NSA had NFI about opsec: 2016 audit found laughably bad security
Unlocked racks. No 2FA. No access control lists. No wonder Snowden got away with it
Second-rate opsec remained pervasive at the United States' National Security Agency, according to an August 2016 review now released under Freedom of Information laws.
It's almost surprising that the agency was able to cuff Reality Winner, let alone prevent a wholesale Snowden-style leak. The Department of Defense Inspector General report, first obtained by the New York Times, finds everything from unsecured servers to a lack of two-factor authentication.
The formerly-classified review (PDF) was instigated after Snowden exfiltrated his million-and-a-half files from August 2012 to May 2013.
“NSA did not have guidance concerning key management and did not consistently secure server racks and other sensitive equipment in the data centers and machine rooms” under its “Secure-the-net” initiative, the report says.
Data centre access is supposed to be governed by two-person access controls, the report notes, and the rollout of 2FA to “all high-risk users” was incomplete at the time of writing.
The agency had too many users with admin privileges, the report continues, they're insufficiently monitored, and the NSA had not cut the number of agents authorised to carry out data transfers.
Server access was probably the most outstanding security gap: in three facilities – NSA's Texas facility, its Utah data centre, and at a laboratory in North Carolina State University – an audit team “observed unlocked server racks and sensitive equipment”.
It's almost a surprise that the NSA was able to respond to the audit team at all: “NSA did not keep accurate and detailed documentation that identified its methodology for completing each initiative”, the audit says, and “did not describe how it measured the initiatives' completeness and effectiveness”.
Hence, at least in August last year, the report says the insider threats still existed.
In the main the NSA has taken its lumps and says it will implement the report's recommendations, although there's also lots of redacted bits in the document that make it hard to know exactly what's going on. ®