Русский корабль - иди нахуй

[BachelorTrek 2,973]

1 minute ago, SL Xpress said:

There are rare earths on asteroids, too. Not that we're anywhere close to that being feasible, but it'd be great if it was.

Helium-3 from the moon for fusion. Companies already exist working to go get it.

[SL Xpress 7,513]

4 minutes ago, BachelorTrek said:

Helium-3 from the moon for fusion. Companies already exist working to go get it.

Heck, my stepfather worked with a Japanese consortium in the early 70s to build a moon base. He has 4 patents for manufacturing processes on the moon, including one where he experimented with actual moon rocks brought back in a zero g environment to demonstrate oxygen could be extracted from minerals found there. Then we killed the Apollo program. 

It's just really expensive with an uncertain ROI, and very little political support. Maybe with the greater commercialization we'll have a chance. I hope so.

[InkaUtexas 25,933]

2 hours ago, Nicole44 said:

Oh and btw I am not the only Zelenskyy fan...he has legions of them. He has not tweeted for nearly 12 hours which concerns, I don't know, millions of us following his tweets. Comedian turned actor turned politician turned leader turned hero. Meanwhile a certain actor named Sean Penn hitchhiked his way to Poland accomplishing nothing. 

Maybe he is busy. I mean, I have also carried a bag that far. Lots of us have. Focus Nicole. 

[Shady Ray 1,633]

Anything beyond a perfunctory analysis of the geographic movement here is over my head, but you military bros might get some info out of it. Obviously, I can't verify the accuracy of it, but it comes from a dude who seems to have some cred in the OSINT crowd.

 

 

As of Feb 28th

 

Status as of this AM:

 

 

 

 

 

Edited March 2, 2022 by Shady Ray

[Shady Ray 1,633]

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

Edited March 2, 2022 by Shady Ray

[Nicole44 22,059]

22 minutes ago, Shady Ray said:

Anything beyond a perfunctory analysis of the geographic movement here is over my head, but you military bros might get some info out of it. Obviously, I can't verify the accuracy of it, but it comes from a dude who seems to have some cred in the OSINT crowd.

 

 

As of Feb 28th

 

Status as of this AM:

 

 

 

 

 

Check mate! God Speed!!!!!!

[FartingMonk 3,606]

6 hours ago, JMFP said:

Transmission level SCADA systems must be on their own private networks per NERC standards so for someone to hack into a transmission SCADA they would have to physically plug in at a substation to hack their way in or break into a control room either way at that point someone would know they are there. It would be easier at the distribution level that doesn't follow NERC standards but then it would be isolated to a smaller region and then what is the real danger if they command distribution breakers to open? Linemen dispatch, turn the controls to local, and close the breakers back in. But also there's like 3000 different distribution companies in the US so to cause a lot of trouble at that level would take a lot of coordination and breaking into a lot of systems. Yeah they could shut off a city and that would suck especially of it's really hot or any cold but it could be brought back up fairly quickly.

At the transmission level all they could really do is trip open lines which would suck but what is the danger of physical damage occurring? Maybe some other lines would be overloaded to the point of self destruction but in order for that to happen all of the automatic relaying would have to be disabled at the same time to keep the overloaded facilities energized until they fell down and you can't do that with SCADA. So again if your SCADA is compromised you dispatch techs to switch the devices to local control and close them back in. Would take a couple days maybe to bring everything back up and it would be suck but would not be catastrophic. And again it is one transmission operator at a time unless a huge coordinated effort is underway.

Generation plants, to gain access to controls in any ones of decent size you'd have to break in to the control room or the plant yard to gain control of the devices. The plants were tied to have their own control rooms on site.

 

A large EMP would fuck our shit up in a hurry though. 

 

But bang for your buck, most cost effective way to fuck up a power system would be physical sabotage. A few 30.06 rounds from a couple hundred yards into a large transformer is a bad day all around. Then if you got a couple buddies doing it too at the same time then a lot of people in that region are going to be living like @Mooseoutfront for a while. Especially right now, most companies are running on very very thin inventory. I mean normally to replace a large transformer takes a while anyway but right now nobody has any spares and replacements are years out. 

 

Anyway, if you require electricity to live then buy a generator and keep plenty of fuel on hand.

 

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

[Underdog 28,627]

4 hours ago, HeHateMe said:

Sean Penn should stick to acting.  Now if he were to start pumping bullets into Russians, or Javelins into armored vehicles, my personal opinion of him might change.  Until that happens, he remains a great actor who is also an attention seeking self absorbed douche bag.  YMMV

What about a pillow case full of sodas? 

[Trey3216 15,346]

6 hours ago, Beantown Express 2.0 said:

You have 3 hips?  I’m no doctor but I don’t think that’s right.

You don’t know how deep the urinals are 

Edited March 2, 2022 by Trey3216

[pops 6,985]

3 hours ago, BamaATL said:

Good grief, this group of photo propaganda needs to stop.  I can hire a few models out of Atlanta, head up to the foothills, get some camo at an Army surplus store in Marietta and get these same types of photos for a total of 5k.  Hot girls sell, quit being stupid folks.  

[956 Worldwide 34,714]

2 hours ago, Shady Ray said:

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

You laugh, but romance-inspired German students who had till recently been communing with nature and backpacking sang their campfire songs as they attacked English trenches in 1914 and got mowed down. Le Boche soon got the hang of things. 

[pops 6,985]

 

[JMFP 1,120]

54 minutes ago, FartingMonk said:

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

Yeah I have a TO, the company I work for is fairly small (about 3000 miles of line) and designated a Transmission Owner, our BA is also technically registered as our TO. We operate under them as a regional dispatch center but I have operational control of all my devices in my control room. We own all our own fiber to our substations and all of our ICCP links are dedicated private lines, not that we have a whole lot. Yeah I can't speak about other's networks but if they are not following NERC CIP requirements then shame on them. I know we take it very seriously.

[Shady Ray 1,633]

7 hours ago, JMFP said:

Transmission level SCADA systems must be on their own private networks per NERC standards so for someone to hack into a transmission SCADA they would have to physically plug in at a substation to hack their way in or break into a control room either way at that point someone would know they are there. It would be easier at the distribution level that doesn't follow NERC standards but then it would be isolated to a smaller region and then what is the real danger if they command distribution breakers to open? Linemen dispatch, turn the controls to local, and close the breakers back in. But also there's like 3000 different distribution companies in the US so to cause a lot of trouble at that level would take a lot of coordination and breaking into a lot of systems. Yeah they could shut off a city and that would suck especially of it's really hot or any cold but it could be brought back up fairly quickly.

At the transmission level all they could really do is trip open lines which would suck but what is the danger of physical damage occurring? Maybe some other lines would be overloaded to the point of self destruction but in order for that to happen all of the automatic relaying would have to be disabled at the same time to keep the overloaded facilities energized until they fell down and you can't do that with SCADA. So again if your SCADA is compromised you dispatch techs to switch the devices to local control and close them back in. Would take a couple days maybe to bring everything back up and it would be suck but would not be catastrophic. And again it is one transmission operator at a time unless a huge coordinated effort is underway.

 

6 hours ago, F250 said:

"Private networks" per NERC standards are not really private. The NERC standards are not very prescriptive despite being inspired by NIST. They leave a lot of room for interpretation as to how to implement a security control. I've seen companies get really cute with "network segmentation" and calling it their separate OT network that is NERC compliant. Laughable shit.

 

1 hour ago, FartingMonk said:

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

 

10 minutes ago, JMFP said:

Yeah I have a TO, the company I work for is fairly small (about 3000 miles of line) and designated a Transmission Owner, our BA is also technically registered as our TO. We operate under them as a regional dispatch center but I have operational control of all my devices in my control room. We own all our own fiber to our substations and all of our ICCP links are dedicated private lines, not that we have a whole lot. Yeah I can't speak about other's networks but if they are not following NERC CIP requirements then shame on them. I know we take it very seriously.

How I want to be when I read this...

 

 

 

How I really am...

 

[TXSG8R 3,362]

6 hours ago, TexasEd said:

I am convinced that some of those abandoned Russian vehicles and uniforms in Ukraine are the infiltration forces sent in to blend into the local population, sabotage, recon, and hunt for high value targets.

 

 

It would have been a lot less conspicuous to come in via train or shitty car.  Plenty of Russians were already there, it’s not like someone would blink at another Russian guy on the street. It’s quite possible that they were abandoned because they are dry on armor or fuel. Doesn’t mean they went back to Russia, they could easily have just linked up with other forces because their vehicle was down. I don’t think deserters and their families will be treated well in Russia, so that has to be cutting though the fuck this shit mood in those conscripts.

[DigglerontheHoof 21,198]

7 hours ago, RDCanecutter said:

You're like all freaky with multiple hip joints and can scratch for fleas behind your ear with your foot.

Good Sir, I do not have fleas.

[Trey3216 15,346]

7 hours ago, SL Xpress said:

They’ll be there fighting decades from now after the war is long over. 

They’re going to Snake Island? 

[Nivek 16,928]

10 hours ago, Gatorubet said:

North Central Nevada it is then….

Austin, NV is um, there.  

[GabrielsHorn 2,183]

 

[956 Worldwide 34,714]

Russia is defaulting on 29 billion worth of bonds today. This is something that investors will remember for decades regardless of what happens.  The premiums Russia will pay for credit will be painful. 

[Hefeweizen 5,321]

Arresting kids for protesting.  Nice look.

[GabrielsHorn 2,183]

 

[NoName 16,351]

8 hours ago, DigglerontheHoof said:

All 3 on same hip 

makoplasty/resurfacing or 3 full on replacements?

fuck that is unlucky. 3 on same hip has to put you in like 0.00001% of folks in the States who have had that same surg 3x.

[Neonmoon 38,129]

Idiots 

 

[DigglerontheHoof 21,198]

1 minute ago, NoName said:

makoplasty/resurfacing or 3 full on replacements?

fuck that is unlucky. 3 on same hip has to put you in like 0.00001% of folks in the States who have had that same surg 3x.

2 complete, 1 just the socket.  Had first the first one at 27.

[NoName 16,351]

7 hours ago, TexasEd said:

I am convinced that some of those abandoned Russian vehicles and uniforms in Ukraine are the infiltration forces sent in to blend into the local population, sabotage, recon, and hunt for high value targets.

 

that's an incredibly expensive 1 way trip for something that could be accomplished in a stolen yugo or literally any other vehicle in the entire country.

[Neonmoon 38,129]

“Precision” strikes 

 

[GabrielsHorn 2,183]

 

[Nivek 16,928]

I'm sorry, but I'm going to just come out and say it.  Russians might be good-hearted people, but centuries have shown that they are just fucking stupid and seemingly will always hand over their country and personal fate to a strongman.

I tend to think of them more as an abused puppy, or drunk abused dogs.

[Dahobbs 17,534]

Just now, Nivek said:

I tend to think of them more as an abused puppy, or drunk abused dogs.

That's very accurate. 

[hookemATL 11,730]

2 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

Did you do too much breakdancing as a young man or something?  Seems really young. Apologies if the real reason was a traumatic event, like clown rape or falling out of a tree. 

[Nivek 16,928]

It's strong, but there's a point where many Russians will ask themselves that if the Ukrainians are bombing their own cities, why is the Russian stock market closed, why are Russian banks struggling, why is Putin banning people leaving with more than $10,000 in foreign currency, why are a shit-ton of companies cutting ties with Russia, why are the tourists disappearing, why can't Russians go abroad or come home, what are the rumors about Russians surrendering to Ukrainians, etc., etc., etc.

Because they are afraid their phones are tapped?

[GabrielsHorn 2,183]

Probably a photoshop but I want to believe it is true. 
 

 

[Parliament 14,258]

Like it has since 2018, this thread continues to deliver.  The only thing it lacks is more MS Paint dick pics.

[Post Oak 20,213]

5 hours ago, BamaATL said:

Good grief, this group of photo propaganda needs to stop.  I can hire a few models out of Atlanta, head up to the foothills, get some camo at an Army surplus store in Marietta and get these same types of photos for a total of 5k.  Hot girls sell, quit being stupid folks.  

Prove it.

[Bateshorn 9,927]

13 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

Hip Replacement Talk Not Going Away.

[NoName 16,351]

15 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

damn dude. hope you are doing well, that's rotten luck.

[NoName 16,351]

as if it wasn't already bad enough to be flying commercial in Russia...

 

[Mitch Cumsteen 18,549]

28 minutes ago, GabrielsHorn said:

 

Thank God the Techno House is still standing. 

[Murfdogg21 4,412]

29 minutes ago, GabrielsHorn said:

 

Some invading soldiers would hit up a tavern, others perhaps a brothel. But in true Euro fashion, this fellow just can’t wait to get into the Techno House. 

[Murfdogg21 4,412]

25 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

THA talk not going away

[TXSG8R 3,362]

1 hour ago, Shady Ray said:

 

 

 

How I want to be when I read this...

 

 

 

How I really am...

 

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[TwiceHorn 31,464]

7 hours ago, Hermanator said:

Is it handing over when elections are rigged and whoever takes power has any dissention squashed with murder and arrest?

We're getting dangerously close to sliding down that path ourselves

Yes, and the latter is what makes me think that.

The other thing is the real Russian analysts speak of this "Russian grievance" about being disregarded by the West and having their territory chopped up.  And that this justifies imperialism with atrocity (as if there's some other kind).  Putin may believe that, but I actually kind of doubt it.  I think Putin is all about Putin and the fact that he starts a wag the dog war every couple of years before he stands election lately means that he uses that "Russian grievance" to galvanize the Russian people behind him.

It's a completely retrograde and illiberal notion that started going out of favor in the 17th-18th centuries.  Even their burst of "modern" thinking with Communism was shot through with imperial ambitions.

I think SLX is right, and xenophobia (kind of at the root of all of this) is fundamental to human nature and something that humanity will struggle to overcome for the remainder of its existence.  But it can be done, to a greater or lesser degree and "western civilization" has done so, to a greater degree than the east.

Edited March 2, 2022 by TwiceHorn

[Buzzrock 14,920]

3 minutes ago, TXSG8R said:

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[Pescado_Rojo 19,416]

32 minutes ago, Neonmoon said:

Idiots 

 

Now let's take a live look at the protests at TAMU Moscow....

[Parliament 14,258]

1) Russian tennis player - Go fuck yourself

2) Why was she allowed to play?

 

[StruggleBus 3,922]

1 minute ago, Parliament said:

1) Russian tennis player - Go fuck yourself

2) Why was she allowed to play?

 

Making random people from Russia the “enemy” is stupid. 

[MaybeACoordinator 8,349]

4 hours ago, Shady Ray said:

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

I've long been in favor of two-year conscriptions for the USA. Doesn't have to be military. But that's another thread

30 minutes ago, Dahobbs said:

That's very accurate. 

Russians, man. A bunch of them used to hang out at Valhalla, the Rice U grad student pub. For those of you who don't know, it's infamous for it's ridiculously cheap beer. I haven't been in about ten years but I doubt it's much more than a dollar a cup even today. Back in 1999, it was 50 cents. So I went in there one Wednesday night and it was pretty empty. There was this one Russian dude in there drunk off his ass slamming beers as soon as he the bartender set them down. The only thing that slowed him down was that he was paying for each 50 cent beer with individual hand-written checks. You could tell he was having trouble with the Roman alphabet, too. So he'd get a beer, down the hatch, and spend the next five minutes trying to write checks for 50 cents. I finally took pity on him and gave him about $3 and told him to party on.

[Telegraph_it 3,357]

12 minutes ago, TXSG8R said:

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[Buzzrock 14,920]

Checking in this morning: are there other significant developments besides:

-Kahrkiv is still holding on but running out of food

-The 40km column has been halted by drones

-Kherson has fallen