Hacker News Reader

Comment by Creationer | Hacker News Reader

Isn't it the role of State Security/Defense Services to conduct these sort of scans, and notify companies of their vulnerability?

View on HN

No. In North America, we have cybersecurity compliance auditing for large power plants and other bulk electrical system facilities done under the auspices of NERC.

https://www.nerc.com/Pages/default.aspx

It's also very difficult to identify the end-user of these control systems:

https://blog.shodan.io/taking-things-offline-is-hard/

You can notify into a bunch agencies in Spain, but AFAIK they have no way to enforce it. Just what I heard from a fried that works at netsec, not that I have any direct knowledge.

It is not. What made you think it was?

People keep saying here and elsewhere that this is what the NSA was supposed to be about in the US.

In Poland, every couple months I see news that our government/military is supposedly creating some sort of "cyber force". If one day they actually create it, I hope this kind of stuff will be its focus.

The NSA has a dual role, break other people’s stuff and secure the US govs stuff (in theory).

They can (and have) act in an advisory capacity but they have no regularity authority to force companies to secure their shit.

Now whether such an organisation should exist that’s an interesting question I guess.

Over here in the UK we have a similar body.

https://en.m.wikipedia.org/wiki/National_Cyber_Security_Cent...

As someone in the UK tech industry I’m not sure what they actually do on the ground.

One thing those are good for is being a call center for white hat hackers. I.e. if you find some holes you can report to those agencies, and they'll take it from there. I know that's what people that speak about their findings on CCC do.

It's a myth:

https://news.ycombinator.com/item?id=17216853

Their main requirement was and is SIGINT. That drives about all their budget and power. Their secondary requirement was to protect the government and/or military (not sure) with communications security (COMSEC). They may have expanded that to computer security. They were also supposed to protect defense contractors since they were an extension of the military. That's why their most secure stuff is unavailable to average American but defense companies can buy it. Also, the penalties for failing to stop the next 9/11 are astounding compared to failing to prevent... (checks today's articles)... a Fortune 500 company from leaking 264GB in client, payment data.

So, they deny us good stuff and weaken what we have wherever possible in general case. Some tiny number of them in Information Assurance give us tools and guides to help us. NSA can't be trusted to protect us. I do think the people in IA who gave us the best tools should be hired by the organization that will protect us. :)

I have started thinking this is a major systemic weakness the US has vs China. Companies in America operate as individual entities more or less vs the top down model in China. Every company I have worked with in China had a group of government agents it just seems to be standard operating procedure there. Maybe they weren't around for day to day operations but they were definitely around whenever Americans were there. It's apparent they have vast cyber and intel efforts intertwined with the major corporations. Contrast this to our model, I don't even know how to alert the US government if I see something suspicious related to cyber security.

It's both a strength and weakness. For innovation, U.S. was among the strongest in the world during Strategic Computing Initiative where DARPA funded all kinds of industry work. Led to many innovations of today. Then, the weakness comes in with them caring only about profit (security is cost center), short term gains tied to executives' bonuses, and so on. That's when state involvement can help. We did have that under the TCSEC with DOD making security standards, incentivizing private sector to build them, and evaluating their security. Multiple agencies also offer security advice and testing. The middle ground looks to be regulations ensuring the basics are in place on top of continual improvement.

If China wants a model, the TCSEC is a decent start at one. It was made for military requirements, though. Like MLS. The next approach should focus on commercial needs. Also, both TCSEC and Common Criteria were paper heavy with long evaluations after product development was done. The next should focus on actual code with reviewers getting into the process early on, reviewing deliverable by deliverable, so they have better insight into what's going on with faster time to market. Lots of room for improvement over the current model.

TCSEC

https://en.wikipedia.org/wiki/Trusted_Computer_System_Evalua...

Example of what industry was doing under TCSEC

https://csrc.nist.gov/csrc/media/publications/conference-pap...

Modern example from that lineage:

https://os.inf.tu-dresden.de/papers_ps/nizza.pdf

> In Poland, every couple months I see news that our government/military is supposedly creating some sort of "cyber force".

All talk, nothing's done.

It should be, but usually they’re trying to accomplish the opposite (to have exploits everywhere)

Reply on news.ycombinator.com