Protecting Against Leakers
schneier.com
schneier.com
He certainly did NOT need this access to administer systems. It still boggles my mind that the sensitive data on those systems was not encrypted so administrators could not read it.
In any well-run IT organization, the DBAs cannot read the credit card numbers stored in the database and the systems administrators cannot read user passwords. But they can still administer the database and the the servers.
In the end someone or some process has access and a sysadmin / DBA could pretend to be that someone or that process.
Once you have physical access to a box it is game-over, the only thing that might still trip you up is an auditing system that is not part of that box.
You shouldn't make it easy either, but if someone configures a system they are in a position to bypass the security on that system. It all ends with trust.
What is surprising is that even the NSA did not follow these practices after all if there is a place where such a system would make sense it would be there, and they certainly could not make the excuse that they're small.
Here you have a fundamental conflict. A root user can reconfigure the controls to allow access (that is absolutely necessary from a practical perspective), and so you end up having to trust the sysadmins.
Or you could set up other systems that would read the files, decrypt them only within special programs. Now you have two problems..... Moreover the sysadmin might be able to pull passphrases as they are typed, keys as they are uploaded, etc. It is not that easy to manage.
In the end a determined sysadmin can get the information and there isn't really a way you can lock him or her out fully.
They created separate positions, with deliberately and carefully separated permissions and often conflicting duties, so that one party watched over the other and ensured no overreaching, and no single person being able to access data unmonitored (as rdl exemplified). In all the time I worked there as a contractor, I never saw production data.
Looking over the Internet, it seems standard practice:
http://www.sans.edu/research/security-laboratory/article/it-...
And of course what Schneier says:
"The first is compartmentalization. Trust doesn't have to be all or nothing; it makes sense to give relevant workers only the access, capabilities and information they need to accomplish their assigned tasks. In the military, even if they have the requisite clearance, people are only told what they "need to know." The same policy occurs naturally in companies."
"Make sure a single person can't compromise an entire system. NSA Director General Keith Alexander has said he is doing this inside the agency by instituting what is called two-person control: There will always be two people performing system-administration tasks on highly classified computers."
1) NSA actually is fairly competent overall, and feigns incompetence as a way to let people bypass legal controls when "useful".
2) NSA is actually incompetent overall, and people like tptacek who say they're wildly beyond the open world are wrong. They obviously have a huge budget and legal protection (legal or illegal) to do whatever they want, but a lot of what someone would want to do is something even I could pull off given the NSA's level of resources.
3) NSA has really fucked up priorities, and for some reason (limited resources, cynical political calculations, expediency, etc.) put all of their effort into offense and none into defense, not even from their #1 threat (insiders). Maybe they also put too much faith in the vetting process and external shell and less on protections within the chewy center. This was pretty common in the commercial world 10-15 years ago (when "use a firewall and AV filters" was the leading security advice). If NSA actually went backward from the 1980s when they strongly believed on internal controls to actually cross over and be inferior to the commercial world, we're kind of screwed.
These systems are on 'known good networks' staffed by people who have some of the most extensive vetting you can get.
These are the folks who invented (or funded the development of) RBAC and the like. SELinux came out of NSA, for example. The tech exists, but it's a hastle to work with. If you've got fully-cleared, all-known-good actors, why bother?
It's not like it's on the internet, or accessible in some fashion.
They put a lot of effort into screening staff, but they're also the most attractive target for well-funded adversaries (Russia, China, etc.).
The only stuff I've ever seen come out of NSA and actually used by anyone in government that hasn't been crap has been hardware. SELinux, etc. are a sideshow. Their OS protections as deployed elsewhere in government are primarily COTS or were developed by external contractors (HBSS, etc.), and are actually shittier in a lot of ways than best commercial practice.
Is an assumption on Schneier's part. For all we know there were dozens or more. They may not have released the data or they may have sold it to some foreign agency instead.
Some would like them to remain thieves after they've done their thing and I'm sure that some thieves eventually consider becoming whistleblower but in the interval between taking the data and exposing it there is no real difference that you could outwardly discern between the two cases.
Don't forget corporations and individuals. And of course blackmail. That could be very profitable, specially against powerful people, politicians...
If they didn't have segregated access (and it does not appear that they did) then that would have surely been too juicy to pass up. 20,000 documents is a lot.
This might also go some way to explaining the panic, if they don't know what he's got and he's had access to data like that then some people must really not be sleeping well right now.
It's safe to assume that most (every?) politicians data is part of NSA's haul. Add journalists.
I find the debate about surveillance terribly naive. Politicians get corrupted as soon as there's no one closely looking.
Creating such a surveillance and secret-keeping mammoth is calling for massive corruption. And this thing has been running for years.
Retail banks' ATM and overnight payments systems are often 25-year-old pieces of software and hardware.
http://cryptome.org/0002/ja-conspiracies.pdf
http://web.archive.org/web/20071020051936/http://iq.org/#The...
----
Sun 31 Dec 2006 : The non linear effects of leaks on unjust systems of governance
You may want to read The Road to Hanoi or Conspiracy as Governance ; an obscure motivational document, almost useless in light of its decontextualization and perhaps even then. But if you read this latter document while thinking about how different structures of power are differentially affected by leaks (the defection of the inner to the outer) its motivations may become clearer.
The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption.
Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.
Only revealed injustice can be answered; for man to do anything intelligent he has to know what's actually going on.
So, as they grow bigger, they become more inefficient and customers more unhappy (see: Paypal). I hope there are ways to mitigate this.
And if you read easily between the lines, this is where the NSA failed us as well.
Snowden's sphere of access was very large. He broke org procedure for the good of all Americans and net users on the planet. What is implied is that existing analysts in like positions have similar access, and can break org procedures for nefarious purposes (indeed, as they already have countless times according to reporting), and no amount of official gov't reassurances on "checks and balances" or "proper procedures" can wipe this fact away.
I wonder how many roles at the NSA have inflated spheres of trust, and about all the little and big ways their operators break org procedures all the time...and especially for what reasons...
Why would anybody even consider giving such tips to `people which can be summed up as evil' is beyond me.
Isaac Asimov, 1956.
Does this mean that the sysadmins will each be responsible for 20x as much information or work? With such a workload how can the doubling up be effective?
I guess my rule is that when confronted with a crisis, organizations will usually react in such a way as to preserve or even exacerbate all pre-existing problems.
I feel like this hasn't been said enough in the debates surrounding the surveillance leaks.
(... It is possible for these two things to not be in conflict with each other...)
They want their employees to honor the commitments they've made. At the same time they're lying to congress and the FISC.
Dear NSA: Let me help you un-fuck your business: Stop requiring your employees to uphold and defend the constitution. Stop hiring people who believe that the NSA should be held accountable to the citizens and/or to the congress.
(Perhaps you should start by creating a cult of personality around a strong, charismatic leader. And for the signing-in ceremony, instead of swearing to "defend the constitution against all enemies, foreign and domestic", maybe they could just wipe their asses with a copy of the Bill of Rights.)
If you do this, you will never have another Edward Snowden again. I guarantee it.
Edit: okay, that was offensive to Mormons, but they do apparently employ a lot of them. If one group is overrepresented, so will their views (which might diverge from the rest of the population).