News for hackers. Stuff that matters.
Re:CISA broke into a US federal agency, and no one noticed f... by oneplane on Friday July 12, 2024 @04:53PM (#40949329)
So your solution to a problem that exists because there isn't enough capacity to go around is to compound that problem by having even less capacity?
Re:CISA broke into a US federal agency, and no one noticed f... by fleabagmange on Friday July 12, 2024 @05:11PM (#40949487)
Omar a minimum we need to deduplicate insane degrees of replication. Why does virtually every government agency have dedicated law enforcement? Narrow it down, reallocate budget, eliminate the wasteful overhead.

It’s not all or nothing here. We spend too much and get too little out of it.

Re:CISA broke into a US federal agency, and no one noticed f... by redserk on Friday July 12, 2024 @05:44PM (#40949729)
Law enforcement is incredibly difficult, especially with the number and types of laws on the books. You want multiple different law enforcement agencies so they can specialize based on the field of law they are in.

Currency counterfeiting is a different set of laws than interstate financial fraud, which is a different set of laws than throwing a Snickers wrapper on the ground in Yosemite.

Re:CISA broke into a US federal agency, and no one noticed f... by coldtea on Friday July 12, 2024 @06:07PM (#40949902)
>Currency counterfeiting is a different set of laws than interstate financial fraud

Which is somewhat irrevant. Teams dealing with each can still share headquarters, IT resources, support stuff, cafeterias, and lots of other things.

Re:CISA broke into a US federal agency, and no one noticed f... by nradov on Friday July 12, 2024 @05:09PM (#40949471)
The federal government does too much. We could simply eliminate many of those agencies and save money for taxpayers, or redirect those resources to more important functions. There is excess capacity, it's just in the wrong places.

As for IT functions, all of that should be centralized under the GSA with proper security controls. There's no benefit to having every agency maintain its own IT infrastructure. Most of those staff are redundant and could be laid off.

Re:CISA broke into a US federal agency, and no one noticed f... by notaustinpowers on Friday July 12, 2024 @05:19PM (#40949540)
I worry for having a centralized IT infrastructure as that now puts every single agency at risk from a single attack. No one would call a neighborhood "secure" if every home used the same key.
Re:CISA broke into a US federal agency, and no one noticed f... by Jtsummers on Friday July 12, 2024 @07:34PM (#40950439)
It's getting centralized anyways, just not inside any federal agency. Instead they're outsourcing it to companies like MS and Google who provide hosted services. This gives the agency cover so long as they do their part (like making use of MFA, using encryption on email). Then they can offer a claim of making their best-effort and going with industry "standards" (standard as in common, not as in ISO, ANSI, or others).
Re:CISA broke into a US federal agency, and no one noticed f... by metadat on Friday July 12, 2024 @09:28PM (#40951027)
This is worse than what's happening today: every agency IT department being underfunded and operating in an ad-hoc, non-uniform matter.

This argument doesn't hold.

Re:CISA broke into a US federal agency, and no one noticed f... by acdha on Friday July 12, 2024 @06:19PM (#40949977)
> As for IT functions, all of that should be centralized under the GSA with proper security controls. There's no benefit to having every agency maintain its own IT infrastructure. Most of those staff are redundant and could be laid off.

This works for email. Would you work at a company where you had to build and deploy apps on infrastructure controlled by someone in a different department and location, whose boss gave them the mandate to standardize as much as possible to reduce costs? (Hope you like Oracle…)

Re:CISA broke into a US federal agency, and no one noticed f... by nradov on Friday July 12, 2024 @08:12PM (#40950623)
Sure, I have worked at companies that manage their IT infrastructure that way. It's fine, way more efficient and secure than letting every department do their own thing.
Re:CISA broke into a US federal agency, and no one noticed f... by Uvix on Friday July 12, 2024 @06:24PM (#40950018)
That was your fairly typical on-premise corporate hosting. Things have gotten better with the cloud but it's still hardly a free-for-all, use-whatever-you-want-with-no-oversight situation.
Re:CISA broke into a US federal agency, and no one noticed f... by acdha on Friday July 12, 2024 @06:33PM (#40950076)
Cloud environments helped, but the kind of massively centralized environment they’re talking about in the cloud work still tends to mean “get 4 levels of approvals and you can get a t3.medium using our AMI with Java 6”. My point is just that successful IT needs people who understand the mission and share your incentives – you can outsource email and other generic services but most people here work on things which aren’t one-size fits all.
Re:CISA broke into a US federal agency, and no one noticed f... by LamaOfRuin on Friday July 12, 2024 @06:24PM (#40950017)
Everyone agrees the government does too much of some stuff and not enough of other stuff. No one agrees on what belongs in which category.
Re:CISA broke into a US federal agency, and no one noticed f... by screcth on Friday July 12, 2024 @08:31PM (#40950745)
That would be extremely bureaucratic.