|
NSA Fails To Sync
The NSA's decision to have a four-eyes rule for system administration was predicted to create a lot of hassle. We already appear to see some of the fall out. There are now obvious difficulties in the process of synchronizing the talking points of various administration robots.
July 22 – Official: Snowden did not get 'crown jewels'
U.S. intelligence now believes Edward Snowden did not gain access to the "crown jewels" of National Security Agency programs that secretly intercept and monitor conversations around the world, CNN has learned.
…
The ongoing damage assessment indicates he did not gain access to what is called ECI or "extremely compartmentalized information," according to a U.S. official familiar with the review.
July 24 – Snowden Damage Still Being Assessed; ‘Deepest Of Deep Secrets’ At Risk, Says STRATCOM’s Kehler
[Gen. Bob Kehler, commander of US Strategic Command,] referred to the type of information Snowden released as ”the deepest of the deep secrets.”
While Gen. Kehler was his usual careful self, a former senior allied intelligence official recently described Snowden’s actions to me as “catastrophic.”
I sincerely doubt that the NSA knows what Snowden has or does not have. It will have to assume that he accessed everything within is reach. A serious system administrator has ways and means to extend the official reach she is supposed to have. Rules that are supposed to prevent access can be circumvented or temporarily turned off. System logs that may register such action can be manipulated which then would make the access undetectable. These are ways and means the NSA is using itself against the people, organizations and countries it is spying on. The NSA's toolkit is designed to beat the best available protection which necessarily includes the ones the NSA itself is using. If one develops weapons for cyber wars one can be quite certain to n also become a victim of these.
While b is perfectly right in a general meaning, things may be more complicated.
Frontup: The security problem generally isn’t one that stems from lack of means. Problems usually arise from two basically trivial issues:
– Security is a *process* not a device. It requires sensible mechanisms, changes that follow technical and threat developments, and, of course, responsible designers, technicians, and users.
Quite certainly the single most important danger was and is users choosing common passwords or password schemes, telling important info to non-authorized persons, aso.
– Costs and cost/benefit ratio. Basically an extension of the “people” problem above, many or even most sites, be it governmental or business, find and set a (usually rather low) level of security they deem adequate. The major criteria in that are the (felt or otherwise determined) need for security and financial means available for security; evidently the two criteria are interrelated.
That is the context within which b’s statement is true for most cases.
Sparing ourselves a lengthy analysis, suffice it to state that one very major factor in the cost/benefit ratio is directly related to the organisations core; what do they exist for, what makes a company earn their income? The closer IT is to the very core the higher an organisations readiness to consider security as critical and vice versa.
A banks business, the core of it, nowadays basically *is* IT. Accordingly banks rank IT-security very high and invest heavily in it (albeit frighteningly often with little success …).
Applying this to nsa we find nsa in a somewhat particular – and basically favourable – position. Like banks, nsa has IT as its very core. Unlike banks, nsa also has IT know-how at it’s very core; after all nsa is about sig-int and com-int both of which basically come down to IT nowadays.
It therefore seems very unlikely to me that nsa employs lousy security. Some have mentioned the fact that nsa seemingly quite carelessly employs a gazillion of third party personel through a large number of third parties. And they interpret this fact as proof of quite low, if not even infeasible, security.
This can be true, however, it can as well prove very high security standards (which then allow less stringent everyday proceedings).
To come back to something b mentioned as an example:
A serious system administrator has ways and means to extend the official reach she is supposed to have. Rules that are supposed to prevent access can be circumvented or temporarily turned off. System logs that may register such action can be manipulated which then would make the access undetectable.
Well, yes and no. This is perfectly true, say, for your average windows or linux system. But it certainly can be quite different. SE-linux, for example (btw, designed widely by nsa), provides ways to very much tighten security and to make the above quoted plain wrong.
Sure, there is always one or more “god-mode” administrators who do have the necessary rights to blow up the whole thing. Based on observations made in some security critical organisations, it seems reasonable though to assume that even “god-mode” can be constrained, for instance by requiring “4 eyes” and logging to yet another system under separate control.
Maybe I’m plain wrong; after all, I don’t work at nsa and can’t but speculate like everyone else. But again, let us not underestimate the other side. We shouldn’t assume that an agency that has designed or has had major involvement in many highly acclaimed state of the art security mechanisms does not implement those mechanisms.
One more mechanism seems noteworthy both to understand a highly security centric organisation and probable factors in the Snowden case:
There is a “holy credo” to separate administrators (tech. access) and users (application based access) in security critical environments. In other words, a bank front desk person has (probably limited) access to (e.g. customer) data through an application (limiting the available views on data to a predefined set) but no access whatsoever to the system itself. An administrator on the other hand has (probably limited) access to systems but not to application data.(For the picky: Yes, there is yet another breed of admins in a bank, the database admins and yes, they do have access to some or all databases – but neither to a front desk system nor to the underlying system of the data bases. Additionally they often must work in 4 eyes settings).
Why all these considerations and details?
Because in my minds eye a lot points to a team, Snowden, the techie, and someone on the user side with a high access level. This would also better (imo) explain zusas obsession to get hold of Snowden.
Some techie or some user breaking the rules sure enough is something that has been foreseen, calculated and played through; it’s the kind of breach that is highly probably sooner or later and nsa was well prepared for that.
But, to paint a imo realistic scenario, a high level user and a sys-admin colaborating would be critical and possibly not planned for scenario.
The real danger, other than superficial, is not Snowden; it’s the high level user(s) behind him. It’s them who *must* be identified to avoid an open and continuing bleeding.
Posted by: Mr. Pragma | Jul 27 2013 23:25 utc | 48
|
