Mark,
I appreciate your outrage. I also appreciate the outrage that is apparent in the tone of the article.
@Flyslinger2 wrote:
Fridays announcement of a huge data spill of classified documents from a Navy contractor is gaining lots of traction. Several public sources corroborate the spill. This article has the most sound judgement and recommendations of those that I have read:
http://observer.com/2018/06/china-steals-of-department-of-defense-navy-secrets-security-breach/
How does an announcement like this affect you?
I have an issue with the some of the emotive language used in this piece though. It takes away from my identifying the problem behind the problem.
Reducing the ranks of folks that exhibit poor decision making skills and impulse control (alcohol abuse, sexual assault, etc.) among those having a clearance is the right way to go in my opinion. It is a step toward increasing the percentage of folks with good decision making skills and impulse control with a clearance. The granting of a clearance is a privilege not a right. It's the same type of evaluation you might make of someone who handles money for your organization.
The risks and the rewards on either side of the equation are both significantly higher for the military; not *just* the risks. A business implements security and chooses between implementing a security measure, or doing operations a certain way that slightly reduces revenue in favor of increasing security; while the military chooses between implementing a security measure, or doing operations a certain way that slows or prevents successful operations that result in loss of life in favor of increasing security. I believe that this causes a significant number of misunderstandings about why risks with information storage and transmission are still taken by the military.
The first thing is that the article glosses over in my opinion, that the information that was allegedly collected was Unclassified. It was still not supposed to be public, but at the same time, the information was identified as not rising to the level needing protection as classified information.
The second thing is that this alleged disclosure was the result of action by an advanced adversary to circumvent what might have been appropriate security for Unclassified information; not an accident or inappropriate security measures for Unclassified information. It may very well be that the company put in place all of the necessary security to protect Unclassified IT systems.
The final thing is that aggregating lower security information into a higher security collection is a living process. It is often an indefinite opinion – that may change as information custodians or security managers come and go - on what point that the collection tips the scale upward in its protection requirements.
It’s not really apparent how the alleged breach occurred, but it came across to me as though all this information was stored in one place. I think in that case it would be because of a failure to identify when a collection of Unclassified information reached the threshold of it becoming classified. And instead of punishing anyone other than the hackers that steal information, setting a more directive review policy and providing additional training on recognizing when Unclassified collections become Classified is in order That training should be specifically for information custodians and security managers (as opposed to everyone, although everyone could have access to it).
Thanks for bringing this up for discussion!
Sincerely,
Eric B.
