Thanks goodness they changed the forums fomat. Someone is using their heads for
something other than a place to hang a sweater cap.
That said, I have replied to Dave and sympathize with his plight. I too am
with a "Gov Agency". Probably not the one Dave's associated with. Through my
years I have learned one thing within the Gov, power and knowledge are not one
and the same.
Information Security within the gov is an oximoron. Most agency CIO's and
CISO's have about as much knowledge of Information Security as the half a sleep
rent a cop downstairs checking badges.
Now I don't want to get off on a rant here but, one agency I worked with as an
Information Security Auditor (for the Inspector General) investigated me after
I supervised a contracted pen test team for breaking into the email of the
agency IG. Short story, apparently at one of the sites we tested there had
been a problem with an employee embezzling funds in excess of $500,000.00. The
IG was investigating the problem on site and also had a presence there. When
one of the pen testers asked me, 'What does OIG stand for?' it quickly raised a
red flag with me.
I asked who were the emails from and to? The pen tester stated the names of
the IG himself and other investigators. I made the decision to take the
information as evidence to show the IG that we needed to have our own domain
and separate subnets and use encryption for communications. Instead of
realizing the benefit of this they put me through two years of an incitement by
a Federal Grand Jury.
Today they have retired and are living quietly with their grand children all
the while the legacy they left behind has only got worse.
I now work as the Security Specialist with a different agency. My job is
simple. I pen test our web sites. Policy, Requirements and legal stuff are
not my concern. The sooner he realizes that the power within the Government
can only make your life miserable and cost you and your family a lot of
heartache and unrecoverable mondy, the sooner he will begin to live a long life.
The Government was here before us and it will be here a long time afterwards
without us.
It's frustrating to read the next days headlines about the latest hacked Gov
agency. We just had one. Why?, because the powers that be have no knowledge
why.
