You are here

NSA

The First Textbook Certified by the NSA

CNSS LogoI received an email this morning announcing that Elementary Information Security has been certified by the NSA's Information Assurance Courseware Evaluation program as covering all topics required for training information security professionals. Here is the certification letter.

This is the first time thay have certified textbooks. In the past they've only certified training programs and degree programs.

The evaluation is based on the national training standard NSTISSI 4011. The book also covers the core learning outcomes for Information Assurance and Security listed in the Information Technology 2008 Curriculum Recommendations from the ACM and IEEE Computer Society.

Wordpress tag: 
Post category: 

More puzzles from the Puzzle Palace

A reader pointed me to an apparently dull collection of NSA documents recently posted by that useful source, GovernmentAttic.org. One of the hidden gems is a "CMI Newsletter" containing a eight pages of crypto puzzles.

I've taken the liberty of posting the CMI Newsletter separately (PDF, click this link), but kudos go to GovernmentAttic for dredging up this diamond in the rough. If you work out answers, feel free to post them here, or at least provide a pingback so interested people can find them.

Post category: 

A Memoir of Secure Computing Corporation

Now that Secure Computing Corporation is a memory, having been acquired by McAfee, I'm going to write up a few memories of my own experiences. At one point I posted much of this in the appropriate Wikipedia entry, but that's actually not kosher. Since much of it is based on personal recollection, these words fall in line with what they call "original research." So I'm posting it here.

scclock-sm

I joined Secure Computing about a year after it came into existence. It was called "Secure Computing Technology Corporation" at the time. By the time I left, they'd gone through three more company presidents, 4 corporate logos, several mergers, and bounced the corporate headquarters from Minnesota to Silicon Valley.

Boak's Puzzle Revisited

A reader, GregoryF, has proposed a solution to Boak's puzzle. Many years ago, David G. Boak of the NSA gave lectures to train employees on communications security matters. In one case he presented a written story about insufficiently burned crypto materials (keys, etc.), several tons' worth, that needed disposal.

Boak didn't quite explain how they disposed of the waste. Instead, he coded the answer using an innocent text system and challenged the readers to solve it.

GregoryF's solution is posted as a comment to the earlier article. He actually came up with two different solutions. The "system" behind the second solution gets somewhat complicated, which casts some doubt on its correctness. Also, I haven't quite recovered the same results.

Spoilers ahead!

Wordpress tag: 

Boak's Puzzle: Disposing of Classified Trash

Recently I was skimming through the NSA's "classified history of COMSEC" (posted at governmentattic.com).  This "history" is a transcription of lectures by David G. Boak, who liked to explain NSA-related topics from a historical perspective. He clearly inspired a generation of NSA's employees. The last "real" page of the document contains a humorous story and a crypto puzzle (link to pdf).

The NSA had an incinerator in their old Arlington Hall facility that was designed to reduce top secret crypto materials and such to ash. Someone discovered that it wasn't in fact working. Contract disposal trucks had been disposing of this not-quite-sanitized rubish, and officers tracked down a huge pile in a field in Ft. Meyer.

How did they dispose of it? The answer is encrypted in the story's text!

Wordpress tag: 

Techno-zombies and Pluribus

I'm always amazed at how long a piece of apparently obsolete equipment can remain in service, especially in government service. Bruce Schneier's blog listed a link to NSA's 1991 video catalog at governmentattic.org. The catalog grants us an interesting if spotty view into the world of crypto gear and classified data collection systems.

I was particularly astonished to see inclusion of a video about the Pluribus - a long-obsolete Arpanet-era packet switch. I worked on the beast: it was overbuilt and underpowered. And unreliable (more on that another time). In the ideal world of tech, such obsolete junk should have been recycled by 1991. I was optimistic.

Obama's Blackberry: An interesting problem

Marc Ambinder of the Atlantic recently blogged about alternative Blackberries that President Obama may carry. Some people might wonder why this is such a big deal. Ambinder notes that "Government Blackberries" can handle classified information "up to Secret" but that you need a Sectera Edge from General Dynamics to do anything (voice only) at Top Secret.

Words of the President are obviously valuable, whether voice or text. Even if we ignore spies, think about the interest they carry for news reporters, government contractors, political operatives, and other presumed patriots. So, to start with, we have to ensure that the President's words are only released when he decides to do so.

The government has established several strategies for protecting information assets. While we don't necessarily know what they're doing in the White House, we can make some educated guesses. The problems, and solutions, revolve around multilevel security, also called MLS.

Post category: 

Stream Cipher Reuse: A Graphic Example

Take a look at the following image. You should see two different 'messages' here.

Smiley overlaying the \

  Two messages

This particular mis-mash of messages reflects the failure of otherwise strong cryptography: the improper implementation of a one-time pad or a stream cipher.

Post category: 

Multilevel Networking

As computer costs fell and performance soared during the 1980s and 1990s, computer networks became essential for sharing work and resources. Long before computers were routinely wired to the Internet, sites were building local area networks to share printers and files. In the defense community, multilevel data sharing had to be addressed in a networking environment. Initially, the community embraced networks of cheap computers as a way to temporarily sidestep the MLS problem. Instead of tackling the problem of data sharing, many organizations simply deployed separate networks to operate at different security levels, each running in system high mode.

Post category: 

Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer