NATO Classified Cloud Platform Compromised • Hacker News Board

Re: NATO Classified Cloud Platform Compromised

#101

Post by nicholasbraker » Wed, Jun 30, 2021, 1:10 PM UTC

sandworm101 wrote: post #90

hereforphone wrote: post #82

Earlier quoted context omitted.

I contracted for US government agencies for a long time. At every single job the contractors were doing the "work" (they had the knowledge) and the government employees were acting as managers. I have not met a government employee with an unusually high level of technical skill (though obviously many do exist). As far as I can tell (and I worked over a decade in this environment, in many countries) government employe…

That would be the plan. If it is a government contract then the government is the customer. The customer manages the project and the hired contractors do the heavy lifting. Look to the people who actually use these systems. Once it is up and running they will all be government employees. The real work, the thing the system is designed to do, starts after the IT infrastructure is up and running. The vast majority of p…

NATO Secret is one of the highest and you definitely need to have had extensive background checks and clearances to have access to this data. From my experience this is not the type of data your typical employee (uniformed or civilian) would be in contact with.

Re: NATO Classified Cloud Platform Compromised

#102

Post by hereforphone » Wed, Jun 30, 2021, 1:14 PM UTC

sandworm101 wrote: post #100

hereforphone wrote: post #98

Earlier quoted context omitted.

The vast majority of people reading and handling classified information are government employees? That's not the case. I was cleared at TS/SCI + polygraph and many many contractors work in that environment.

In the office where you worked. In the office where I work there are zero. Classification levels don't really matter. It is about the nature of the information. Some is simply never shared with non-employees. Some isn't shared with people not wearing uniforms. Well, excepting one or two non-uniforms but they are still government employees.

I was military first then worked for defense contractors for a decade or so. In the areas I worked (several countries including war zones), at the levels I worked (secret, TS/SCI), in the agencies I worked with (DoD, special operations groups, intelligence organizations), I did not experience what you're claiming.

Re: NATO Classified Cloud Platform Compromised

#103

Post by pbronez » Wed, Jun 30, 2021, 1:24 PM UTC

nicholasbraker wrote: post #101

sandworm101 wrote: post #90

Earlier quoted context omitted.

That would be the plan. If it is a government contract then the government is the customer. The customer manages the project and the hired contractors do the heavy lifting. Look to the people who actually use these systems. Once it is up and running they will all be government employees. The real work, the thing the system is designed to do, starts after the IT infrastructure is up and running. The vast majority of p…

NATO Secret is one of the highest and you definitely need to have had extensive background checks and clearances to have access to this data. From my experience this is not the type of data your typical employee (uniformed or civilian) would be in contact with.

Per NATO's security guidance [0], NATO SECRET is the second-highest of ~5 classification categories It " is applied to information the unauthorized disclosure of which would cause serious damage to NATO."

In decreasing order of sensitivity, the categories are:

COSMIC TOP SECRET

NATO SECRET (NS)

NATO CONFIDENTIAL (NC)

NATO RESTRICTED (NR)

NATO UNCLASSIFIED (NU)

[0] https://www.act.nato.int/images/stories/structure/reserve/hq...

Re: NATO Classified Cloud Platform Compromised

#104

Post by trutannus » Wed, Jun 30, 2021, 1:34 PM UTC

88840-8855 wrote: post #29

neatze wrote: post #19

My only question is; why such project was connected to the internet at all ?

Do you know anyone who does not want to work from home?

More like people who can't. Working with sensitive documents sometimes requires physical engineering considerations (ie: viewing rooms). Not something that can be replicated in an employee's home. Contrary to what software devs like myself like to think, not every job can be done remotely!

Re: NATO Classified Cloud Platform Compromised

#105

Post by [deleted] » Wed, Jun 30, 2021, 2:15 PM UTC

pbronez wrote: post #103

nicholasbraker wrote: post #101

Earlier quoted context omitted.

NATO Secret is one of the highest and you definitely need to have had extensive background checks and clearances to have access to this data. From my experience this is not the type of data your typical employee (uniformed or civilian) would be in contact with.

Per NATO's security guidance [0], NATO SECRET is the second-highest of ~5 classification categories It " is applied to information the unauthorized disclosure of which would cause serious damage to NATO." In decreasing order of sensitivity, the categories are: COSMIC TOP SECRET NATO SECRET (NS) NATO CONFIDENTIAL (NC) NATO RESTRICTED (NR) NATO UNCLASSIFIED (NU) [0] https://www.act.nato.int/images/stories/structure/res…

[deleted]

Re: NATO Classified Cloud Platform Compromised

#106

Post by jvanderbot » Wed, Jun 30, 2021, 2:22 PM UTC

eru wrote: post #77

raesene9 wrote: post #67

Earlier quoted context omitted.

For the sake of debate, lets assume an equal level of incompetence between contractor run projects and government run projects. In that case at least a) There's no need to pay extra for the profit margins of the contractor companies (and the inevitable sub-contractors they use) and b) The incentives of the people doing the work are likely to be closer to the original project, in that the people doing the work are in…

Profit is a small part of costs. See https://slatestarcodex.com/2017/02/09/considerations-on-cost... I'm not so sure about incentives. The incentives aren't necessarily great in either situation. See also https://en.wikipedia.org/wiki/Public_choice

"Overhead" is a large part of costs, and profit is often contractually limited in government contracts. But much of the profit is hidden in the markup, which can sometimes be 50%, meaning you pay $1.50 for $1.00 of supplies, labor, etc.

Re: NATO Classified Cloud Platform Compromised

#107

Post by jvanderbot » Wed, Jun 30, 2021, 4:13 PM UTC

jvanderbot wrote: post #106

eru wrote: post #77

Earlier quoted context omitted.

Profit is a small part of costs. See https://slatestarcodex.com/2017/02/09/considerations-on-cost... I'm not so sure about incentives. The incentives aren't necessarily great in either situation. See also https://en.wikipedia.org/wiki/Public_choice

"Overhead" is a large part of costs, and profit is often contractually limited in government contracts. But much of the profit is hidden in the markup, which can sometimes be 50%, meaning you pay $1.50 for $1.00 of supplies, labor, etc.

To add to this, the gov requires that all the markup is broken out, so it can be audited. I think usually contractors are allowed things like R&D budgets, salary (maybe not bonuses?) etc. I'd love someone more knowledgeable than I am to chime in.

Re: NATO Classified Cloud Platform Compromised

#108

Post by JackFr » Wed, Jun 30, 2021, 4:39 PM UTC

sandworm101 wrote: post #97

flatline wrote: post #20

Earlier quoted context omitted.

Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.

I'm a government employee. I work with a few dozen people across multiple locations doing actual work. Not one of us is a contractor. Zero contactors are involved in any real work. The few we have are in support positions. We have some contracted IT people who manage some of our computer systems but don't have any access to what those computers actually do. We have contacted security guards at the front gate. And I t…

When I was a defense contractor it always struck me as weird that the guardhouse at USMC HQ at the Navy Annex was staffed by $12/hr private security guards.

On the other hand the commander of the group I was doing work for pointed out that a fully trained Marine private was far to costly an asset to waste checking visitor ids.

Re: NATO Classified Cloud Platform Compromised

#109

Post by viro » Wed, Jun 30, 2021, 4:50 PM UTC

leto_ii wrote: post #53

joe_the_user wrote: post #18

Earlier quoted context omitted.

Article: The platform, known as NATO’s Service-Oriented Architecture and Identity Access Management (SOA & IdM) Project, is one of four core projects of NATO's IT modernization efforts. So this expresses what "modernization" is - fob as much work as possible unto a job-shop/meat-grinder operation and watch things like this happen. I don't even know whether to laugh or be appalled, the Snowden leaks happened due to co…

> the Snowden leaks happened due to contracted-out sys admins, after all But that's a good thing, right? It's good that everybody found out that the government unlawfully collected their data etc. Snowden was not an attacker asking for money, he was an honest guy with a conscience and a whole lot of courage.

> the government unlawfully collected their data etc.

How did the ANT catalog leaks do that? Did you not notice Russia suddenly got more aggressive (annexing Crimea etc.) after the Snowden incedent?

Re: NATO Classified Cloud Platform Compromised

#110

Post by sandworm101 » Wed, Jun 30, 2021, 5:33 PM UTC

pbronez wrote: post #103

nicholasbraker wrote: post #101

Earlier quoted context omitted.

NATO Secret is one of the highest and you definitely need to have had extensive background checks and clearances to have access to this data. From my experience this is not the type of data your typical employee (uniformed or civilian) would be in contact with.

Per NATO's security guidance [0], NATO SECRET is the second-highest of ~5 classification categories It " is applied to information the unauthorized disclosure of which would cause serious damage to NATO." In decreasing order of sensitivity, the categories are: COSMIC TOP SECRET NATO SECRET (NS) NATO CONFIDENTIAL (NC) NATO RESTRICTED (NR) NATO UNCLASSIFIED (NU) [0] https://www.act.nato.int/images/stories/structure/res…

Those NATO levels are all just the start. Every NATO member runs many of their own layers. Over and above NATO come levels that are country-specific. In the US that means things like "five eyes" or US-only, which are technically secret (ie not TS) but are still above NATO. Remember that anything NATO is going to be seen by a large number of countries, including Turkey and Greece.