Comment by linkregister | Hacker News Reader

Comment by linkregister | Hacker News Reader

Parent Full thread

> It seems NSA has spent all its budget on cool hacking tools and programs

From the report: On March 20, 2014, US-CERT notified OPM that a third party had reported data exfiltration from the OPM's network.

I think it's likely it was NSA that made the notification. Maybe not. Either way, what further could NSA have done about it? The NSA can't make another federal agency improve its computer security. At best it can perform audits: which it appears to have done; OPM had the lowest security posture of any agency.

Should the NSA have prevented the exfiltration? How would that work? Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? Should the NSA have authority over civilian government agencies? What about hacking and wiping the intruders' endpoints? Sounds like an act of war to me, if those endpoints are on Chinese soil.

I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.

> The NSA can't make another federal agency improve its computer security.

Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes.

> Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet?

To the federal agencies. Cyber defence doesn't work with current bloated beaurocracy. Nobody seems to be in charge.

> I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.

I don't know. I would rather them spend more time defending, wouldn't mind expanding their power and diverting more budget towards that.

> Nobody seems to be in charge.

That's indeed the problem. There was a strong push for a while to put NSA in charge of civilian infosec infrastructure. But Congress didn't really want to put a combat support agency in that role. So DHS is technically in charge of that. But we still have the majority of federal agencies stuck fending for themselves when it comes to securing their networks. Without stronger action from Congress, this may never change.

Because when I think of technical sophistication, I think of DHS.

Exactly, they simply have never had the institutional knowledge required to secure government networks.

Their hostile attitude towards computer security pay incentives practically guarantees nobody will jump ship from IOC or TAO. This problem will likely only be resolved by a big media stink.

> Without stronger action from Congress, this may never change.

You should go read the cybersecurity act passed in December of 2015, and realize that DHS is now authorized to force agencies to use it's security and offerings.

> The NSA can't make another federal agency improve its computer security.

Maybe not directly. But the NSA could play a much more positive role in information security generally by moving out of the shadows and making more of its research public. The expertise that the NSA has acquired in securing information needs to be widely disseminated to work its way into engineering curricula and praxis, and that won't happen as long as the NSA communicates by whispering.

Yes, maybe they should release a kernel security scheme for Linux that incorporates some lessons learned. Maybe they could call it SELinux.

I mentioned SELinux in a previous comment along the same vein.

Reply on news.ycombinator.com