Sysadmins see evidence that they have been hacked by GCHQ [video]

Re:Sysadmins see evidence that they have been hacked by GCHQ... by atmosx on Tuesday September 16, 2014 @12:36AM (#8323031)

You choose your hardware carefully and if paranoid enough, you perform statefull packet inspection on your OpenBSD transparent router to know possibly what's the reason/content for every connection. Once you tag those that are standard, you start narrowing things. Again policy is what matters, if you allow torrents you are making your job extremely difficult.

I know easier said than done. Writing firewall rules/ confug reporting tools for every computer in the internal part of a network is hard too, that's why almost no one does it.

[ Parent | on HN ]

Re:Sysadmins see evidence that they have been hacked by GCHQ... by bashinator on Tuesday September 16, 2014 @01:39PM (#8325773)

3G keyloggers. Data egress is completely bypassing your network. (There are pwnie express boxes that include a 3G data link for bypassing target networks when sending results back.) I guess you could add physical scans for unauthorized radio transmitters to your security routine. Opsec is hard.

[ Parent | on HN ]

Re:Sysadmins see evidence that they have been hacked by GCHQ... by atmosx on Wednesday September 17, 2014 @04:37AM (#8329084)

Sure, but that's a physical attack: You need someone to install the 3G Keylogger to your machinery.

I was talking on a keyboard-only level, but even that can be largely mitigate with proper policies IMHO.

That said, an insider is an achilles heel for every security scheme out there (e.g. Snowden).

[ Parent | on HN ]