NSA helps out Microsoft with critical Exchange Server vulnerability disclosures

If a friendly NSA agent offered to help tidy up around the house, it would certainly be a kindness. But it's definitely the sort of gift horse you want to look in the mouth. After all, they were just "helping out" securing random number generators, but Shumow and Ferguson discovered that they may have been helping themselves out, too.

http://rump2007.cr.yp.to/15-shumow.pdf

From what I’ve observed, large organizations tend to be driven by relatively small groups of people. It’s often hard to identify who exactly is in those groups, but the fact remains that humans can only take so much complexity, so it gets blame shifted across increasingly smaller groups of people until it arrives at the “core” of an organization. It would be interesting to know who the is in that core group of people at the NSA.

Really, NSA is captive to the law that bureaucracies do exactly what you tell them to do. NSA is budgeted to conduct cyber offense and governmental defense, so private-sector defense is outside the mission; in fact, it conflicts with the former even as it connects with the latter. So NSA is only going to help you if the risks to its defensive mission outweigh the value to its offensive mission (not that organizations have rigorous tests for these things, but whoever yells the loudest is usually a good proxy for it).

The best approach, IMO, is to take cyberdefense out of NSA entirely and give someone like CISA an active mission to maximize whole-of-nation digital defense. While this doesn’t entirely mitigate moral hazard between the offensive/defensive mission balance, at least you’ve got competing budgets that have an incentive to work against each other.

Trust but verify.

> I mean, good? Defending the nation and its citizenry (including their businesses) is ostensibly one pillar of the NSA's mission. Glad to see them act upon it.

One backdoor got found-out so the NSA goes public with a pretend security announcement. Microsoft “security” is designed to keep the casual browser out but not prevent the state security apparatus getting access to your data, anytime anywhere. Anyone who says different is a fool or is invested in the “cyber security” business.

Not sure why trynton’s comment is greyed out...

A vulnerability they were using got burned, and now they want to close it off so nobody else can use it.