Hacker News Reader

Comment by rwmj | Hacker News Reader

Copying the backup tapes to what? Auditing is implemented along with physical measures like ensuring USB ports are glued up and people are searched going into and out of the secure data center (which is air-gapped from the internet). You can't even carry a mobile phone -- there are detectors for the signals they give off.

(USB ports / CDs being what failed in the Bradley Manning case)

View on HN

Physical security is a joke everywhere. I've worked in 50+ datacenters and I'd bet anyone anywhere that I could sneak a 64GB micro SD card out of any datacenter in the world. No one is doing cavity searches, not even NSA. Getting a "decommissioned" or "test" server out full of data would be trivial in 99.99% of organizations.

Theoretically it's trivial to audit sysadmins. In practice it's virtually impossible. Let me know when Red Hat wants to bet money on it.

Red Hat doesn't sell physical security. Let me know when ADT wants to bet money on it.

Red Hat doesn't offer a real world solution to the problem of auditing sysadmins. That's entirely my point.

I'm pretty sure I recall hearing the NSA never lets anything leave their facilities intact when decomissioning or otherwise disposing. I've heard a story of brand new very expensive servers (big Sun machines I think) sitting in a loading dock, still on pallettes, having the project cancelled and having them destroyed unused rather than risk data leaving the building.

I'm sure they have great policies. I'm also sure they're regularly not followed or easily bypassed by certain people. Who exactly destroys the servers, for example?

Reply on news.ycombinator.com