From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 351633B29D for ; Wed, 8 Nov 2023 21:26:40 -0500 (EST) Received: by mail-il1-x12e.google.com with SMTP id e9e14a558f8ab-359c1f42680so1570305ab.2 for ; Wed, 08 Nov 2023 18:26:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1699496799; x=1700101599; darn=lists.bufferbloat.net; h=content-transfer-encoding:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=tbvMEjqGACpwJuaNmh3ZPeyaOGNxKYJVL2fOdA7dDhY=; b=KiCELg8TbnNBMzZvi5/6vHLyaSGU3BYcDkNn+CsnWr7K5GC7MTGGaOyqz2J3tRc4kV 6A+ulGfLpfxOHylBIsoHcHuOR+eVRm1kzzdvTHWY/F76QqRXU0u79t+OY01izmmMdcaD kFGqJlpOha74zUNPrDk8xWE3Q+EHfF70MsByB+djztnUVz71eXRq+sv5M5JPpZq652jS 17o+TBXqew6Grt5SdaU+baKB7/j2LAtDoMMvDEQg2dMb52AD1vMTGFKQmgm929dBf4QU SauCSuyLDtgtojelyc65LYkwc5VXKvIqtBwoC3wVTzk5YfayR5X0dpc5AsMUTgEwTG1E OcVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1699496799; x=1700101599; h=content-transfer-encoding:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tbvMEjqGACpwJuaNmh3ZPeyaOGNxKYJVL2fOdA7dDhY=; b=ZQfThI47A+GCDzqBXMg2mG6wScU4cfRFAxZmeJAJ4gEEgYtcOj4GKRvRzllTluNwsN BmtYpNu7Gw9Jv+lTKci6Ox0g3lqFh67ugeLPnqAHOu2ProFT5jt4+QjYxwS2FF6ZyX+l HKgRu9uFJo35/yk2GjuStpgo+gr3rTYo7itQk5ap5mPotKJG3zv4z7lQZ9BP8BkW2KGw TUNEArRZHA7uarFd5jVQeY0LAGtHbF9ytxUBSi/QLgK+YJ2954Z5Tt7JNmJtKBmCqZpm HYuf2yeYVRTnpQVdqe2zOe0zPfFnEdXSWh65q/47D59KcQiqJVh7DjJfGxmvSAcg/EqK GCgw== X-Gm-Message-State: AOJu0Yx0JInZZ+5QvWKjqmfC/OIp77sWcRG1bwInSSUmfzSxxlztU35I /txdeH/iFyYtHySVTX5c6Ow+L8+aPXR7DNTjW+Er/2ipFvrzwP5i X-Google-Smtp-Source: AGHT+IEeBZQnKYPvxgo1Cyw+ntcxFmUN7S2Epr7svSIUUNhlLUqV6S+TVRSAfJPhg1U8Fz3og9i5U7sdB1fK0WqQ6W0= X-Received: by 2002:a05:6e02:214b:b0:357:f12f:d192 with SMTP id d11-20020a056e02214b00b00357f12fd192mr3620835ilv.32.1699496799443; Wed, 08 Nov 2023 18:26:39 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Lee Date: Wed, 8 Nov 2023 21:26:27 -0500 Message-ID: To: dickroy@alum.mit.edu, =?UTF-8?Q?Network_Neutrality_is_back=21_Let=C2=B4s_make_the_technical_aspect?= =?UTF-8?Q?s_heard_this_time=21?= Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: Re: [NNagain] cybersecurity is not a talent problem X-BeenThere: nnagain@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: =?utf-8?q?Network_Neutrality_is_back!_Let=C2=B4s_make_the_technical_aspects_heard_this_time!?= List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Nov 2023 02:26:40 -0000 On Wed, Nov 8, 2023 at 7:58=E2=80=AFPM Dick Roy via Nnagain wrote: > > Yes, today one can argue that there is a shortage of talent, however Paul= 's point was that that I s not the first problem to solve, in fact the prob= lem that must be solved first is: > > " We're in a hole, here, folks. The first thing we should do is: stop dig= ging.=E2=80=9D > > ... and he is right IMHO! If Katherine Archuleta had enough talent to heed the warnings from the IG there's a chance there wouldn't have been a breach. The organization should have been well past the "stop digging" phase when the breach occurred. > > https://www.linkedin.com/pulse/lack-talent-problem-cyber-paul-vixie/ > > Nothing that happened at OPM, or failed to happen at OPM, was the fault= of its leadership team. Wrong. At the very least, management should have been closing the holes that had been identified. again, looking at https://oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Breac= h-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Gene= ration.pdf on page 6 How the Breach Happened. Despite this high value information maintained by OPM, the agency failed to prioritize cybersecurity and adequately secure high value data. The OPM Inspector General (IG) warned since at least 2005 that the information maintained by OPM was vulnerable to hackers. The leadership team ***was warned***. Given that they "failed to ... adequately secure high value data", how is whatever did or didn't happen at OPM _NOT_ the fault of the leadership team? I'll agree that > > Katherine Archuleta should not have had to ... be an expert on "cyber" = security But she _did_ need to listen to the experts that were warning her about how bad security was. And she needed enough talent to realize that she should heed the warnings from her cyber security experts. > and also because she had a reasonable expectation that somebody, somewher= e, knew how completely and ruinously bad all of the IT (Information Technol= ogy) in the world was, and would have told her that there was no safety any= where except on paper, in filing cabinets, guarded by the U.S. Military. Seriously? There is no absolute security so no matter how much leadership ignores warnings, or how bad the security is in the organization they're running, it's not their fault when a security breach happens? Do you really buy that? Would you be OK with your bank or any other organization that has your PII thinking like that? speaking of which.. How do you feel about Equifax? Oh well.. nothing that could have been done, they should have been put out of business or something in between? Regards, Lee > > RR > > -----Original Message----- > From: Nnagain [mailto:nnagain-bounces@lists.bufferbloat.net] On Behalf Of= Lee via Nnagain > Sent: Wednesday, November 8, 2023 2:47 PM > To: Network Neutrality is back! Let=C2=B4s make the technical aspects hea= rd this time! > Cc: Lee > Subject: Re: [NNagain] cybersecurity is not a talent problem > > On Wed, Nov 8, 2023 at 2:22=E2=80=AFPM Dave Taht via Nnagain wrote: > > > > Paul Vixie reposted this old piece of his, even more relevant today, th= an 2015. > > > > https://www.linkedin.com/pulse/lack-talent-problem-cyber-paul-vixie/ > > I disagree. With a lot, but let's just go with this > > The "cyber" security problems that the US Government, and every other g= overnment, and every large and medium enterprise are all coping with today = do not stem from lack of "cyber" talent. > > Take a look at > https://oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Bre= ach-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Ge= neration.pdf > > on page 9: > The bottom line. The longstanding failure of OPM's leadership to > implement basic cyber > hugiene, such as maintaining current authorities to operate and > employing strong multi-factor > authentication, despite years of warnings from the Inspector General, > represents a failure of > culture and leadershit, not technology. > > There is no substitute for talent. > > Regards, > Lee > _______________________________________________ > Nnagain mailing list > Nnagain@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/nnagain > > _______________________________________________ > Nnagain mailing list > Nnagain@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/nnagain