NSA created online cybersecurity course with 100s of classes | Hacker News Reader

NSA created online cybersecurity course with 100s of classes

clark.center

134 pointsgraderjs20 comments

> One of the goals of the National Security Agency (NSA) is to advance the state of cybersecurity

Don't forget the NSA does both offense and defense. More so offense from what I've gathered. Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0]

[0] https://en.wikipedia.org/wiki/NOBUS

To be fair, a lot of the people involved in the offensive side find their forever homes in defensive cybersecurity orgs in the private sector. If you take a long view of it, the offensive/defensive split is a lot less ominous.

The tools are similar too. There’s a very thin line between defensive cyber tools and malware sometimes.

>Advancing 'the state of cybersecurity' whilst also using 0day they refuse to alert others of / patch / disclose, and use 0day for themselves only[0]

A bit like spinning off many military/space technological advances for civilian applications while keeping the juicy bits secret, no?

I like GPS. I also like that the US has the best GPS-guided munitions.

  > Millions of innocent civilians in the middle east aren't as happy about it though.

In the interest of both sides there's a much more real and concrete Vulnerabilities Equities Process, that has been used to report zero days.

https://en.m.wikipedia.org/wiki/Vulnerabilities_Equities_Pro...

https://www.wired.com/story/nsa-windows-10-vulnerability-dis...

It's important to remember this because those two subgroups are often in contention with one another. This is why you see high ranking members of the NSA (or other groups) advocating for strong encryption as well as high ranking members advocating against encryption. It is always clear who is who by what they are advocating for. But we definitely have a bias for hearing red team instead of blue team. I hope that shifts, because blue team is far more important (and a substantially more difficult problem).

What is this site? NSA has but a section in this list of courses.

Site says: The CLARK System is partially supported by:

- the National Security Agency under NSA Grant H9830-17-1-0405, H98230-21-1-0175

- NCyTE Center

- California State University San Bernardino, and

- Towson University

Appears to be primarily run by CS staff and students at Towson University

Fox: here’s some ways to guard your henhouse! Farmer: thanks! I learned a lot. Wait a second.

Curious to know how long this was in development, and how the principals were selected.

Build a CYBER CUBE

No mention of data diodes, aka unidirectional networks... Not good

Correction: Horrible search engine. It turns out that commenting from a phone is suboptimal

This is classic HN: "This useful resource does not include $MY_PREFERRED_TECHNOLOGY, therefore it is bad."

This is correct to some degree - both the criticism and the complaint.

No mention of large language models, aka llms... Not good

There are a bunch of topics not covered in these courses. I fail to see how not covering a single extremely niche defensive capability is “not good”.

Data diodes are a relatively cheap and foolproof technology to use, it shouldn't be extremely niche, it should be widely deployed. The ability to monitor a SCADA system externally with ZERO chance of control ingress is a powerful tool.

Data diodes are widely deployed in critical infrastructure SCADA systems and widely understood by practitioners in that field - that’s the niche where they fit really well.

That still doesn’t have anything to do with a cybersecurity curriculum meant for a general audience being somehow “not good” for failing to cover them.

Your ability to scrub almost six hundred course programs in a matter of hours is impressive.

Reply on news.ycombinator.com