$960M and the FBI's Art of Branding Insecurity

In previous posts "Are cyber criminals or bureaucrats the industry's top performer?", and "Insiders - insights, trends and possible solutions" I emphasized on how bureaucracy results in major insecurities, and provided further info on various issues related to insiders and risk management solutions -- ones the FBI is obviously far from implementing given the access control issues they have in place. It seems like two years ago, a Consultant Breached FBI's Computers :

"A government consultant, using computer programs easily found on the Internet, managed to crack the FBI's classified computer system and gain the passwords of 38,000 employees, including that of FBI Director Robert S. Mueller III. The break-ins, which occurred four times in 2004, gave the consultant access to records in the Witness Protection Program and details on counterespionage activity, according to documents filed in U.S. District Court in Washington. As a direct result, the bureau said it was forced to temporarily shut down its network and commit thousands of man-hours and millions of dollars to ensure no sensitive information was lost or misused."

How he did it? With access to hashes and 90 days password expiration period, he had all the time in the world, excluding the fact that according to the article a FBI agent even game him his password.

Passwords are a hot topic, and so are the insecurities posed by them. Moreover, spending near $1B for a non-existent case system, while dealing with access control issues is rather unserious for thought to be serious institution -- have you guys considered an open source alternative? You wouldn't come across lots of developers with top-secret clearances applying for the top, but obviously a top-secret clearance cannot prevent insider behavior as well. Continue reading →

BBC under the Intelligence Shadow

Nothing is impossible, the impossible just takes a little while. A relatively typical practices for the ex-USSR, namely controlling the media and profiling the journalists including the readers, seem to have been going on in London during the same period as well. According to the Sunday Telegraph, the BBC let intelligence agents vet staff :

"Confidential papers obtained by the Sunday Telegraph reveal that the British Broadcasting Corp. allowed intelligence agents to investigate the backgrounds and political affiliations of thousands of its employees, including newsreaders, reporters and continuity announcers. The files, which shed light on the BBC's hitherto secret links with the counter-espionage service known as MI5, show that at one stage it was responsible for vetting 6,300 BBC posts -- almost a third of the total work force. The procedure was phased out in the late 1980s. The files also show that the corporation maintained a list of "subversive organizations" and that evidence of certain kinds of political activity could be a bar to appointment or promotion."

If you can spell the name of the party while sleeping, and have subscribed to its periodical propaganda, only then you have the chance to unleash your career potential. I guess what they were worried about was an undercover Red reporter, taking advantage of live events and directly broadcasting a subvertive message -- remember when a guy invaded Truman's world in the "Truman show", and tried to warn the little kid he's on TV all the time? The interesting part is how even the spouses of applicants were subject to scrutiny.

There you go with the freedom of the press, I guess China must have had something in mind when blocking access to the BBC's web site. Continue reading →