Does anyone know if there are other sources that can confirm the breach?
NATO Classified Cloud Platform Compromised
31–40 of 122 posts
Re: NATO Classified Cloud Platform Compromised
#32Earlier quoted context omitted.
Article: The platform, known as NATO’s Service-Oriented Architecture and Identity Access Management (SOA & IdM) Project, is one of four core projects of NATO's IT modernization efforts. So this expresses what "modernization" is - fob as much work as possible unto a job-shop/meat-grinder operation and watch things like this happen. I don't even know whether to laugh or be appalled, the Snowden leaks happened due to co…
Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.
Sure, the states of the world have decided that security isn't one of their core competencies - computer security, yes, but the point remains.
I find this mind-boggling but that's how it is.
Re: NATO Classified Cloud Platform Compromised
#33Reading the start of this article reminded me of a somewhat unrelated thing I saw: I remember seeing in "tech influencer" youtube video on how "Japan hasn't kept up with the west" when it comes to IT. Not to be super orientalist or whatever and assume Japan is doing better the US in IT, but what should they do instead, go the US route and put every thing on the cloud? Is that better?
I couldn't help it, it's literally in the article that this was part of the "NATO modernization" efforts. Perhaps whatever they had before would have failed too but it's clear that these "modernization" efforts aren't always better.
Re: NATO Classified Cloud Platform Compromised
#34Earlier quoted context omitted.
Article: The platform, known as NATO’s Service-Oriented Architecture and Identity Access Management (SOA & IdM) Project, is one of four core projects of NATO's IT modernization efforts. So this expresses what "modernization" is - fob as much work as possible unto a job-shop/meat-grinder operation and watch things like this happen. I don't even know whether to laugh or be appalled, the Snowden leaks happened due to co…
Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.
It really is one of the dumbest things in government work. Politicians want to "shrink government" so they don't want many actual employees that would probably be well paid, stable, but someone needs to do the work. Thus, enter the I-too-want-to-shrink-the-government politicians who agree but then farm it out to contractors, some whom they might work for one day (or even come from in some cases in the US!). And so the actual government employees are few and far in between while everything else is farmed out to contractors, some who are good and many who do fly by night jobs on grants and have no incentive to do better otherwise.
Re: NATO Classified Cloud Platform Compromised
#35How’s that Zero Trust working out for ya?
What does zero trust have to do with this?
The IdM box in the provided diagram [1] is the same single point of failure "policy engine" and "ID management" architecture that is advocated by the "zero trust" crowd [2]. It's the same type of flawed centralised architecture that allowed the Solarwinds Orion exploit to be used to such great effect [3]. At least the ZTA paper calls out this weakness [4], but unless I missed something the paper severely understates the risk that a central "policy engine" presents, and glosses over all the other components ("threat intelligence feeds", host-based agents, etc) which are centralised in this architecture and present a similar risk.
[2] NIST SP 800-207, Figure 2, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
[3] https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
[4] NIST SP 800-207, Section 5.1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Re: NATO Classified Cloud Platform Compromised
#36My only question is; why such project was connected to the internet at all ?
A computing cloud that's not connected to the internet is completely useless. Besides, how else would the lowest bidder international contractor be able to work on it?
Re: NATO Classified Cloud Platform Compromised
#37Earlier quoted context omitted.
Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.
It really is one of the dumbest things in government work. Politicians want to "shrink government" so they don't want many actual employees that would probably be well paid, stable, but someone needs to do the work. Thus, enter the I-too-want-to-shrink-the-government politicians who agree but then farm it out to contractors, some whom they might work for one day (or even come from in some cases in the US!). And so th…
It is also nice to have an entity to throw under the bus if necessary.
Re: NATO Classified Cloud Platform Compromised
#38Earlier quoted context omitted.
Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.
It really is one of the dumbest things in government work. Politicians want to "shrink government" so they don't want many actual employees that would probably be well paid, stable, but someone needs to do the work. Thus, enter the I-too-want-to-shrink-the-government politicians who agree but then farm it out to contractors, some whom they might work for one day (or even come from in some cases in the US!). And so th…
Do you think projects run and implemented by people directly employed by the government have a better track record?
Re: NATO Classified Cloud Platform Compromised
#39Reading the start of this article reminded me of a somewhat unrelated thing I saw: I remember seeing in "tech influencer" youtube video on how "Japan hasn't kept up with the west" when it comes to IT. Not to be super orientalist or whatever and assume Japan is doing better the US in IT, but what should they do instead, go the US route and put every thing on the cloud? Is that better ? I couldn't help it, it's literal…
Stop using fax will be enough to be considered modern by my standards
Re: NATO Classified Cloud Platform Compromised
#40My only question is; why such project was connected to the internet at all ?
A computing cloud that's not connected to the internet is completely useless. Besides, how else would the lowest bidder international contractor be able to work on it?
DoD has a parallel internet inaccessible from outside secure sites. They can follow the same approach with NATO computing needs.