,
4 tweets,
1 min read
Read on Twitter
Here’s the thing about the US Defense Industrial Base. The average person thinks of the largest companies (BAE, Boeing, General Dynamics, Lockheed Martin, Northrop Grumman, Raytheon, SAIC...etc.) when we think of who builds the missiles/tanks/ships/airplanes/satellites.
1/n
1/n
The reality is the large defense contractors have enormous supply chains of sub contractors and suppliers - many of which are small(er) businesses that don’t have the size/resources/security maturity to adequately protect the data - that the bigger defense contractors have
2/n
2/n
If getting into primary orgs with the data (USG or large DIB) is too difficult - attackers can often get same data from smaller sub contractor (or leverage network/access/trust to gain access up stream).
And the system relies on all orgs being able to protect the data.
3/n
And the system relies on all orgs being able to protect the data.
3/n
People often point out that the most sensitive data is classified - which is air gapped.
I learned from IRs that a set of files may be unclassified individually,but if lots are stolen they can be considered classified (even though they can be stored on unclass systems)
4/n
I learned from IRs that a set of files may be unclassified individually,but if lots are stolen they can be considered classified (even though they can be stored on unclass systems)
4/n
