5 ms·

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

by binkHN 4mo ago

sandeepkd 4mo ago
While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group
- mikestew 4mo ago
  The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords.
  - realo 4mo ago
    You are right... Most use Excel files ...
  - sandeepkd 4mo ago
    Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption at transit and rest). They would be another set of software that every company specially small business or contractors may not be incentivized to pay for. Some one in their naivety considered Github as a safe enough place, assuming that the access is guarded which turned out to be wrong and exposed this thing. Lastly IT teams in large corporations being secure is a myth for most part. Your root keys for the most popular CA providers were shared in plain text emails not so long ago.
    - antonvs 4mo ago
      This organization is using AWS apparently. They would store the root account credentials in AWS Secret Manager. That costs $0.40 per month. People in the relevant admin group would have access to them. They would log in with their individual AWS credentials in order to access the root credentials if they need that. But, requiring AWS root credentials itself is an anti-pattern and implies an immature organization. That should not be needed for day-to-day operation. This is all just ignorance and incompetence, nothing more. > Lastly IT teams in large corporations being secure is a myth for most part. This is CISA. The Cybersecurity and Infrastructure Security Agency for the United States. Security is what they're supposed to specialize in. The only potential excuse here is that DOGE gutted them to a point that has completely compromised their capabilities. However, this situation is bad enough that it suggests that problems predated that incident.
      - sandeepkd 4mo ago
        To be honest I do not know how to respond to this, cause this plays out quite often this way and sounds pretty convincing on surface. Unfortunately this is the gap between theory and implementation. There is a reason why the ROOT credentials are called ROOT. In case of anything going wrong, all your regular user accounts would be locked, see how you lock yourself out of this circular dependency. ONE SHOULD NEVER NOT PUT THEIR ROOT CREDENTIALS IN THE SECRET MANAGER OF SAME ACCOUNT. Its a classical circular problem, compilers compiler type. For AWS itself they have this additional concept of management account that allows you to defer this problem to just one more level. Bottomline, you can have any number of boxes to lock other boxes and put their key to bounding box, ultimately there would be one outermost box that is locked by key which is not in any box
        antonvs 4mo ago
        > In case of anything going wrong, all your regular user accounts would be locked You're talking about a very specific and rare scenario, and certainly not something that justifies storing all your passwords in plaintext in a CSV file. In almost all scenarios where you would need root credentials, having them in the provider's secret manager is fine. Obviously you need to store root credentials outside of the secret manager as well, but that should be a "break glass" scenario that's only used in emergencies. And you don't store them in plaintext CSV. > Unfortunately this is the gap between theory and implementation. I don't disagree that there are many, many organizations that practice bad security. But that doesn't mean there are none that have good security. And one would expect CISA to have good security, otherwise there's really no point in its existence. There's a difference between saying "this is what most organizations are like" and "this is the way it has to be". The former is true, the latter is false.
  - throwawaypath 4mo ago
    >For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords. It's CURRENTYEAR. No one should be using team password managers or files to store credentials. There should not be storable credentials.
- MrDarcy 4mo ago
  The error and omission of not enforcing mandatory security training covering posting plaintext passwords to public sites for CISA contractors is itself an act of gross negligence. So much so the contracting company’s insurer would cite it as the reason why the claim is not covered by their policy.
- antonvs 4mo ago
  > shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. What do you mean by this? There are password managers and more enterprise-oriented secrets managers, and application platforms typically have integration with them. Individuals shouldn't be using shared secrets. This is a completely solved problem and it's not difficult to set up properly, especially in a cloud environment like AWS, where you can use services like AWS Secrets Manager.
  - deleted 4mo ago
    [deleted]
- Forgeties79 4mo ago
  > While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. This isn’t a grocery store or something it’s CISA. This is like a gun going off in a cop’s holster while he’s texting and driving without a seatbelt. Yeah he’s a contractor but that doesn’t suddenly allow for such incompetence.
  - sandeepkd 4mo ago
    I have worked with some of the experienced folks in federal space in the past, who were super smart, experienced and COSTLY from managements perspective. They had the ability to challenge the management on such things. Most of them have either retired, managed out or moved on. What you have here is not a reflection of the individual but the entire management chain. Its a race to make most money and at times these contractors are number of seats to fill at lowest possible cost.
    - Forgeties79 4mo ago
      Totally agree
- morpheuskafka 4mo ago
  He worked for CISA. Surely there is either a security clearance with indoctrination and training, or at the very least, some sort of mandatory training/onboarding for all contractor staff?
- acdha 4mo ago
  None of this is true at the federal level, or at least wasn’t before the current administration. There are standards for all of this, and if you haven’t read them most are quite reasonable — I keep the NIST 800-63 reference handy anytime someone tries to say password expirations are a good idea — and there are people who are paid full time to enforce them. Having a password list or static AWS credentials is not only a direct policy violation but also implies a number of other failures, from monitoring GitHub repo administration and secret scanning to failure to enforce policies against sharing credentials (part of everyone’s standard training), require use of phishing-proof authentication, failure to use short-term credentials, etc. One mistake can be an individual but this is a multiple-manager failure going up to the executive level.

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

by binkHN 4mo ago

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group

mikestew 4mo ago
The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. This strikes me as so wrong, I wonder if I’m misreading your comment. For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords.
- realo 4mo ago
  You are right... Most use Excel files ...
- sandeepkd 4mo ago
  Lets take a concrete example, suppose you have AWS root account credentials. Are you going to assign them to one individual identity or as a company you would keep them accessible to a group of admins. Its going to be the second choice almost for every big company which makes them shared credentials. Coming to team password managers at high level, its a shared location guarded behind closed doors (probably encryption at transit and rest). They would be another set of software that every company specially small business or contractors may not be incentivized to pay for. Some one in their naivety considered Github as a safe enough place, assuming that the access is guarded which turned out to be wrong and exposed this thing. Lastly IT teams in large corporations being secure is a myth for most part. Your root keys for the most popular CA providers were shared in plain text emails not so long ago.
  - antonvs 4mo ago
    This organization is using AWS apparently. They would store the root account credentials in AWS Secret Manager. That costs $0.40 per month. People in the relevant admin group would have access to them. They would log in with their individual AWS credentials in order to access the root credentials if they need that. But, requiring AWS root credentials itself is an anti-pattern and implies an immature organization. That should not be needed for day-to-day operation. This is all just ignorance and incompetence, nothing more. > Lastly IT teams in large corporations being secure is a myth for most part. This is CISA. The Cybersecurity and Infrastructure Security Agency for the United States. Security is what they're supposed to specialize in. The only potential excuse here is that DOGE gutted them to a point that has completely compromised their capabilities. However, this situation is bad enough that it suggests that problems predated that incident.
    - sandeepkd 4mo ago
      To be honest I do not know how to respond to this, cause this plays out quite often this way and sounds pretty convincing on surface. Unfortunately this is the gap between theory and implementation. There is a reason why the ROOT credentials are called ROOT. In case of anything going wrong, all your regular user accounts would be locked, see how you lock yourself out of this circular dependency. ONE SHOULD NEVER NOT PUT THEIR ROOT CREDENTIALS IN THE SECRET MANAGER OF SAME ACCOUNT. Its a classical circular problem, compilers compiler type. For AWS itself they have this additional concept of management account that allows you to defer this problem to just one more level. Bottomline, you can have any number of boxes to lock other boxes and put their key to bounding box, ultimately there would be one outermost box that is locked by key which is not in any box
      - antonvs 4mo ago
        > In case of anything going wrong, all your regular user accounts would be locked You're talking about a very specific and rare scenario, and certainly not something that justifies storing all your passwords in plaintext in a CSV file. In almost all scenarios where you would need root credentials, having them in the provider's secret manager is fine. Obviously you need to store root credentials outside of the secret manager as well, but that should be a "break glass" scenario that's only used in emergencies. And you don't store them in plaintext CSV. > Unfortunately this is the gap between theory and implementation. I don't disagree that there are many, many organizations that practice bad security. But that doesn't mean there are none that have good security. And one would expect CISA to have good security, otherwise there's really no point in its existence. There's a difference between saying "this is what most organizations are like" and "this is the way it has to be". The former is true, the latter is false.
- throwawaypath 4mo ago
  >For instance, team password managers are a thing. And IT teams at many large corporations are not passing around an unsecured CSV files full of passwords. It's CURRENTYEAR. No one should be using team password managers or files to store credentials. There should not be storable credentials.
MrDarcy 4mo ago
The error and omission of not enforcing mandatory security training covering posting plaintext passwords to public sites for CISA contractors is itself an act of gross negligence. So much so the contracting company’s insurer would cite it as the reason why the claim is not covered by their policy.
antonvs 4mo ago
> shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. What do you mean by this? There are password managers and more enterprise-oriented secrets managers, and application platforms typically have integration with them. Individuals shouldn't be using shared secrets. This is a completely solved problem and it's not difficult to set up properly, especially in a cloud environment like AWS, where you can use services like AWS Secrets Manager.
- deleted 4mo ago
  [deleted]
Forgeties79 4mo ago
> While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security. This isn’t a grocery store or something it’s CISA. This is like a gun going off in a cop’s holster while he’s texting and driving without a seatbelt. Yeah he’s a contractor but that doesn’t suddenly allow for such incompetence.
- sandeepkd 4mo ago
  I have worked with some of the experienced folks in federal space in the past, who were super smart, experienced and COSTLY from managements perspective. They had the ability to challenge the management on such things. Most of them have either retired, managed out or moved on. What you have here is not a reflection of the individual but the entire management chain. Its a race to make most money and at times these contractors are number of seats to fill at lowest possible cost.
  - Forgeties79 4mo ago
    Totally agree
morpheuskafka 4mo ago
He worked for CISA. Surely there is either a security clearance with indoctrination and training, or at the very least, some sort of mandatory training/onboarding for all contractor staff?
acdha 4mo ago
None of this is true at the federal level, or at least wasn’t before the current administration. There are standards for all of this, and if you haven’t read them most are quite reasonable — I keep the NIST 800-63 reference handy anytime someone tries to say password expirations are a good idea — and there are people who are paid full time to enforce them. Having a password list or static AWS credentials is not only a direct policy violation but also implies a number of other failures, from monitoring GitHub repo administration and secret scanning to failure to enforce policies against sharing credentials (part of everyone’s standard training), require use of phishing-proof authentication, failure to use short-term credentials, etc. One mistake can be an individual but this is a multiple-manager failure going up to the executive level.