Live on C-SPAN now: NSA Chief Testifies at Cybersecurity Hearing

Post by dizzystar » Wed, Jun 12, 2013, 11:11 PM UTC

zxcdw wrote: post #24

jacoblyles wrote: post #20

Earlier quoted context omitted.

It may be true that people without traditional education credentials are likely to be less conformist/more likely to cause trouble.

Whether that so-called "trouble" is good or bad and for whom is another thing, which can be quite subjective even. Problems at school aren't necessarily an indicator of a failure. There are many examples of bad school performance which doesn't result in bad performance in whatever the person pursues. As far as I am aware, even Einstein didn't really like being in school and had problems concentrating, yet his scienti…

Post by staccatomeasure » Wed, Jun 12, 2013, 11:33 PM UTC

TallGuyShort wrote: post #48

staccatomeasure wrote: post #41

Earlier quoted context omitted.

Right so what I'm imagining is basically (for lack of a better term) a QA framework that tests that the instrumentation for tracking access...etc is legit. You could say that blowing up even one nuke without proper oversight is unacceptable and thus we have mechanisms in place to make sure the right bells and whistles are trigged. EOD launching a nuke and using PRISM data are keystrokes on a computer.

No - launching a nuke results in a thermonuclear explosion detectable from space - not just keystrokes on a computer. Keystrokes on a computer can be hidden, those mechanisms can be by-passed - and no satellite from space is going to detect all that and alert us to the problem in the reliable and impartial way that would be necessary.

Post by gasull » Wed, Jun 12, 2013, 11:34 PM UTC

narrator wrote: post #52

It's as if all the important decisions have already been made and they are just going through the motions.

Post by corin_ » Wed, Jun 12, 2013, 11:40 PM UTC

staccatomeasure wrote: post #56

corin_ wrote: post #47

Earlier quoted context omitted.

Sure they're keystrokes, but if the software/audits/etc. are run by the same people who might want to abuse it, it doesn't mean much. And put yourself in their shoes: if you abuse a secret database, you likely won't get found out. If you abuse the nukes you most likely will.

Right so it's more difficult to do, but you can separate out the testing team or do other things to be rigorous about detection. At the very least you can make it more difficult than sitting down at a terminal and hitting go. One sort of simple solution I can think of is having passwords just like nuke authcodes that have similar restrictions that are passwords for access and decryption...etc.

Post by staccatomeasure » Wed, Jun 12, 2013, 11:47 PM UTC

staccatomeasure wrote: post #56

corin_ wrote: post #47

Earlier quoted context omitted.

Sure they're keystrokes, but if the software/audits/etc. are run by the same people who might want to abuse it, it doesn't mean much. And put yourself in their shoes: if you abuse a secret database, you likely won't get found out. If you abuse the nukes you most likely will.

Right so it's more difficult to do, but you can separate out the testing team or do other things to be rigorous about detection. At the very least you can make it more difficult than sitting down at a terminal and hitting go. One sort of simple solution I can think of is having passwords just like nuke authcodes that have similar restrictions that are passwords for access and decryption...etc.