This isn't the "official postmortem". It's the official report of the GOP-led House Oversight and Government Reform Committee. It's a partisan political document.
A better title:
Republican House Oversight Report On OPM Data Breach.
A better title:
Republican House Oversight Report On OPM Data Breach.
FINDING: Slow implementation of critical security requirements such as dual factor authentication is a true case of misplaced priorities.
That's not technical language. It's not even formal language.
OPM was/is a clusterfuck. I'm not disputing that. But the authors of this document had a job to do: portray administration appointees in the worst light possible.
You're not making an argument. You're trying to pass an opinion as a fact. You need to back up statements like that.
Regardless of whether or not anything was exaggerated, it's still a partisan, political document. The contents don't change that. This would still be the case if it was a "Minority Staff Report" too...
That of the two major parties, the report is authored by the one with a far more adversarial relationship wwith the truth is also worth mentioning.
Not that the report mightn't contain elements of reality. But this is also likely to be as critical of the opposing part and politically beneficial to the authoring party as possible .
The fact is that this isn't a bipartisan and balanced (possibly, yes, to the point of compromise) report. That is not an opinion.
Tptacek hasn't argued the contents are specifically flawed. But the impartiality of the authors is certainly suspect on well-founded grounds.
There are interesting technical details in this document about the exact methods, vectors, files, timelines, etc used in both offense and defense of this incident. They would be of interest and value to many in this community regardless of the partisan agenda of the committee.
This document walks up the abstraction chain several notches and attacks the org chart and security policy of the MS Word variety, not the way things were written or configured (except insofar as bad config stemmed from not enough teams of paper not enforced well enough). It is pitched at the kind of CIO/CTO who could just as easily be any other CxO, not at engineers.
If even that, which most of the intelligence and law enforcement officials have said is a catastrophe that won't be fixed for a generation, shouldn't be portrayed in the "worst light possible", then what should?
Enough with the partisan crap. This happened on those people's watch. Regardless of which party named them as the leaders of the OPM, they should be heavily criticized for it.
In fact, I'm actually quite angry myself at the fact that the Obama administration tried to downplay this for as long as possible last year. You actually didn't see much about it in mainstream media, and only some of it in tech media. All because Obama may have not wanted to be remembered as the president on whose watch the OPM breach happened.
So what I get from this is that you're the partisan one, not the OPM report.
http://democrats.oversight.house.gov/news/press-releases/cum...
[0] http://democrats-benghazi.house.gov/sites/democrats.benghazi...
From tptacek's comment, made ~5 minutes before yours:
http://democrats.oversight.house.gov/news/press-releases/cum...
Why would they want to avoid discussing this?
Nevertheless I'm sorry to have made a comment that seemed partisan. The Democrats and Republicans can both jump in a lake for all I care.
I'm interested in figuring out what you mean by your remark. You're saying nobody wanted to talk about it, but it seems for opposite is the case. What prompted your original remark?