Hacker News Reader

Comment by arh68 | Hacker News Reader

> C, for the Central Verification System (CVS), ... contains ... Personal Identification Verification (PIV) credentials ... and polygraph data

Good lord.

Yet, somehow, someone might still present the solution as needing to spend more money sooner: It was only when OPM was assessing systems to actually implement the sort of continuous monitoring tools ... that OPM security officers discovered traffic outbound from the network. If only they'd demo'd the software a year ago, right? /s

Is anyone getting fired? Why should anyone lift a finger during this 30-day sprint? And what happens on Day 31?

View on HN

This is the shit the NSA should be worrying about. Securing the US IT infrastructure against nation-state intrusion. Not dragnets of everyone's naked selfies.

I don't disagree. Unfortunately, this all falls on DoD-DISA. The NSA works with DISA to write the policy for how to secure systems (called STIGs) and also has 'Red Teams', but they aren't the arm that certifies these systems before coming online, nor are they the ones the ensure the systems stay secured as new vulnerabilities are found and patched -- that's DISA again.

I could see the CIA NSA taking their vetteing back in house every CIA and NAS employee must be incandesant with rage over this cock up.

That makes sense from an org-chart level. But if that's actually the thinking inside, it represents a total lack of ownership on their part to get to the overall goal of security.

You obviously know what you're talking about, but DISA can't enforce STIGs across the entire government can they? Some say that's DHS's job, or some Office within DHS (or within an Agency under DHS).

> but DISA can't enforce STIGs across the entire government can they?

No, with a small caveat: If that civilian agency (say DHS) is connected to the GIG[1], then DISA has a say-so and can threaten to disconnect them for failing security audits.

Something to keep in mind is that the STIGs are merely implementation guides to secure a system. Therefore, different agencies have different interpretations. In some cases specific secure implementations break systems and applications (mostly legacy ones), so they avoid securing those particular settings all together.

1: https://en.wikipedia.org/wiki/Global_Information_Grid

If this was the UK the home secretary would have resigned by now - why has the secretary of state (which I understand is the US equivalent) not done so.

The Secretary of State has no responsibility over the agency at question. It is an independent agency with a director appointed by the President. That is who should be resigning over this.

The secretary of state isn't the equivalent of the home secretary. The secretary of state is mainly responsible for foreign policy, so probably more like equivalent to the Foreign Secretary? Although definitely not a strict equivalency.

There isn't really any U.S. equivalent to the Home Secretary, the responsibilities are divided over several offices reporting to the president.

Ah I see ty

None of the secretaries have direct control or authority over the OPM.

Additionally, the Secretary of State is foreign affairs and not the equivalent of the Home Secretary.

https://en.wikipedia.org/wiki/Katherine_Archuleta

That is the person who is responsible for the OPM.

It operates on a fee-for-service model for 90% of its budget and isn't properly funding IT and IT security. Given she has only been there 18 months, I'm not sure how you can really blame her beyond the fact she didn't follow the "shutdown and repair" recommendation...except for the fact if she did that, she'd have to burn through the OPM's cash reserves as the only way to fund it.

Its honestly more of a flaw in the way Congress built the OPM incentive structure and the fact the director is a revolving door position that changes every 2-4 years.

The government simply just doesn't fund/prioritize IT & IT security properly outside of the intelligence services. They also build these psuedo-private-sector funding models that create the incentive to "ignore" cost centers like Security into critical infrastructure like the OPM. Its really horrific.

I don't think so.

It's a long time since any UK politician resigned on principle or on honor. I think the late Robin Cook was the last (over the Iraq invasion which he believed was illegal).

Private Eye has an endless stream of 'highly suspect' (since any suggestion of 'corrupt' may get HN into trouble, just to be clear, I'm not saying 'corrupt'.) activities of various government ministers, none of whom resigned or even came close - despite their misdeeds being exposed. Look at how many were caught in the expenses scandal - some UK politicians even tried to hold on while being convicted of fraud and other criminal convictions (with some initial success too, https://en.wikipedia.org/wiki/Nazir_Ahmed,_Baron_Ahmed). That's never going to fly in the US.

You really need to go back to Margaret Thatcher's cabinet before you can really find many examples of resignation on the back of government screwups.

I think a resignation is more likely in the US than the UK. And it's not at all likely in the US.

I think the whole resignation of honor thing is self defeating. Corrupt and malicious people will never resign out of honor. Why should responsible people who have made a mistake do so?

The end result of honor resignation is that you have politicians who worry more about appearances than actually getting anything done. Does that sound at familiar?

For some background here is the way DHS is organized: http://www.dhs.gov/components-directorates-and-offices

Gotta love the government obsession with acronyms.

Where I come from, CVS and PIV mean completely different things. One of them is an abomination before God, and the other is a natural act of biology.

Good lord, not the polygraph data! I wonder if the Chinese have a database with I-Ching divinations?

Reply on news.ycombinator.com