The Evidence Builds
CBS News reports that Edward Snowden’s digital maneuvers still stumping U.S. government.
Their sources are saying that as a system administrator working for a contractor at the regional center in Hawaii, Snowden managed to go wherever he wanted on the entire network and hide his tracks.
The bottom line is that they have no effective auditing capability on the system, and any of the problems reported are the result of screw-ups, because anyone intent on abuses can easily hide their tracks.
This is the system created by the people who are tasked with making the information infrastructure of the US secure. This is really pathetic …
2 comments
The core problem is one of loyalty. You want someone who is full time, who is part of the institution, who has a vested interest in the success of the institution whether that’s military retirement benefits if continuing in service, stock options, whatever. One thing you *don’t* do is put a contractor in charge of critical infrastructure. Not without having a full time employee with years in service overseeing his every move, anyhow. Just giving him root access to the whole frickin’ network with no oversight? WTF?
I have utilities going to track anything done as root, and I get emailed a report every morning. You can f**k with the utility’s database files, but if you do, I get emailed a report on *that* too, in real time. I have golden handcuffs going where if the company does well, I do well too, that’s how they buy my loyalty. This is just common sense, that you track everything and put only people who have a vested interest in the success of the institution in charge of critical infrastructure. But I guess common sense ain’t so common….
I could understand his ability to muck about with the system in Hawaii, but he apparently could wander at will. I was the sysadmin at a college for the teaching systems that were used by the IT department. They were locked up like a vault because I knew damn well somebody would attempt to break in. They tried and got caught, so they stopped trying. The system was available in the lab 8am-10pm six days a week, and I had no desire to go in on my time off to babysit. We used TAs to cover the lab, and their access was only sufficient to the tasks they were allowed to perform. I liked most of them, but I wasn’t going to trust them with my Friday and Saturday nights.
It is more complex today, but damn, the tools are part of the operating system, and if you are trying to establish your credibility to advise people on hardening their systems, you have to harden your own.
Contracts run from 3 to 5 years, so people aren’t going to invest their lives in the job.
When I was in, even the cleaning crew were Federal employees and almost everyone was former military. Security and confidentiality was not a problem.