Is the US Government's Cybersecurity Agency Up to the Job? (cnn.com) 71
CNN reports that some critics are now questioning whether America's Cybersecurity and Infrastructure Security Agency (CISA) is equipped to protect the integrity of government systems from adversaries:
Some of the nearly half-dozen government agencies affected by the hack have recently reached out to CISA for help with addressing the known vulnerabilities that were exploited in the attack but were told the agency did not have enough resources to provide direct support, according to a source familiar with the requests. The person noted the slow response has only increased the perception that CISA is overstretched. Multiple sources told CNN that CISA, which operates as the Department of Homeland Security's cyber arm, does not have the appropriate level of funding or necessary resources to effectively handle an issue of this magnitude.
"It's a two-year-old agency with about 2,000 employees, so clearly that level of responsibility is not commensurate with the resources that they have," Kiersten Todt, a former Obama cybersecurity official and managing director of the Cyber Readiness Institute, recently told CNN....
"CISA is not capable," according to James Andrew Lewis, cybersecurity and technology expert at the Center for Strategic and International, who added that the agency's failure to detect the breach months ago was largely due to the fact its attention and resources were consumed by efforts to secure the 2020 presidential election. "CISA has always been and will continue to be slammed by the responsibilities heaped on it by law," Daniel Dister, New Hampshire's chief information security officer, told CNN. "They have been overloaded with work from the start and have had a hard time coming up to the level of expertise that DoD/CYBERCOM/NSA has enjoyed."
Yesterday the New York Times noted the breach wasn't detected by any U.S. government cyberdefense agency (or the Department of Homeland Security), but by private cybersecurity firm FireEye. "It's clear the United States government missed it," the Times was told by Senator Mark Warner, ranking member of the Senate Intelligence Committee. "And if FireEye had not come forward, I'm not sure we would be fully aware of it to this day." The breach is far broader than first believed. Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. But as businesses like Amazon and Microsoft that provide cloud services dig deeper for evidence, it now appears Russia exploited multiple layers of the supply chain to gain access to as many as 250 networks.
The hackers managed their intrusion from servers inside the United States, exploiting legal prohibitions on the National Security Agency from engaging in domestic surveillance and eluding cyberdefenses deployed by the Department of Homeland Security. "Early warning" sensors placed by Cyber Command and the National Security Agency deep inside foreign networks to detect brewing attacks clearly failed. There is also no indication yet that any human intelligence alerted the United States to the hacking.
"It's a two-year-old agency with about 2,000 employees, so clearly that level of responsibility is not commensurate with the resources that they have," Kiersten Todt, a former Obama cybersecurity official and managing director of the Cyber Readiness Institute, recently told CNN....
"CISA is not capable," according to James Andrew Lewis, cybersecurity and technology expert at the Center for Strategic and International, who added that the agency's failure to detect the breach months ago was largely due to the fact its attention and resources were consumed by efforts to secure the 2020 presidential election. "CISA has always been and will continue to be slammed by the responsibilities heaped on it by law," Daniel Dister, New Hampshire's chief information security officer, told CNN. "They have been overloaded with work from the start and have had a hard time coming up to the level of expertise that DoD/CYBERCOM/NSA has enjoyed."
Yesterday the New York Times noted the breach wasn't detected by any U.S. government cyberdefense agency (or the Department of Homeland Security), but by private cybersecurity firm FireEye. "It's clear the United States government missed it," the Times was told by Senator Mark Warner, ranking member of the Senate Intelligence Committee. "And if FireEye had not come forward, I'm not sure we would be fully aware of it to this day." The breach is far broader than first believed. Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. But as businesses like Amazon and Microsoft that provide cloud services dig deeper for evidence, it now appears Russia exploited multiple layers of the supply chain to gain access to as many as 250 networks.
The hackers managed their intrusion from servers inside the United States, exploiting legal prohibitions on the National Security Agency from engaging in domestic surveillance and eluding cyberdefenses deployed by the Department of Homeland Security. "Early warning" sensors placed by Cyber Command and the National Security Agency deep inside foreign networks to detect brewing attacks clearly failed. There is also no indication yet that any human intelligence alerted the United States to the hacking.
Re:You talking about the CISA (Score:5, Insightful)
making political announcements to their press buddies about election security?
You mean Christopher Krebs, the guy who headed CISA before he contradicted the con artist's lies about "fraud" in the election and was fired. Yes, you are correct. That is the job of a government agency when asked about a situation, to give facts. That the con artist doesn't believe in facts because he can't admit he's a loser is the real issue, not a government agency informing the press and the people about the truth of the matter.
Just like the Surgeon General publicly contradicting the con artist [cnn.com] who continues to lie about the soaring and staggering death toll in this country from covid-19. The same con artist who has admitted to downplaying the severity of the virus, who has told states they are on their own to come up with a plan to fight the pandemic, who has stolen PPE equipment from states, who has done nothing except whine and moan about how bad this pandemic is making him look instead of doing something about it.
Re:You talking about the CISA (Score:4, Insightful)
The intrusion happened months before that announcement and the systems were in place for years before that, so no. Besides, election security is within the scope of their operations, and the more transparent they are with it the better. It's only "political" insofar as the loser of the election has politicized the process when they got an undesired outcome.
Re: (Score:3)
The intrusion happened months before that announcement and the systems were in place for years before that, so no. Besides, election security is within the scope of their operations, and the more transparent they are with it the better.
If they had been absolutely transparent, they would have said, "We have no idea if the election was secure or not. We can't even secure our own PCs, let alone widely different machines from different vendors scattered across the country!"
I'm not saying a particular team won (that part seems clear), they were making a political statement because it wasn't based in fact, it was based in their desire to influence people.
Re:You talking about the CISA (Score:4, Informative)
If they had been absolutely transparent, they would have said, "We have no idea if the election was secure or not. We can't even secure our own PCs, let alone widely different machines from different vendors scattered across the country!"
In almost all of the US, the security of the election is completely independent of the security of the PCs. There has been a large move to physical paper ballots which are marked up by the voters and only scanned by the voting machines. This means that even if the voting machine is 100% compromised by totally bad actors the election can still be 100% secure. In many locations what they did after the vote is an "audit". This means that first they take the record of how the votes were counted by the voting machines, then they take groups of votes and check that the physical paper ballot papers match with the electronic record. Once you have manually checked enough random samples, the possibility for the election to have been influenced by the machines falls below the margin of the difference between the votes.
Now, it is possible that this process was done wrongly. It is possible that people tried to cheat in this process, however none of that is in the allegations because the allegations are all bullshit by total bullshit merchants. The same is true of the allegation that they have no idea about the security of the election.
Re: (Score:3)
Once you have manually checked enough random samples, the possibility for the election to have been influenced by the machines falls below the margin of the difference between the votes.
Except now we have the con artist specifically asking the Georgia Secretary of State to find votes.
"The people of Georgia are angry, the people in the country are angry. And there's nothing wrong with saying that, you know, um, that you've recalculated," Trump said in one excerpt of the call. Raffensperger responded, "Well, Mr. President, the challenge that you have is, the data you have is wrong."
In another excerpt, Trump said, "So look. All I want to do is this. I just want to find 11,780 votes, which is one more than we have. Because we won the state."
After recounting the votes (twice), after doing a manual audit of the votes, after doing a signature comparison of mail in ballots, Georgia found zero evidence of anything wrong yet we have a so-called president asking to have
Re: (Score:2)
Crap. Link got messed up in my post. Here is the link to the story [cnn.com].
Re: (Score:2)
There has been a large move to physical paper ballots which are marked up by the voters and only scanned by the voting machines.
This description doesn't inspire confidence [pbs.org].
Re: (Score:2)
Why didn't they know about it, it was part of their "real" job!!
tbh Isn't election security and in fact elections themselves mostly a state and local thing anyway?
Re:But hey, don't worry (Score:4, Informative)
Venezuelan here. they are not the same machines. smartmatic machines haven't been used in Venezuela in a long time, and Venezuela's scam elections aren't due to their use anyway. It's in the transmission of the results, which is done via the phone system (using the government's phone company)
you are being confused by right wing extremist propaganda. this has been debunked multiple times already. one example: https://www.reuters.com/articl... [reuters.com]
Re: (Score:1)
Smartmatic is the company behind the company and the machines and their connections are well documented at this point. The people at Dominion that testified at the legislatures will go to prison if anyone ever bothers to look into it.
https://votingsystems.cdn.sos.... [ca.gov]
The link is a public records document from the state of California showing Eric Coomers testimony from when he worked for Sequoia in 2005. They were then bought by Smartmatic in 2005. Here's a CNN video documenting the purchase as well as the li
Nope, not quite (Score:3)
Nope, they never said either of those two things.
This is what the joint statement by five different organizations said, which one of CISA's committees signed, had to say about electronic voting in the 2020 election:
--
All of the states with close results in the 2020 presidential race have paper records of each vote, allowing the ability to go back and count each ballot if necessary. This is an added benefit for security and resilience. This process allows for the identification and correction of any mistakes
Re: (Score:2)
Re: (Score:2, Troll)
Yes. CISA was lying when they said that; the evidence was public well before their statement was published. For example, military absentee ballots in Pennsylvania were illegally opened and then thrown in the trash, more than a month before the election -- in a "close" state with law saying ballots cannot be opened before election day . Also in Pennsylvania, various illegal election procedu
Re:Nope, not quite (Score:5, Informative)
For example, military absentee ballots in Pennsylvania were illegally opened and then thrown in the trash, more than a month before the election
Try again. They were not illegally opened [cnn.com]. Further, this incident was caught by the elections director in the county and immediately corrected. The contractor who did this was also let go. In other words, the checks and balances were done and no votes were lost.
Also, the Department of Justice attorney who violated agency policy by announcing who the ballots were cast for resigned last week [thehill.com].
Also in Pennsylvania, various illegal election procedures were ordered and in some cases used
No there were not. No illegal procedures were directed to be used so obviously none were used. Why do you keep lying? Are you that sore a loser?
There is plenty more evidence of more votes deleted, lost, changed, and compromised;
No, there is not. The con artist and his charlatans have never mentioned anything in any of the 54 lawsuits they've filed. In fact, in none of the lawsuits have they said fraud was committed. The only evidence we have for any fraud is three cases in Pennsylvania, all committed by Republicans [thehill.com].
Your desperation is pathetic. All you've done is keep repeating baseless lies because your feelings are hurt your guy didn't win. Well guess what, fuck your feelings.
Re: (Score:2)
That article doesn't say what you claim it says. It says that officials claimed the ballots were thrown out due to "error" rather than "fraud". Opening those votes was still illegal [ballotpedia.org], even under the changes made to state law in 2020.
And the ballot 'curing' [wjactv.com] procedures used by some counties were recognized as violations of the state elections code.
In short, yes, evidence does show the things happened that CISA claimed didn't happen. You are projecting your lies onto other people. Shove off.
Re: (Score:3)
9 Whole ballots. Wow! Meanwhile Trump is busy asking Georgia officials to "find 11,700 votes" [washingtonpost.com]. He probably asked officials in other states to do the same.
Re: (Score:3)
https://www.reuters.com/articl... [reuters.com]
More fake news I guess...
Need more money!! (Score:1)
No (Score:1)
Because the NSA, even with their immense funding, can't do their job properly, and feel the need to spy on American citizens, in direct contravention of their charter and the law.
If their job is sabotage (Score:1)
Then they are doing great
How Would We Know? (Score:2)
It is all closed door policy stuff. If we knew the answer then we would be a threat and caged or killed.
NO organization has excellent technical ability? (Score:5, Interesting)
We are beginning doing accounting for last quarter. NO bank or tax authority has a well-designed web site.
Intel has poor management [slashdot.org].
Boeing Aircraft [slashdot.org] is poorly managed.
Microsoft is poorly managed. [slashdot.org]
Re: (Score:3)
Boeing wasn't always that way. What I understand is that it took a nosedive (pun intended) around 20 years ago. Historically, their planes hadn't been known for nosediving. The prevalence of incompetence in big organizations is a product of a society that increasingly rewards incompetence, and the biggest organizations attracting the ones who want the biggest reward. It doesn't necessarily have to be that way, but it will be as long as things keep consolidating and monopolizing - Microsoft with its OS, Boei
Re: (Score:2)
Totally agree with you about reagan and his merry bunch of idiots. W continued the same BS, and Clinton/GOP did a f
Re: (Score:2)
Google (Alphabet) needs a new CEO? (Score:2)
In my opinion, Google was better when Sergey Brin, Larry Page, and Eric Schmidt were more in charge. Those were the days of "Do no evil."
Now: Google Removes 'Don't Be Evil' Clause From Its Code of Conduct [gizmodo.com].
Re: (Score:2)
Google doesn't need to be well managed. All they need to do is avoid disrupting the sweet flow of advertising revenue.
Re: (Score:2)
Technology is becoming more complicated. (Score:3)
Re: (Score:2)
The NSA might have excellent technical ability. Unfortunately they are one of the foes that US Cybersecurity is up against.
Re: (Score:2)
Maybe NO organization has excellent technical ability, in my experience. The complexity of technology is greater than most technically-knowledgeable people know how to understand.
I think the problem is that there are not enough technically minded people to go around. We are pushing people through code camps and they get hired with a few months training.
Which is ok for a React front-end, but then they start building micro-services and don't have the foundational knowledge in networking and asynchronous processes, and things fall apart when you push them a little.
No (Score:3)
Trying to keep "security holes" to yourself, and assuming bad actors will not exploit them is not a good way to handle national security.
NSA has a dual focus, and one of them actually tries to make sure systems are kept secure. But that requires patching all known security holes. Even the ones known only to a few restricted people.
Publicly funded (Score:2)
It's hard to recruit smart people (Score:5, Insightful)
..when you pay low wages, require drug tests and have a dress code
Re: (Score:3)
It is bad enough when in the corporate world management is more concerned with quarterly results and/or their own compensation rather than product quality.
Re: (Score:2)
Re: (Score:2)
You mean smart, independent thinkers don't appreciate excessive restrictions on their physical body and what they do on their own time? And then they want to be paid more than a pittance when they have to wear a monkey suit no client will ever see?
I'm shocked!
Re: (Score:2)
We are told people in government make as much as, if not more than, private industry. So which is it?
require drug tests
You want people to be allowed to come to work stoned [cbsnews.com]?
have a dress code
Oh the horror! How has this world ever survived by requiring people in a professional environment to dress appropriately? Maybe we should allow people to dress in slippers and pajamas, like they do when they go shopping. Then we can hear how it's racist to say they shouldn't show up like that [usatoday.com].
Re: (Score:2)
If that's your concern, then we should require people in these jobs to never use alcohol.
Re: (Score:2)
Not with restrictions. (Score:2)
A big problem with that security has is that they cannot impose hard restrictions. When I say hard restrictions I mean being able to say, "all software must have the source code availible" and all agencies therefore have to abide. As a result they are merely a group that gets the blame when their recommendations are overridden because it's merely easier than finding a way to cause everyone to comply.
They are doing the best they can without having real authority and this is the result. Don't like the resu
Re: (Score:2)
HA HA HA! (Score:2)
You must be new here...
Totally Inept (Score:2)
C'mon, is it really that fucken hard? (Score:2)
Make network access a privleged, whitelisted & audited service.
*my* take is that this was a russky attempt to subvert the election *for the republicans* from US sourced IP addresses.
CISA is a âoerisk advisorâ (Score:2)
They neither implement nor enforce security. Asking if they are up to job of securing the nation is as relevant as asking âoeIs Congress running the DOJ well?â or âoeIs the President writing effective laws?â
Typical know-nothing question (Score:2)
The task is too big for any single government agency or company. Same goes for healthcare.
Nothing will change until pain is brought to c-level officers. We need regulations that mandate jail time for decision makers that failed to properly secure and monitor their systems. Solarwinds, equifax and OPM decision makers should have been jailed for years.
No. (Score:1)
No, and we're not socially capable of assembling a government agency that is, because for the past 4 decades we've been systematically attacking education and demeaning and belittling all the exceptionally smart people who aren't also evil.
You mean the people who outsourced to Solarwinds? (Score:2)
Yeah. Right.
Humor, humor everywhere, and not a funny mod to... (Score:2)
Seriously disappointed to see this story expire without a recognizable joke. That's Slashdot 2020, whoops, Slashdot 2021 for you.
Whose fault? (Score:2)
Let's see, pass tax cuts for the wealthy and big companies, then complain about the deficit; push for "smaller government"...
And then complain when the "smaller government" doesn't have the resources.
Stupid MAGAts.