Русский корабль - иди нахуй

[BachelorTrek 2884]

1 minute ago, SL Xpress said:

There are rare earths on asteroids, too. Not that we're anywhere close to that being feasible, but it'd be great if it was.

Helium-3 from the moon for fusion. Companies already exist working to go get it.

[SL Xpress 7491]

4 minutes ago, BachelorTrek said:

Helium-3 from the moon for fusion. Companies already exist working to go get it.

Heck, my stepfather worked with a Japanese consortium in the early 70s to build a moon base. He has 4 patents for manufacturing processes on the moon, including one where he experimented with actual moon rocks brought back in a zero g environment to demonstrate oxygen could be extracted from minerals found there. Then we killed the Apollo program. 

It's just really expensive with an uncertain ROI, and very little political support. Maybe with the greater commercialization we'll have a chance. I hope so.

[InkaUtexas 24819]

2 hours ago, Nicole44 said:

Oh and btw I am not the only Zelenskyy fan...he has legions of them. He has not tweeted for nearly 12 hours which concerns, I don't know, millions of us following his tweets. Comedian turned actor turned politician turned leader turned hero. Meanwhile a certain actor named Sean Penn hitchhiked his way to Poland accomplishing nothing. 

Maybe he is busy. I mean, I have also carried a bag that far. Lots of us have. Focus Nicole. 

[Shady Ray 1633]

Anything beyond a perfunctory analysis of the geographic movement here is over my head, but you military bros might get some info out of it. Obviously, I can't verify the accuracy of it, but it comes from a dude who seems to have some cred in the OSINT crowd.

 

 

As of Feb 28th

 

Status as of this AM:

 

 

 

 

 

Edited March 2, 2022 by Shady Ray

[Shady Ray 1633]

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

Edited March 2, 2022 by Shady Ray

[Nicole44 21941]

22 minutes ago, Shady Ray said:

Anything beyond a perfunctory analysis of the geographic movement here is over my head, but you military bros might get some info out of it. Obviously, I can't verify the accuracy of it, but it comes from a dude who seems to have some cred in the OSINT crowd.

 

 

As of Feb 28th

 

Status as of this AM:

 

 

 

 

 

Check mate! God Speed!!!!!!

[FartingMonk 3603]

6 hours ago, JMFP said:

Transmission level SCADA systems must be on their own private networks per NERC standards so for someone to hack into a transmission SCADA they would have to physically plug in at a substation to hack their way in or break into a control room either way at that point someone would know they are there. It would be easier at the distribution level that doesn't follow NERC standards but then it would be isolated to a smaller region and then what is the real danger if they command distribution breakers to open? Linemen dispatch, turn the controls to local, and close the breakers back in. But also there's like 3000 different distribution companies in the US so to cause a lot of trouble at that level would take a lot of coordination and breaking into a lot of systems. Yeah they could shut off a city and that would suck especially of it's really hot or any cold but it could be brought back up fairly quickly.

At the transmission level all they could really do is trip open lines which would suck but what is the danger of physical damage occurring? Maybe some other lines would be overloaded to the point of self destruction but in order for that to happen all of the automatic relaying would have to be disabled at the same time to keep the overloaded facilities energized until they fell down and you can't do that with SCADA. So again if your SCADA is compromised you dispatch techs to switch the devices to local control and close them back in. Would take a couple days maybe to bring everything back up and it would be suck but would not be catastrophic. And again it is one transmission operator at a time unless a huge coordinated effort is underway.

Generation plants, to gain access to controls in any ones of decent size you'd have to break in to the control room or the plant yard to gain control of the devices. The plants were tied to have their own control rooms on site.

 

A large EMP would fuck our shit up in a hurry though. 

 

But bang for your buck, most cost effective way to fuck up a power system would be physical sabotage. A few 30.06 rounds from a couple hundred yards into a large transformer is a bad day all around. Then if you got a couple buddies doing it too at the same time then a lot of people in that region are going to be living like @Mooseoutfront for a while. Especially right now, most companies are running on very very thin inventory. I mean normally to replace a large transformer takes a while anyway but right now nobody has any spares and replacements are years out. 

 

Anyway, if you require electricity to live then buy a generator and keep plenty of fuel on hand.

 

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

[Underdog 27966]

4 hours ago, HeHateMe said:

Sean Penn should stick to acting.  Now if he were to start pumping bullets into Russians, or Javelins into armored vehicles, my personal opinion of him might change.  Until that happens, he remains a great actor who is also an attention seeking self absorbed douche bag.  YMMV

What about a pillow case full of sodas? 

[Trey3216 15298]

6 hours ago, Beantown Express 2.0 said:

You have 3 hips?  I’m no doctor but I don’t think that’s right.

You don’t know how deep the urinals are 

Edited March 2, 2022 by Trey3216

[pops 6946]

3 hours ago, BamaATL said:

Good grief, this group of photo propaganda needs to stop.  I can hire a few models out of Atlanta, head up to the foothills, get some camo at an Army surplus store in Marietta and get these same types of photos for a total of 5k.  Hot girls sell, quit being stupid folks.  

[956 Worldwide 33957]

2 hours ago, Shady Ray said:

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

You laugh, but romance-inspired German students who had till recently been communing with nature and backpacking sang their campfire songs as they attacked English trenches in 1914 and got mowed down. Le Boche soon got the hang of things. 

[pops 6946]

 

[JMFP 1105]

54 minutes ago, FartingMonk said:

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

Yeah I have a TO, the company I work for is fairly small (about 3000 miles of line) and designated a Transmission Owner, our BA is also technically registered as our TO. We operate under them as a regional dispatch center but I have operational control of all my devices in my control room. We own all our own fiber to our substations and all of our ICCP links are dedicated private lines, not that we have a whole lot. Yeah I can't speak about other's networks but if they are not following NERC CIP requirements then shame on them. I know we take it very seriously.

[Shady Ray 1633]

7 hours ago, JMFP said:

Transmission level SCADA systems must be on their own private networks per NERC standards so for someone to hack into a transmission SCADA they would have to physically plug in at a substation to hack their way in or break into a control room either way at that point someone would know they are there. It would be easier at the distribution level that doesn't follow NERC standards but then it would be isolated to a smaller region and then what is the real danger if they command distribution breakers to open? Linemen dispatch, turn the controls to local, and close the breakers back in. But also there's like 3000 different distribution companies in the US so to cause a lot of trouble at that level would take a lot of coordination and breaking into a lot of systems. Yeah they could shut off a city and that would suck especially of it's really hot or any cold but it could be brought back up fairly quickly.

At the transmission level all they could really do is trip open lines which would suck but what is the danger of physical damage occurring? Maybe some other lines would be overloaded to the point of self destruction but in order for that to happen all of the automatic relaying would have to be disabled at the same time to keep the overloaded facilities energized until they fell down and you can't do that with SCADA. So again if your SCADA is compromised you dispatch techs to switch the devices to local control and close them back in. Would take a couple days maybe to bring everything back up and it would be suck but would not be catastrophic. And again it is one transmission operator at a time unless a huge coordinated effort is underway.

 

6 hours ago, F250 said:

"Private networks" per NERC standards are not really private. The NERC standards are not very prescriptive despite being inspired by NIST. They leave a lot of room for interpretation as to how to implement a security control. I've seen companies get really cute with "network segmentation" and calling it their separate OT network that is NERC compliant. Laughable shit.

 

1 hour ago, FartingMonk said:

Are you NERC certified?  I'm RC and TO and as much as we believe we are off the network we are not.  Remote work has got us into a bigger jam.  My buddies at ONCOR just went with a test thinking the same thing and they got caught pants down

 

10 minutes ago, JMFP said:

Yeah I have a TO, the company I work for is fairly small (about 3000 miles of line) and designated a Transmission Owner, our BA is also technically registered as our TO. We operate under them as a regional dispatch center but I have operational control of all my devices in my control room. We own all our own fiber to our substations and all of our ICCP links are dedicated private lines, not that we have a whole lot. Yeah I can't speak about other's networks but if they are not following NERC CIP requirements then shame on them. I know we take it very seriously.

How I want to be when I read this...

 

 

 

How I really am...

 

[TXSG8R 3325]

6 hours ago, TexasEd said:

I am convinced that some of those abandoned Russian vehicles and uniforms in Ukraine are the infiltration forces sent in to blend into the local population, sabotage, recon, and hunt for high value targets.

 

 

It would have been a lot less conspicuous to come in via train or shitty car.  Plenty of Russians were already there, it’s not like someone would blink at another Russian guy on the street. It’s quite possible that they were abandoned because they are dry on armor or fuel. Doesn’t mean they went back to Russia, they could easily have just linked up with other forces because their vehicle was down. I don’t think deserters and their families will be treated well in Russia, so that has to be cutting though the fuck this shit mood in those conscripts.

[DigglerontheHoof 20449]

7 hours ago, RDCanecutter said:

You're like all freaky with multiple hip joints and can scratch for fleas behind your ear with your foot.

Good Sir, I do not have fleas.

[Trey3216 15298]

7 hours ago, SL Xpress said:

They’ll be there fighting decades from now after the war is long over. 

They’re going to Snake Island? 

[Nivek 16643]

10 hours ago, Gatorubet said:

North Central Nevada it is then….

Austin, NV is um, there.  

[GabrielsHorn 2142]

 

[956 Worldwide 33957]

Russia is defaulting on 29 billion worth of bonds today. This is something that investors will remember for decades regardless of what happens.  The premiums Russia will pay for credit will be painful. 

[Hefeweizen 5210]

Arresting kids for protesting.  Nice look.

[GabrielsHorn 2142]

 

[NoName 16196]

8 hours ago, DigglerontheHoof said:

All 3 on same hip 

makoplasty/resurfacing or 3 full on replacements?

fuck that is unlucky. 3 on same hip has to put you in like 0.00001% of folks in the States who have had that same surg 3x.

[Neonmoon 38126]

Idiots 

 

[DigglerontheHoof 20449]

1 minute ago, NoName said:

makoplasty/resurfacing or 3 full on replacements?

fuck that is unlucky. 3 on same hip has to put you in like 0.00001% of folks in the States who have had that same surg 3x.

2 complete, 1 just the socket.  Had first the first one at 27.

[NoName 16196]

7 hours ago, TexasEd said:

I am convinced that some of those abandoned Russian vehicles and uniforms in Ukraine are the infiltration forces sent in to blend into the local population, sabotage, recon, and hunt for high value targets.

 

that's an incredibly expensive 1 way trip for something that could be accomplished in a stolen yugo or literally any other vehicle in the entire country.

[Neonmoon 38126]

“Precision” strikes 

 

[GabrielsHorn 2142]

 

[Nivek 16643]

I'm sorry, but I'm going to just come out and say it.  Russians might be good-hearted people, but centuries have shown that they are just fucking stupid and seemingly will always hand over their country and personal fate to a strongman.

I tend to think of them more as an abused puppy, or drunk abused dogs.

[Dahobbs 17088]

Just now, Nivek said:

I tend to think of them more as an abused puppy, or drunk abused dogs.

That's very accurate. 

[hookemATL 11496]

2 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

Did you do too much breakdancing as a young man or something?  Seems really young. Apologies if the real reason was a traumatic event, like clown rape or falling out of a tree. 

[Nivek 16643]

It's strong, but there's a point where many Russians will ask themselves that if the Ukrainians are bombing their own cities, why is the Russian stock market closed, why are Russian banks struggling, why is Putin banning people leaving with more than $10,000 in foreign currency, why are a shit-ton of companies cutting ties with Russia, why are the tourists disappearing, why can't Russians go abroad or come home, what are the rumors about Russians surrendering to Ukrainians, etc., etc., etc.

Because they are afraid their phones are tapped?

[GabrielsHorn 2142]

Probably a photoshop but I want to believe it is true. 
 

 

[Parliament 13979]

Like it has since 2018, this thread continues to deliver.  The only thing it lacks is more MS Paint dick pics.

[Post Oak 20068]

5 hours ago, BamaATL said:

Good grief, this group of photo propaganda needs to stop.  I can hire a few models out of Atlanta, head up to the foothills, get some camo at an Army surplus store in Marietta and get these same types of photos for a total of 5k.  Hot girls sell, quit being stupid folks.  

Prove it.

[Bateshorn 9474]

13 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

Hip Replacement Talk Not Going Away.

[NoName 16196]

15 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

damn dude. hope you are doing well, that's rotten luck.

[NoName 16196]

as if it wasn't already bad enough to be flying commercial in Russia...

 

[Mitch Cumsteen 18326]

28 minutes ago, GabrielsHorn said:

 

Thank God the Techno House is still standing. 

[Murfdogg21 4394]

29 minutes ago, GabrielsHorn said:

 

Some invading soldiers would hit up a tavern, others perhaps a brothel. But in true Euro fashion, this fellow just can’t wait to get into the Techno House. 

[Murfdogg21 4394]

25 minutes ago, DigglerontheHoof said:

2 complete, 1 just the socket.  Had first the first one at 27.

THA talk not going away

[TXSG8R 3325]

1 hour ago, Shady Ray said:

 

 

 

How I want to be when I read this...

 

 

 

How I really am...

 

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[TwiceHorn 30715]

7 hours ago, Hermanator said:

Is it handing over when elections are rigged and whoever takes power has any dissention squashed with murder and arrest?

We're getting dangerously close to sliding down that path ourselves

Yes, and the latter is what makes me think that.

The other thing is the real Russian analysts speak of this "Russian grievance" about being disregarded by the West and having their territory chopped up.  And that this justifies imperialism with atrocity (as if there's some other kind).  Putin may believe that, but I actually kind of doubt it.  I think Putin is all about Putin and the fact that he starts a wag the dog war every couple of years before he stands election lately means that he uses that "Russian grievance" to galvanize the Russian people behind him.

It's a completely retrograde and illiberal notion that started going out of favor in the 17th-18th centuries.  Even their burst of "modern" thinking with Communism was shot through with imperial ambitions.

I think SLX is right, and xenophobia (kind of at the root of all of this) is fundamental to human nature and something that humanity will struggle to overcome for the remainder of its existence.  But it can be done, to a greater or lesser degree and "western civilization" has done so, to a greater degree than the east.

Edited March 2, 2022 by TwiceHorn

[Buzzrock 14775]

3 minutes ago, TXSG8R said:

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[Pescado_Rojo 19192]

32 minutes ago, Neonmoon said:

Idiots 

 

Now let's take a live look at the protests at TAMU Moscow....

[Parliament 13979]

1) Russian tennis player - Go fuck yourself

2) Why was she allowed to play?

 

[StruggleBus 3922]

1 minute ago, Parliament said:

1) Russian tennis player - Go fuck yourself

2) Why was she allowed to play?

 

Making random people from Russia the “enemy” is stupid. 

[MaybeACoordinator 8349]

4 hours ago, Shady Ray said:

Watch out world. A bunch of young, less-than-militarily-inclined German men could be forced to swap out their skinny jeans, pointy shoes and black Hugo Boss turtlenecks for, ehhhh, another one of Hugo Boss' best selling outfits (yeah yeah...I know that Boss doesn't make Bundeswehr unis anymore, but its legacy remains).

 

https://www.france24.com/en/live-news/20220301-ukraine-war-raises-spectre-of-conscription-in-germany

 

I've long been in favor of two-year conscriptions for the USA. Doesn't have to be military. But that's another thread

30 minutes ago, Dahobbs said:

That's very accurate. 

Russians, man. A bunch of them used to hang out at Valhalla, the Rice U grad student pub. For those of you who don't know, it's infamous for it's ridiculously cheap beer. I haven't been in about ten years but I doubt it's much more than a dollar a cup even today. Back in 1999, it was 50 cents. So I went in there one Wednesday night and it was pretty empty. There was this one Russian dude in there drunk off his ass slamming beers as soon as he the bartender set them down. The only thing that slowed him down was that he was paying for each 50 cent beer with individual hand-written checks. You could tell he was having trouble with the Roman alphabet, too. So he'd get a beer, down the hatch, and spend the next five minutes trying to write checks for 50 cents. I finally took pity on him and gave him about $3 and told him to party on.

[Telegraph_it 3350]

12 minutes ago, TXSG8R said:

The DoD transitioned to Risk Management Framework for Cyber 4 or 5 years ago, sounds like it’s based on the same NIST/CNNSI guidance. My program was in the first block of systems to switch over from DIACAP.  They gave us a 12 month timeline and it took almost 2 years to get our ATO. It was and is a nightmare on the DoD side to implement because of the diversity of systems and the gov’ts need to apply templates and standards which doesn’t fit everybody. One of the key parts of the NIST framework is tailoring controls, which of course the DoD wouldn’t allow.

RMF is pretty straight forward on the enterprise side, standard users on standard networks. On the tactical side things get squirrely fast. Our system was a command and control suite that flew around in the back of a Blackhawk, but got on the colored networks through comsat links.  Big army decreed anyone touching SIPR was immediately a high, high, med system. That meant we had untailored HHM controls applied to an ad hoc system, in a helicopter, in a tactical environment. Super fun. 

Controls are how you fix or mitigate a vulnerability, and they cover everything. Policy, physical security, logistics, auditing, budget, personnel, technical, etc.  IIRC our system had 1200ish controls, and within a control there can be up to 15 tasks.  Tailoring controls removes any that obviously don’t fit that system. You can’t remove it because it’s hard or you want to speed things up, but if a control says “the building will have a fire suppression system that activates within x seconds” and your system isn’t in a building, obviously you can tailor that out. That’s how it’s supposed to work, but again, DoD didn’t want systems purging controls that were hard and the volume of systems didn’t allow any real visibility from the top to approve/deny tailoring, so they just threw out the tailoring step entirely.  So back to the Blackhawk example, yep, I had to mitigate why my system didn’t have a fire suppression in the building that is a Blackhawk in my Plan of Actions & Milestones (POAM), which gets reviewed and updated quarterly.

One of the biggest strengths of RMF is closing all the “someone else is responsible for that control” loopholes that plagued DIACAP, and cybersecurity as a whole. On tactical systems we would say that a higher NOC did a bunch of stuff, and that the owning tactical unit was responsible for all the user level stuff, and wipe our hands of it even though we knew units rarely enforced passwords properly, or patched AV on schedule, etc. Now you have to show your work. If someone inherits a control, it flows up or down to their system and gets rolled into their evaluation as well. So if the unit gets evaluated and isn’t doing X controls, they fail, and that failure flows into your system and can trigger a failure for you as well. That’s the academic version of how it’s supposed to be. In reality the Army has realized it’s just too big and hard on the tactical side so there is a lot of leeway being given to systems and vulnerabilities are being left open because of budget (fix this new vuln now, but your budget was already set for the next 5 years and can’t be changed, good luck), or lack of oversight on the hundreds of potential systems, and thousands of implantations at the unit level. The elephant in the room is also on the logistics side.  Supply chain protection is a massive part of RMF, and practically impossible to achieve with foreign manufacturing, JIT logistics, and now Covid impacts to the supply chain.

I took the long way around to get to this question (for the NERC guys, shady just provided a convenient roll up). Is the NERC implementation pretty tight top to bottom, or do you have similar issues? I would think it’s much more standard wrt the network side (all one color network, pretty standard enterprise guidance, etc), but all the local control/access still leaves some big holes (giggity) to be exploited. Sloppy admin rights or password policies leads to elevated rights, which leads to attack vector, which leads to yada yada.  

[Buzzrock 14775]

Checking in this morning: are there other significant developments besides:

-Kahrkiv is still holding on but running out of food

-The 40km column has been halted by drones

-Kherson has fallen