reolt

A junior security operations employee at a company I worked at - who was fired for persistent incompetence - somehow obtained a fairly important position doing security for a government agency. That agency was (shockingly) later revealed to have very publicly embarrassing security issues.

I imagine this sort of thing is pretty common.

I feel like NSA might be able to make a stronger case for themselves if they were at least able to show they could do one of the most basic and fundamental things they're supposed to do be doing.

I see. That certainly makes it more interesting. In that case, all of the criticism should be directed at him, and not at Fidelis or their appliances.

That's strange. My company uses the same Fidelis XPS appliances Berkeley is using, and they're entirely installed, administered, managed, configured, and monitored by our internal IT security staff. Only our staff has access to alerts it fires and the snippets of traffic it captures (for example, if it detects potential malware C&C beaconing, it'll show the bytes it flagged as matching the signature, and some ~200 bytes before and after it). We're also able to view, change, or add all the rules it uses. The source code is closed, so that part is a blackbox, but it seems like a huge stretch to call the entire appliance a blackbox considering we're 100% responsible for integrating, managing, and utilizing it.

I imagine Fidelis probably also offers a professional services option that allows them to manage setup and maybe even remote monitoring. If this is true, there's absolutely no reason why Berkeley can't hire competent infosec folks to handle it all internally, especially considering they have a lot of smart students in the field.