #34

rdtsc wrote: post #30

Earlier quoted context omitted.

> The NSA can't make another federal agency improve its computer security. Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes. > Do you want…

> Nobody seems to be in charge. That's indeed the problem. There was a strong push for a while to put NSA in charge of civilian infosec infrastructure. But Congress didn't really want to put a combat support agency in that role. So DHS is technically in charge of that. But we still have the majority of federal agencies stuck fending for themselves when it comes to securing their networks. Without stronger action from…

> Without stronger action from Congress, this may never change.

You should go read the cybersecurity act passed in December of 2015, and realize that DHS is now authorized to force agencies to use it's security and offerings.

Re: The OPM Data Breach [pdf]

#95

Post by [deleted] » Fri, Sep 09, 2016, 5:15 AM UTC

kardashian007 wrote: post #42

missed_out wrote: post #33

Earlier quoted context omitted.

After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

Sucks. Consider writing a book / get in touch with theintercept on a new machine from public wifi. https://theintercept.com/securedrop/ FWIW: Someone I know whom worked for DIA as a sysadmin about 10-15 years ago recalled multiple instances of TS/SCI folks being fired for surfing for porn over monitored networks... career- & clearance-ending. Maybe that's the only culturally-unacceptable sin in that community, apart…

[deleted]

Re: The OPM Data Breach [pdf]

#96

Post by Godel_unicode » Fri, Sep 09, 2016, 5:17 AM UTC

zacharycohn wrote: post #48

colinbartlett wrote: post #45

Earlier quoted context omitted.

What about things the US Digital Service or 18F? The image they present is that those teams are different and outside the standard government bureaucracy. I'm skeptical.

Employee of 18F here, speaking unofficially. We care a lot about security - both from the technical side and from the policy compliance side!

> We care a lot about security

Which is doubtless why you ignore the TIC guidelines, etc

Re: The OPM Data Breach [pdf]

#97

Post by Godel_unicode » Fri, Sep 09, 2016, 5:24 AM UTC

thanatropism wrote: post #49

Interestingly enough, I haven't either seen either an emphasis on the main responsible directors being women; or claims that the agency was a "glass cliff".

Incompetence knows no gender.

Re: The OPM Data Breach [pdf]

#98

Post by [deleted] » Fri, Sep 09, 2016, 5:25 AM UTC

kevin_thibedeau wrote: post #72

rdtsc wrote: post #63

Earlier quoted context omitted.

How was recruitment?. Someone I know tried to get a got job there, got stuck in the queue forever. Was told to wait months. So eventually gave up and took another job.

USAJobs is badly in need of an 18F overhaul.

[deleted]

Re: The OPM Data Breach [pdf]

#99

Post by marmot777 » Fri, Sep 09, 2016, 5:26 AM UTC

Is the headline of the report truth or hyperbole?

"The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation"

Re: The OPM Data Breach [pdf]

#100

Post by superuser2 » Fri, Sep 09, 2016, 5:38 AM UTC

loteck wrote: post #21

tptacek wrote: post #17

Earlier quoted context omitted.

It is not a technical document. It is a document that contains technical details. For instance: it contains a formal set of "findings", as in the "findings" of law and fact in a trial. Here's one of the first findings: FINDING: Slow implementation of critical security requirements such as dual factor authentication is a true case of misplaced priorities. That's not technical language. It's not even formal language. O…

I won't argue with you the difference between a technical document and a document with technical details. You're welcome to that definitional win. There are interesting technical details in this document about the exact methods, vectors, files, timelines, etc used in both offense and defense of this incident. They would be of interest and value to many in this community regardless of the partisan agenda of the commit…

A technical document about a breach would explain the mechanisms for the vulnerabilities and exploits involved, and discuss how systems could be architected and written differently to avoid them.

This document walks up the abstraction chain several notches and attacks the org chart and security policy of the MS Word variety, not the way things were written or configured (except insofar as bad config stemmed from not enough teams of paper not enforced well enough). It is pitched at the kind of CIO/CTO who could just as easily be any other CxO, not at engineers.