Yup, that's the job of the folks at Fort Carson: find the flaws in the prototype. I often hear and feel the booms when they are testing. The percussive shocks travel many miles through the shale to under my house.

Bolting on security after the fact is not exactly the preferred strat.

Especially when the cost of busted security in this context is “exceptionally grave damage.”

I think btown's sibling comment has it right. It's not even a prototype if it isn't demonstrating some aspect of its core capabilities.

Given this line from the article:

    Despite the early September memo’s scathing critique, Leonel Garciga, Army chief information officer and Chiulli’s supervisor, said in a statement to Reuters that the report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them.

and

    Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone Army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document.

it seems like there was a SIGNIFICANT mismatch in expectations between the team delivering the prototype and the people receiving it. Everyone's time was wasted as a result.

« Enterprise security

We reject the notion of gating, pay-walling, or upselling core security controls like audit logging, single sign-on, and multi-factor authentication. Whether you’re a small business or a federal agency, you get access to every core enterprise security feature in our standard offering:

Mandatory encryption of all data, both in transit and at rest, that uses robust, modern cryptography standards. Strong authentication and identity protection controls, including single sign-on and multi-factor authentication. Strong authorization controls, including mandatory and discretionary access controls. Robust security audit logging for detecting and investigating potential abuse. Highly extensible information governance, management, and privacy controls to meet the needs of any use case. »

The real question is: did the product manager shave his beard?

I've worked on similar types of operational systems in the past. The access control is always extremely limited in the prototypes.

It is important to understand that the customers don't have a clear view of the types of access controls they want until they start field exercises. By having relatively limited access controls in the prototype, they discover in real use cases that allowing some data access which never would have occurred to them is highly valuable which can then be refined into specific types of data sharing. In a default locked down environment, these beneficial interactions would never be discovered because they can't occur. All of the ways the users access and use data in the prototypes is logged and studied.

Similarly, other types of data sharing expose real risks that can be reduced to specific scenarios developed during operational exercises. The problem with an exhaustive access control model is that it simply has too many degrees of freedom to be usable for most people.

During development, the universe of all possible uses of access control is reduced to a much simpler and more understandable model of the key data it is important to restrict and the key data it is important to share, grounded in real-world operational learnings. These models are simpler and more precise to implement, and also easier to verify the correctness of, than a default "access control all the things" approach.

> insufficient red-teaming of the prototype before launch

There's been no launch. It's a prototype.

Yeah, there's no way anyone would ask or it'd get approved for public release. Not because it's necessarily controlled information (though suspect it probably is), but what would be the point? Things get released to the public only when there is a particular need to tell the public something and everything else defaults to sitting on some janky ass SharePoint site until everyone forgets about it.

Given these blustering charlatans' track record with security, I would be very surprised if it was NOT publicly leaked, sitting somewhere on an open cloud server, put there by some petulant incel child who calls himself Big Balls.

Build one to throw away.