Hacker News Reader

Comment by niels_olson | Hacker News Reader

As a sailor in the US Navy, let me quote from the Chairman's letter leading the OPM breach report (1), here he is addressing all federal CIOs:

The effectiveness of our country's response depends on your answer to this question: Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans?

I guarantee most Federal CIOs never even saw the report, and wouldn't believe the question actually applies to them. The folks at DDS did though (including Matt Cutts), and I'm willing to bet they have it pinned up on the wall.

(1) https://oversight.house.gov/wp-content/uploads/2016/09/The-O...

View on HN

> Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans?

Perhaps a better question is: can anyone be expected to properly secure data on that scale, against well-resourced malicious actors?

Has Google ever suffered a breach on this scale? Having worked in IT in the government vs. the private sector, it really seems as though government could care less about security.

Does operation Aurora count by the Chinese government? It was a big enough deal to Google that they stopped operating a search engine within China's borders. https://en.m.wikipedia.org/wiki/Operation_Aurora

https://www.washingtonpost.com/world/national-security/chine...

How about when Google's data center links were tapped by the NSA?

https://www.washingtonpost.com/world/national-security/nsa-i...

I thought it was mostly IP and a couple of accounts that were taken. Nothing on the scale of millions of records taken? I could be wrong however.

It was a pretty serious breach as far as I remember. The assailing party was looking for specific accounts, and got what they were looking for. Just because they didn't take millions of records didn't mean that they didn't have access to them.

Google right after the NSA reveal started doubling up on their efforts to use encrypted links between servers within their data centers, leading me to believe that it could have been a lot worse - just get access to some non-critical host, and if the traffic is unencrypted, just hang out with a packet sniffer and just record all traffic passing by.

Google is much more vigilant with their security (not that they weren't before, just even more so) - It's better to not underestimate the extent of breaches.

When I search my email on haveibeenpwned.com, one of my results is the following:

Bitcoin Security Forum Gmail Dump: In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum. Whilst commonly reported as 5M "Gmail passwords", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct, albeit a number of years old.

Compromised data: Email addresses, Passwords

Yes. By the NSA in fact:

https://www.washingtonpost.com/world/national-security/nsa-i...

Most US companies have security breaches all the time. However, unless a social security number, health information or credit card is accessed there are no real reporting rules. Most companies do not disclose attempted/successful cyberattacks on their networks.

Therefore, if google isn't storing large numbers of credit cards, social security numbers of health records they probably will never tell you wether or not they had their servers breached.

I bet quite a big number of those federal CIOs got their "education" from:

"Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research"

http://www.washington.edu/research/centers/126

http://www.uwb.edu/ciac

https://www.pce.uw.edu/certificates/information-security-and...

Taught by a ~70 year old woman with lit major, MBA, fake IT Phd and zero real IT knowledge https://www.coursera.org/instructor/~115

I took three classes wasting my time listening to >50 year old industry veterans(LAX airport CISO boasting how he doesnt know _anything_ about computers etc) tell me CIO role is to get a piece of paper stating you delegated responsibility and obey all the federal/industry pat on the back standards (PCI, HIPAA, SOX).

Take the violated trust in the CIO top of the Navy releasing this news on the day before Thanksgiving.

Reply on news.ycombinator.com