The National Security Agency does not see its mission as being limited to peering through keyholes. In addition to trying to figure out what “the other guys” are up to, the NSA also tries to protect our cyber shores from attack. This part of NSA’s mission is far from new, but it got some interesting and maybe confused press coverage recently.
The U.S. National Security Agency does not see its mission as being limited to peering through keyholes. In addition to trying to figure out what “the other guys” are up to, the NSA also tries to protect our cyber shores from attack. This part of NSA’s mission is far from new, but it got some interesting and maybe confused press coverage recently.
The NSA has been telling people how to think about computer security at least since the early 1980s. The original Trusted Computer System Evaluation Criteria (aka the Orange Book) was published in 1983, and since then the NSA has published various documents to help people evaluate the security of systems or to configure systems in the most secure way that can be done considering the underlying operating system. For example, the NSA has an online repository (under the umbrella of the agency’s Central Security Service) of more than 70 guides for configuring PCs, routers, switches and firewalls.
The latest batch of guides includes one for configuring Apple OSX systems – something I found interesting and well done. In mid-October Daniel Wolf, the NSA’s information assurance director, spoke at the Microsoft Security Summit East. The summit is a traveling road show focused on security in Microsoft products. I went to the one in Boston and found it generally useful, even more so because my Apple OSX bias has left me without as much personal experience with Windows security issues as many of you have. In a keynote speech, Wolf talked about a number of things, but different ears seem to have focused on different things he said or maybe overinterpreted his words.
The official NSA press release focused on Wolf’s enthusiasm for vendors’ “progress and future plans to enhance the security of operating systems and desktop applications” and the fact that “the onus is now on the users” to do their part by “applying the latest patches and software updates.” This report says Wolf also mentioned two of the national and international efforts that the NSA is engaged in to promote the development of security criteria and for security testing.
The latter project has tested and ranked the security of a large number of products. I am not all that sure the reporters from Federal Computer Week and Government Computer News went to the same talk described in the NSA press release or that they went to the same talk as each other, even though they both wrote about a mid-October speech by Wolf. The Government Computer News reporter focused on the NSA’s development of a “three-phase architectural plan for secure worldwide data sharing” among intelligence agencies and the military. She also mentioned in passing a possible, but yet unfunded, office to push high-assurance software that she quoted Wolf as saying would be a modern equivalent of the World War II Manhattan Project. The reporter for Federal Computer Week made the unfunded office the focus of her report, noting that it would be a government-funded research center “devoted to improving the security of commercial software.” She also included mention of government concern over the offshore development of much of the next generation of commercial software.
So, maybe the NSA is planning a new Manhattan Project and maybe it is not. In any case, the agency continues to crank out useful work (at least what we are permitted to see).
Disclaimer: Harvard’s expansion into Allston, Mass., might be almost as expensive, in non-constant dollars, as the original Manhattan Project but it will be nowhere as secret (at least going forward). But the above commentary is my own.
