US Customs Database Of Traveler Photos Was Hacked And Stolen • Hacker News Board

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#201

Post by lostmyoldone » Tue, Jun 11, 2019, 12:01 PM UTC

EForEndeavour wrote: post #154

cjhanks wrote: post #77

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of dat…

Except for simply not collecting the data, the only other option is making the cost of retrieval be equivalent or greater, irreducibly, to the expected value of keeping it.

Approximately, the digital equivalent of having a human rifle through filing cabinets to get to that one folder that is actually important.

To this day, the only reliable way to achieve this has been printing things on paper, especially if put in individual folders do that even OCR efforts take some human work.

Time spent by human hands are, in a way, the only somewhat fair currency to measure privacy in.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#202

Post by codyb » Tue, Jun 11, 2019, 2:59 PM UTC

satiani wrote: post #197

SmellyGeekBoy wrote: post #195

Earlier quoted context omitted.

I'm no fan of modern security theater but the number of plane hijackings and bombings in the 90s compared to today would seem to indicate that at least some good comes of it.

source?

Hijackings were pretty much a daily thing (or three times daily thing) for decades.

Although until 9/11 the intent usually was either to get to a non extradition country, or demand something from some nation state primarily.

The source above shows a clear decrease in airline fatalities through the years but I suspect that’s due more safety improvements through autopilots, better sensors, and more redundancy than the decrease in hijackings.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#203

Post by llao » Tue, Jun 11, 2019, 4:45 PM UTC

codyb wrote: post #202

satiani wrote: post #197

Earlier quoted context omitted.

source?

Hijackings were pretty much a daily thing (or three times daily thing) for decades. Although until 9/11 the intent usually was either to get to a non extradition country, or demand something from some nation state primarily. The source above shows a clear decrease in airline fatalities through the years but I suspect that’s due more safety improvements through autopilots, better sensors, and more redundancy than the…

You are vastly over-exaggerating. According to https://aviation-safety.net/statistics/period/stats.php?cat=... , even when limiting to the period between ~1970 and ~2003, it is about 2 per month on average. The total sum of fatalities is just over 1000 people.

This is nothing to justify the massive surveillance.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#204

Post by MrMorden » Tue, Jun 11, 2019, 8:42 PM UTC

enraged_camel wrote: post #173

01100011 wrote: post #166

Earlier quoted context omitted.

I worked at a government contractor who was rolling out NIST compliance. Everyone, from IT to engineers, hated it. You can rest assured that as soon as someone isn't looking, they're going to violate it.

I have never come across a compliance policy that people didn't hate. Compliance, almost by definition, needs to make people's job harder, or create extra work. Because people are lazy, and they tend to go for the path of least resistance, and those are not good things in the context of safety and security.

Compliance is a tool. It's used to enable security iff the C-suite want to use it that way; otherwise, it's just another meaningless metric.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#205

Post by anigbrowl » Tue, Jun 11, 2019, 9:17 PM UTC

munchbunny wrote: post #174

anigbrowl wrote: post #96

Earlier quoted context omitted.

You and a whole bunch of other people making the same extremely basic observation. It would be good if you would suggest some alternative strategies, since 'don't bother keeping that data' isn't a realistic option in this context.

Part of my job is designing software that is resistant to amplification once the hacker is already in, so maybe I can help here. When you plan your security, step 1 is making it hard to get in, step 2 is making it hard to persist, i.e. plant a command and control process somewhere inside the perimeter, and to move laterally in the system, i.e. get from one service into a more important service. There's some basic stu…

Really enjoyed reading this, thank you for the time you put into it and the clear explanation.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#206

Post by sailfast » Tue, Jun 11, 2019, 11:08 PM UTC

mattnewton wrote: post #152

sailfast wrote: post #134

It is clear from the tenor of some of the posts here that more of you need to work for some non-zero time in the government so you can have some empathy / appreciation here. They’re hiring.

The same org separating children from their families at the border in violation of a court order? Why would I take a pay cut to work for that mission? I don’t fault the engineers in any case, it seems like their technical security wasn’t tested here; it was some kind of policy failure that lead to the information leaving government control. And that’s the problem, we don’t solve this with engineering, or empathy for…

I meant government in general - not CBP. Without having worked in the federal space, it’s likely a lot of the context of this - policies, procurement, onboarding, security, etc is lost. Probably should have clarified and I deserve the downvotes. Agreed that CBP’s mission at the moment is a serious problem.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#207

Post by codyb » Wed, Jun 12, 2019, 2:18 AM UTC

llao wrote: post #203

codyb wrote: post #202

Earlier quoted context omitted.

Hijackings were pretty much a daily thing (or three times daily thing) for decades. Although until 9/11 the intent usually was either to get to a non extradition country, or demand something from some nation state primarily. The source above shows a clear decrease in airline fatalities through the years but I suspect that’s due more safety improvements through autopilots, better sensors, and more redundancy than the…

You are vastly over-exaggerating. According to https://aviation-safety.net/statistics/period/stats.php?cat=... , even when limiting to the period between ~1970 and ~2003, it is about 2 per month on average. The total sum of fatalities is just over 1000 people. This is nothing to justify the massive surveillance.

I wasn’t trying to justify the mass surveillance and I totally read that table wrong, woops! That’s a brain fart ;-).