NSA refused Clinton a secure BlackBerry like Obama, so she used her own

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by nickpsecurity on Thursday March 17, 2016 @01:25PM (#11305917)

I totally agree. I ran into this myself fighting with high-assurance vendors over the tech that was limited to defense only. I said, "We have infrastructure, banks, I.P., and so on to protect. NSA's pentesters & certifications say these are only devices that can stop even them. These are American businesses, not foreign spies. Background check them, whatever, just get them security that works." Replies were always courteous denials on grounds of national security. That's despite that each system usually had tens of millions in taxpayer-funded R&D or nearly guaranteed contracts to get it started.

In all my time studying NSA's IAD, I could never be sure if this was just organizational issues or straight subversion. Snowden leaks made that harder rather than easier. Bell, of Bell-LaPadula fame, has a nice write-up of how they helped create high-assurance security market then destroyed it over time.

http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...

The A1 products he referenced still exist but government doesn't push them for rest of us. A NOBUS thing I guess. SNS Server (MLS LAN) is defense only, not sure about XTS-400 (now XTS-500 w/ Linux apps), and Aesec's GEMSOS might be available to commercial sector. I forgot to ask for clarity on that. Nobody outside high assurance or good CompSci has ever heard of them. Bleak picture for anyone investing in next high-security product, ain't it?

Nice, albeit biased, presentation on methods behind GEMSOS & old school high-assurance.

http://www.iwia.org/2005/Schell2005.PDF

Holistic, pub-subscribe architecture leveraging SNS Server as "impenetrable" component to simplify overall scheme. That's overstating it but it's allegedly unbroken in field since released in early 90's. Embedded firewall is another old trick you can do today w/ Octeon II's or similar PCI card computers.

htttp://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA425566

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by neurotech1 on Thursday March 17, 2016 @04:16PM (#11307236)

When it comes NSA pen testing, its not that some things are "impenetrable" its a question of how far they are willing to go, and who they are willing to p__ off to do it.

There are limits, both legal and political, that the NSA won't cross but a private contractor doing pen testing might try.

Rightly or wrongly, about the only way most US private companies can get a proper grasp of what the NSA is capable of is to hire a senior former NSA officer.

http://ironnetcyber.com/executive-team.html

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by nickpsecurity on Thursday March 17, 2016 @08:20PM (#11308829)

This is possible. However, I read many of the papers and Final Evaluation Reports from this time period. They usually found the common and some uncommon flaws in systems with feedback to vendors. One of a UNIX aiming for higher assurance heavily criticized its lack of hardware-level enforcement and architectural issues. They also standardized on assurance and design techniques with similar re-applications to ensure what worked before would again. Evaluations were done by people from private labs and NSA's IAD hackers sometimes repeated by other groups.

So, altogether, they probably got plenty of review. They could still use more from independents with great skill. So far, though, solid in review and the field in high risk is saying something.

Re hiring a former NSA officer

Others and I have been telling all of you for years what they're capable of. You just look at each layer or compondnt to see what a subversion/breach would do. Then read years of papers showing how to avoid those. Then notice what each product is or isnt applying. Then you know they were breaking almost all of it. ;)

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by chris_wot on Friday March 18, 2016 @08:52PM (#11316568)

And now I have a mountain load of further reading :-) thanks!

[ Parent | on HN ]

Re:NSA refused Clinton a secure BlackBerry like Obama, so sh... by nickpsecurity on Friday March 18, 2016 @10:45PM (#11317021)

Any time. It's one of the things I'm good at. :)

[ Parent | on HN ]