Hacker News Reader

Comment by zepto | Hacker News Reader

Doesn’t this represent a gross failure of the NSA?

Preventing this kind of thing seems like their entire purpose.

Going based on this Washington Post article, it seems its a DHS system called Einstein, which according to a GAO investigation/report was found to have had issues:

https://www.washingtonpost.com/national-security/ruusian-hac...

I think I found the full report here:

https://www.gao.gov/assets/700/696283.pdf

"In that report, we also noted that NCPS was partially, but not fully, meeting most of its stated system objectives.34 Although the system’s intrusion detection capabilities provided the ability to detect known patterns of malicious activity on agency networks, it was limited in its capabilities to identify potential threats using anomaly-based detection. We also reported that although DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities.The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities.

The department had also identified needs for future capabilities, but had not defined requirements for the capability to detect threats entering and exiting cloud service providers. Further, DHS had not considered specific vulnerability information for agency information systems in making risk-based decisions about future intrusion prevention capabilities."

It almost seems like a roadmap for an APT... :|

Paradoxically, the more gross the failure, the less responsibility large organizations seem to take. Thinking of Equifax, or PG&E and the wildfires.

Maybe this is the real rotten core that needs changing. Orgs need to be held to account. And that points to an even deeper core -> we are the ones who need to change, to actually hold orgs to account.

What does it mean to "hold orgs to account?" Let's unpack this.

When some organization promises to do a thing and they fail to do the thing, then sure, you can blame them for breaking their promise.

This doesn't fix anything though.

To fix things you need to talk about preparedness. Whose job is it to prepare? Do they know what to do? Do they have the resources to do it?

Increased penalties for failure aren't going to fix it. And especially, deciding afterwards that someone should have known it's their problem isn't going to fix it.

Why wouldn't increased penalties for failure do it? We're in an environment where spending money on better security and preparing is seen as waste. If the alternative is having a large fraction of your profits confiscated because you were being negligent, that seems like the most direct way to address the mindset at the organization level.

If investors ask why you're spending so much on ITSEC, you point at regulatory requirements.

Someone has to point out the possibility of failure to someone who can do something about it. Where is the incentive to point it out or spend time looking for failures? Particularly when it's not their job? You need to make it someone's job.

In some cases, insurance can do it. It's the insurance company's job to understand and minimize risk.

But the best idea I've read is to have a regulatory agency like the NTSB.

I agree on all fronts. Preparedness is the clearest way. But our economy (and capitalism in general) don't reward preparedness, in fact they often punish for it. I read some article about how building slack into systems is equal to building resiliency into them. How can we build an economy that aligns incentives to be resilient?

The same applies to pandemic preparedness. There is no incentive for a hospital to over-provision beds that are empty most of the time.

Looking for examples of cultures and organizations that over-provision, the military might be an example. Why do we translate worry about physical attacks into action but not cyber attacks or environmental harm?

Because we have had millennia to observe the effects of physical attacks, but the other 2 are much more recent? We haven't yet learnt the hard way.

The underwriting of business ventures goes back at least three centuries, and the market process aligns incentives pretty well. But if you think you can price over/under-preparedness better, that sounds like a profit opportunity for you.

> Let's unpack this.

It's probably a fallacy to assume this can be fully digested in a public forum. Things like this require committees and trust and understanding of the problem. Software threw all that out the window years ago.

We can just pray the AI will know better.

How to do that though? See these people, using the Insurance companies stickler for the small print against them: https://www.abc.net.au/news/2020-12-15/australians-fight-ins...

In short, the insurance companies have a phrase where they don't have to pay out for business losses caused by disease as specified by a certain law.

But that law got wiped from the books and replaced with a new law. And the terms of insurance for most of the companies never got updated and so are irrelevant on that point.

So the insurance companies should pay up for business losses due to covid. They are now saying "never mind the exact lettering of the agreement, go by the spirit of it"....

“Too big to fail” has been mentioned often as a danger to a well working society.

But then again, as long as there is reasonably rapid evolution in society, I have no idea how one might curtail organizations from becoming too big.

At best it would become another game of Whac-a-mole[0] between regulators and organizations, with regulators more often on the losing side than not.

[0] https://en.wikipedia.org/wiki/Whac-A-Mole#Colloquial_usage

The market process and diseconomies of scale tend to constrain the size of firms, so much so that "bigness" is a strong indicator that a firm is instead being propped up by the political process, e.g., bailouts, regulatory capture.

The attack surface of the government is incredibly, extremely massive. It's pretty much impossible to stop every single intrusion attempt. When combined with nation-state backing, it's nearly impossible to stop widespread compromise as it's currently structured.

Personally, I assume that MAD applies to this system to ensure that no rational nation would leverage this access for anything beyond intelligence-gathering.

Seems like “intelligence gathering” could include all kinds of bribery and manipulation.

I.e. a massive set of new assets

Reply on news.ycombinator.com