Risk
6/19/2013
12:36 PM
50%
50%

NSA Tests IT Access Control Restrictions

Could two-person access requirements and better automation prevent future leaks?

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The National Security Agency (NSA) is studying new information security policies and technology to help the agency prevent future leaks.

Testifying before the House Intelligence Committee Tuesday, NSA director Gen. Keith Alexander said that measures under consideration include requiring two people, with comparable levels of authority and experience, to be present before any highly sensitive data can be accessed, even if only for systems administration purposes.

In his testimony, Alexander defended the agency's surveillance programs -- with names such as Mainway, for traffic analysis of cell phone calls; Prism, recording Internet-borne audio, email and video; Marina, for Internet traffic analysis; and Nucleon, for telephone content interception -- in the wake of details of the programs being leaked earlier this month by Edward Snowden.

[ How much do we really know about how Prism works? Read Defending NSA Prism's Big Data Tools. ]

While employed by Booz Allen Hamilton, Snowden worked as a contract NSA systems administrator. He wasn't unique; the agency relies heavily on IT contractors who hold top-secret clearances, as Snowden did. In fact, Alexander told the committee that about 1,000 of the agency's contract employees serve as systems administrators.

Now, however, Alexander said the agency is investigating whether it can use technology to automate more systems administrator responsibilities. Another proposal the NSA is considering to safeguard agency secrets against rogue employees is to put in place the two-man rule, which would require at least two people to be present before systems containing sensitive data could be accessed. The technique is already used to safeguard nuclear launches -- as portrayed in movies such as WarGames and The Hunt For Red October -- as well as to physically secure access to some types of sensitive information or systems. But according to information security experts, it's rarely used, because the technique slows down even routine tasks.

Despite the proposals being mentioned, Alexander told the committee that the NSA still didn't know how Snowden had gained access to the classified material that he leaked. "We are looking at where the oversight broke down," he said.

But the Los Angeles Times, quoting an unnamed U.S. official, recently reported that NSA investigators had identified which server Snowden accessed and which documents he copied onto a USB thumb drive. According to journalist Glenn Greenwald, who broke the story, Snowden leaked "thousands" of documents, of which "dozens" were newsworthy.

Despite those documents going missing, in the hearing, both House Intelligence Committee Chairman Mike Rogers (R-Mich.) and ranking member C.A. Dutch Ruppersberger (D-Mary.), who together co-authored the divisive CISPA bill, expressed their support for the NSA. Even the title of the hearing, "How Disclosed NSA Programs Protect Americans, and Why Disclosure Aids Our Adversaries," telegraphed the committee's prevailing viewpoint, with Alexander reportedly facing a warm reception.

That began with Rogers' opening remarks. "One of the more damaging aspects of selectively leaking incomplete information is that it paints an inaccurate picture and fosters distrust in our government," he said. "It is at times like these where our enemies within become almost as damaging as our enemies on the outside."

Some legislators did, however, press Alexander on program details, including how access to the collected information was protected, and if it might also be subject to leaks. "This is historically unprecedented in the extent of the data that is being collected on potentially all American citizens," said Rep. Jim Himes (D-Conn.). "We know that when a capability exists, there's a potential for abuse." But Alexander responded that access to captured metadata was highly restricted, and that any inappropriate access would lead to the rogue analyst being detected and caught.

Alexander further defended the surveillance programs, which were launched under a still-secret reading of the Patriot Act, by saying that they'd helped foil 50 terror plots, although that assertion wasn't backed up by any evidence. Under questioning, he said that intercepts of foreign Internet communications had helped in about half of the cases, while traffic analysis of phone calls had helped in 10 of those cases.

Critics of the NSA's surveillance programs, however, said that the hearing did little to probe those programs or address the implications of what Snowden described in a Q&A Monday as "the largest program of suspicionless surveillance in human history."

"This hearing isn't a fact-finding mission, it's a PR stunt," Michelle Richardson, legislative counsel at the American Civil Liberties Union, told The Wall Street Journal. "It's clear that leadership of the intelligence committees consider themselves part of the intelligence community, not an independent body tasked with its oversight."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5427
Published: 2015-03-29
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read pa...

CVE-2014-5428
Published: 2015-03-29
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integratio...

CVE-2014-9205
Published: 2015-03-29
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.

CVE-2015-0528
Published: 2015-03-29
The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files.

CVE-2015-0996
Published: 2015-03-29
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive info...

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.