Jump to content

Telegraph_it

Legacy Members
  • Posts

    3368
  • Joined

  • Last visited

Posts posted by Telegraph_it

  1. 22 hours ago, PenelopeWitherspoon said:

    Nope.  You can’t do Rome justice in 2.5 days, and you can’t do the Amalfi Coast justice on a day trip.

    Agreed. I would skip Rome and go to the countryside. 

  2. 4 hours ago, 956 Worldwide said:

    Poland is kicking ass and really rehabing their democratic backslider image.  The Slovaks and Romanians and Czechs are kicking ass too. It’s good to let Europe get this one given that they were so dovish for so long.

    And their version of Budweiser is great. I remember it being cheaper then water. At least that is how I justified expensing it. 
     

    image.thumb.png.1d20a3ac88552e117da3d53ce764cef8.png

  3. 3 minutes ago, Armybrat said:

    We intend to return to London to finish our England tour within a year, bur will fly with Virgin....fuck British Air. 
    (because of their highway robbery, and the fact that the FA would not let The crippled up Mrs. Brat take one of the several empty business class reclining seats we could see in the cabin directly in front of ours)

    To be fair to BA no airline is going to let someone use a lay flat just because it is empty. 
     

    United turned a plane around recently because two passengers would not unseat themselves from business class seats they didn’t pay for. 
     

    But OP should go on Virgin. I’ve only flown Virgin Australia and the business class product was great. I don’t know about 787 but there is a bar on the 777. 

    • Hook 'Em 2
    • Like 1
  4. 5 minutes ago, Pods said:

    I believe discussion was that F-16's to Ukraine wouldn't work, because their pilots aren't trained and are a bit busy for the training right now. NATO can pick up the slack while the Polish pilots get trained. 

    I thought Poland and Romania were handing over Russian made aircraft to Ukraine and getting F-16s as replacements. 

  5. 12 minutes ago, TXSG8R said:

    The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

    RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

    Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

    One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

    I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

    Frustrated Keyboard GIF

    • Haha 2
    • Drool 1
  6. 3 minutes ago, Doc Reeves said:


    The rocks!

    * right behind the bridge is that amusement park with the really large clown face overlooking the harbor you can see for miles. 

    i dont know why but that fucking thing still shows up in my nightmares. Weird. 

    Oh shit. I’m glad I never ventured that far. I did do the bridge tour and climb the first time I visited Sydney but thankfully I missed that damn clown. 
     

    There is a great pub in the rocks called The Glenmore that I’ve spent a decent amount of time at. The rooftop was always great for lunch after flying all night. 

    • Hook 'Em 1
  7. 9 minutes ago, Bateshorn said:

    I survived LA to Sydney in 94 when you had what ever canned and edited movies Quantus played on the drop down screen. Dark times. 

    My old man and I did IAH-SYD nonstop (17.5 hours) in November 19 for a long weekend to say that we did and to pub crawl with some coworkers from Melbourne and Sydney. 
     

    Well timed because then Covid happened. 
     

    For some reason I even decided to watch garbage football down there. 
     

    image.thumb.jpeg.dc49a206f677515ea8c8ce110b766640.jpeg

    • Hook 'Em 5
×
×
  • Create New...