Hacker News Reader

Comment by protomyth | Hacker News Reader

"In one instance, maintainers even had to manually burn data onto CDs and drive off base to send the massive files across a civilian WiFi network."

That is a level of scary, I'm not comfortable with in our military's data. Logistics data flying across a civilian WiFi is really not good.

View on HN

Similar stuff happens in medical sometimes too. Everything is so restricted that at some point if you want to get something done you have to circumvent all security systems in a really bad hack way.

So instead of gently decreasing security when it's not possible to be totally secure... it's better to throw the baby out with the bathwater. Wonderful.

Exactly. One of the first things we learned in my UNDERGRAD security class is that "good" security which is unduly onerous will just make users route around it and revert to plain old bad security. The canonical example was ridiculous password requirements which just make people put their password on a post it on their monitor.

As you said, security requirements that are that onerous and too rigid to relax when necessary is just shittily designed security to begin with.

> "good" security which is unduly onerous will just make users route around it and revert to plain old bad security

I believe this picture is also a suitably canonical example.

http://www.jumpoverthere.com/wp-content/uploads/2012/10/secu...

I imagine that's easier said than done in some scenarios, perhaps even the majority.

A lot of security guys just ignore legitimate needs. It may be difficult but they can't just say "No" to everything.

The gist of a convo with IT when I needed to work around some parameters:

"Hey IT dept. I understand the reason for our network restrictions, but we have a lot of data that we need to get to [some endpoint] using [some method]."

"Sorry, we can't relax the restrictions. You have to work within the parameters."

"But the parameters do not allow me to complete my job."

"Sorry."

I'd love to work within the parameters, but when IT won't budge, you're stuck with the least preferrable method.

and where exactly is your boss during this time?

Right beside me infuriated, because there was nothing that he could do about it either.

That's not an IT issue, that's an organizational issue. If your boss cannot do anything including appeal to his/her boss, then you shouldn't do anything. That type of thing needs to be sorted out.

Clearly, in the case of the F-35 systems, federal law was violated doing the offsite thing. We see developers (and frankly some sysadmins) violating HIPA and this kind of stuff has to stop.

>That's not an IT issue, that's an organizational issue.

I knew this at the time. I never blamed IT directly for the issues, because I knew that they were just doing their job as well.

I know it's not the easiest thing to do, but the proper response is to walk to HR (with your boss alongside) and explain that you can't do your job. The improper response is to wardrive to the first open access point you can find and use that.

In theory you are right but that's not how it works in most places.

HR isn't your friend. You can easily get fired by doing things like this.

Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. If that person's action results in a leak than they can be personally sued and fined. Doesn't matter if they did it out of frustration with obstacles that made it very difficult to "get stuff done".

> Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security.

I don't think your wrong, but an awful lot of system admins have ended up dealing with lawyers and courts. Your system admin having had a prior talk with the lawyers about security, HIPA, and who is liable will do wonders for their willingness to bend the rules for you.

Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself.

According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it's non-cleartext.

So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.

Reply on news.ycombinator.com