Think before you make policy changes...
Published on July 28, 2008 By greywar In Security

Q: When does adding secuirty policies make you less secure?


A: When you forget that there are these things called "users".


     If you were to send an email from a government computer and it included a drop down menu (in which you *must* choose an option to send email) that had 2 choices:





    Would you assume that the system you were on was authorized to process SECRET information? Seems logical to most folks but on many Government computers you would be wrong. Wrong and on the way to commiting a serious security violation/spillage if you were to actually send SECRET level information.

    The goal of adding the classification box was to ensure that all UNCLASSIFIED emails were marked as such (a regulatory thing) but the implementation of it leaves the users with the idea that they can send SECRET info securely over NIPR (that's Non-Classified Internet Protocol Router Network) only machines when you should be sending it only on SIPR (Secret Internet Protocol Router Network) boxes.

    This is BAD security. A particularly egregious example of Security Theater actually.

    Sometime I need to post about making your password policy so "secure" that users are forced to circumvent the system but not today.


Bonus question:


Q: Why would you label an email SECRET on an UNCLASSIFIED system?


A: To make life easier for the prosecuting attorney at your Court-martial!


Site Meter

on Jul 28, 2008

Oh wow. This is funny because today I was looking at.. some stuff.. about the box that rhymes with Hex-rhidus today and was asked where I found it. I said some guy. The follow-up question was, "Is it unclassified?" And I thought hmm... I hope so. It was sent to me over the unclassified network.

We don't have the drop-down menu though. So, maybe we need that?

Nice to see you're alive Greywar. I am also... alive.

on Jul 29, 2008
And I thought hmm... I hope so. It was sent to me over the unclassified network.

Unfortunately even without the drop=down box to confuse users there are tons of classified materials sent over NIPR every day.

Good to see you too Tal... If you ever get the urge to find work in Az let me know... We have a whole office full of nerds here so you would blend right in.