Hacker News Reader

Comment by bush-bby | Hacker News Reader

Maybe a stupid question but it seems very foolish to target fedramp companies? I mean why would this not attract the attention of some very effective 3 letter agencies? Granted it’s not technically supply chain, but the recent fed retaliation to darkside, etc. comes to mind.I just feel it’s phenomenally hubristic to brag on social media about penetrating fed ramp certified federal contractors…they are highly likely to be interacting with top secret level info.

View on HN

If you are operating from a jurisdiction that's already under heavy sanctions or severed diplomatic relations and extradition is unlikely, the laws of another country don't really matter.

I understand that, but I was thinking more in terms of retaliation. The sword cuts both ways. Haven’t the feds been bringing down the hammer on these sorts of groups lately?(by that I mean attacking back)

There have been some headlines about what you reference but I'm skeptical that work has amounted to anything lasting.

That’s fair, I guess I’m relatively skeptical as well. I’m just surprised it’s still worth the risk for these groups.

It's worth noting we don't know what the true motive of any group that claims to be solely about ransomware and extortion actually is.

Yeah, Definitely agree.

Yes but equally powerful actors (relatively speaking) are interested in such resources and attacks, and can ensure the same high level of comfort for the attackers, so it's probably a wash.

When they always have a safe haven to run to and lay low in a comfortable way without significant losses (that aren't just cost of business), what good is such a slap?

In my mind I see it like the same as throwing a beer bottle at a robbers car as they drive away. Even if you hit it, at best it's some scratches or maybe a busted tail light, but they're still gone with your goods.

I doubt anyone working for such powerful actors are gloating about their breaches on social media.

This is not how FedRAMP works, re: “interacting with top secret”…

No secret or top secret info is permitted in the typical Impact Level 4 and Impact Level 5 FedRAMP systems. Okta is only certified at IL4 I think.

AWS & Azure do offer IL6, meaning information processed up to the SECRET classification.

Sure, but what I was referring to was the fact the attackers claim to specifically be attacking okta customers themselves. I’m saying there is a high overlap between fedramp and companies which somewhere in the organization there will be access to highly sensitive info. Not saying they are in possession of, but have access to for many contracts.

> highly likely to be interacting with top secret level info.

Doubt it

Wdym? There’s a high overlap in contracts which require top secret clearances for kps involved, and Fedramp certified companies…

I kind of agree with the parent. Putting top secret info into AWS feels... insane. When I worked for a gov't contractor the top secret info was kept in a faraday caged room.

AWS has had a Top Secret-certified region (AWS Top-Secret-East) since 2014. IIRC, it's physically located on-site at the NSA. They launched a Secret-certified region in 2017, and just launched a second TS region on the West Coast in Dec. 2021.

Government is big business for AWS.

Wow that reads like dystopian science fiction, not sure why!

Interesting. I wonder how much it gets used. That said, my contractor work was pre 2014, so yeah sounds right.

Certified doesn't mean they use it that way

Reply on news.ycombinator.com