CISA broke into a US federal agency, and no one noticed for a full 5 months The US Cybersecurity and Infrastructure Security Agency (CISA) says a red team exercise at a certain unnamed federal agency in 2023 revealed a string of security failings that exposed its most critical assets. CISA calls these SILENTSHIELD assessments. The agency's dedicated red team picks a federal civilian executive branch ( …
The federal government is stepping on entrepreneurial capitalism by not using private industry to perform these checks and analysis, to say nothing of placing undue regulatory burden and profit-killing demands for greater security on job-creating businessmen! The entire CISA should be disbanded immediately and their budget returned to the public in the form of further tax cuts for billionaires!
>The entire CISA should be disbanded immediately and their budget returned to the public in the form of further tax cuts for billionaires!
Why do we have expensive public sector red teams with their gold plated pensions when cheap overseas red teams can break into our federal agencies for free !
It would've been hilarious if that red team compromised their systems, only to find out that another actually malicious actor had already set up shop
>"After gaining access, the team promptly informed the organization's trusted agents of the unpatched device, but the organization took over two weeks to apply the available patch," CISA's report reads. "Additionally, the organization did not perform a thorough investigation of the affected servers, which would have turned up IOCs and should have led to a full incident response.
It's 2024 and basic online infrastructure security, let alone incident response really is still just a complete theater and clown show. But let's keep spending more on C-levels and after-the-fact contractors, then post our infosec roles at $15/hour so we can blame them when the paper mache tower we run our business on crumbles.
given the funding shenanigans most federal agencies have faced in congress for more than a decade now I could imagine the agencies would have difficulty resourcing competent Solaris* (+Oracle crap) system admins and competent security staff, let alone attracting applicants in the first place or retaining those duffers they did attract.
Fairly analogous with the farce that is most SME's IT just differing in scale.
* Solaris admins must be getting pretty long in the tooth and not exactly oversupplying the market.
...It said real adversaries may have instead used prolonged password-praying attacks...
"God(s/ess/esses), if you really exist and love me, prove it by giving me the password to this system."
That would be a tough one to patch against. Maybe pray to your pantheon to protect your systems?
>...It said real adversaries may have instead used prolonged password-praying attacks...
New policy:
Passwds must be the name of a demon who is at least a 9th level lord of hell. It must be entered 3 times
Bad news:
Our data center is now an abyss with flames and screams of the dammed
Good news:
It's secure
Bad news:
Oracle are charging a per/user license for the hoards of hell
So someone else gets the blame.
The skills required to protect systems like this are simply too thin on the ground for the number and complexity of installations.
Users should be able to expect their software to be secure by default and to be patched automatically by the vendor when new vulnerabilities occur.
Given that this is unlikely to ever be the case, all internal systems should be airgapped from the public internet.
We may need simpler OSs and software. The more basic the system, the fewer ways there are to crack it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
