This was my favorite part, and a good lesson for every startup. Skip over all the overrated recent Stanford grads and Box alumni, THIS is the guy you want to hire:
"Only one person in the entire Department of Defense, a technical officer in a Marine unit in the Pacific, responded to the attack in an effective manner: seeing that something odd was happening with the computer server, he pulled it offline at his own initiative."
If you ask me the best response was the officer who told his commander he "didn't trust his command and control".
In my mind this indicates someone who is aware of the issue, and is already taking action to work around the problem - which in the military mind was not that some computers were hacked, it was that C3 mechanisms couldn't be counted on.
Fortunately the military trains officers to deal with decision-making in ambigious situations and creating workarounds when taking battle damage. I'll be willing to bet the next sentence in that message was a suggestion for how he would proceed.
I generally disagree but it depends on the server. That technical officer made the attacker's DoS attack a success. Imagine if everyone responded that way to questionable activity.
> Everyone in the room was stunned, not least John Hamre, who had been sworn in as deputy secretary of defense at the end of July. Before then, Hamre had been the Pentagon’s comptroller, where he’d gone on a warpath to slash the military budget, especially the part secretly earmarked for the NSA. Through the 1980s, as a staffer for the Congressional Budget Office and the Senate Armed Services Committee, Hamre had grown to distrust the NSA: It was a dodgy outfit, way too covert, floating in the gray area between “military” and “intelligence” and evading the strictures on both. Hamre didn’t know anything about information warfare, and he didn’t care.
I say, bravo to the NSA for uncovering the vulnerability. But, the cynic in my wonders how long anyone over there had suspected this, but never acted on it until faced with the threat of having feed pulled from the trough. My prejudices lead me to think of government as tending towards the dysfunctional. So, I worry if the same sort of thing isn't going on right now.
This is the problem. The pendulum swings too far one way and then eventually swings too far back the other way, this is a classic example.
We started with little or no security and the NSA barely had a budget for information warfare - now many people think they have an unlimited budget to do this and some of the stuff they're doing has been demonstrated to be pretty sketchy.
At some point, more oversight will reign them in a little, until something else happens to push the pendulum further back in the direction it just came.
That's surely a part of the US government that is in dire need of more checks and balances.
Another even more telling thing revealed in this article; the very end where they realize that /no one/ is 'in charge' of fixing this. (Arguably because they ALL are. This is all what should be general OpSec training!)
The unmentioned background to Eligible Receiver is that the previous summer, the National Security Studies Quarterly published a paper by Eric Sterner entitled Digital Pearl Harbor: National Security in the Information Age.
Curious thing to me is at what point do you switch from saying this was a test to this is the real thing; meaning that you task the NSA to hack someone, then blame it on for example North Korea, China, etc.
It's possible we've already seen this with the Sony hack. Even if the loudest adherents to this theory have been somewhat discredited this year, nothing produced by Mr. Fart et al. contradicts it in convincing fashion.
"Only one person in the entire Department of Defense, a technical officer in a Marine unit in the Pacific, responded to the attack in an effective manner: seeing that something odd was happening with the computer server, he pulled it offline at his own initiative."