What Happens When You Send a Zero-Day to a Bank?

Re:What Happens When You Send a Zero-Day to a Bank? by steamer25 on Friday April 21, 2017 @07:11PM (#14170164)

Someone in another forum commented recently that there should be a new top-line federal agency whose mission is to promote the security of America's information infrastructure. They suggested it should be established as an adversarial check/balance against e.g., the CIA and NSA.

https://twitter.com/Snowden/status/839168025517522944

Maybe if they were required by statute to accept anonymous submissions and make FOIA-style responsible disclosures after a reasonably short period of time, they wouldn't end up colluding right away.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by azernik on Friday April 21, 2017 @08:33PM (#14170493)

The already exists an agency with this mission: the NSA. The problem is that they have two often-conflicting mission statements, WTH the other being to spy on foreign adversaries. Really what this would entail is splitting the NSA into two bureaucracies, with the information-security one then being able to wholeheartedly pursue vulnerabilities that affect American infrastructure.

The offensive organization wold probably then still sit on vulnerabilities only it knew about, but at least this would be better than the current situation.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by nickpsecurity on Friday April 21, 2017 @09:25PM (#14170647)

"The already exists an agency with this mission: the NSA."

It's a myth far as I know. I've studied them a long time seeing much conflicting info about this. A declassified, historical document I found at one point about them said their job was SIGINT and COMSEC (just communications security!) for U.S. government. A later provision extended this to protecting COMSEC of defense contractors. The IAD seems to have policy-driven stuff about helping protect INFOSEC in general. There could've been a COTS mandate of some sort at some point but it was clearly toothless.

The NSA is mandated to protect communication security of defense sector. That's it. Even then, the defense sector keeps asking them to downgrade the security to let in more quick-moving products from commercial sector that are hacker fodder. They've since started on a program that lets them in after a 90-day evaluation against the lowest standards from Common Criteria. The NSA is the last group that should be responsible for INFOSEC given all this w/ market an utter failure, too.

The groups that have done the most are probably NSF and DARPA for funding strong security with NIST and DISA (esp STIGS) at least trying to do something with hardening guides and crypto recommendations. I prefer reputation-driven nonprofits that are funded with combo of donations, licensing of quality software, and consulting fees. They can't get acquired or be destroyed by changes in government policy.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by hackuser on Friday April 21, 2017 @10:03PM (#14170753)

The NSA is part of the U.S. Dept of Defense, which generally can't operate domestically. I'm not sure how that applies in this case.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by zeckalpha on Friday April 21, 2017 @10:53PM (#14170884)

NIST is another.

[ Parent | on HN ]