Comment by crankylinuxuser

6 years ago

The company in question is Coalfire. This company assesses who can become FedRAMP compliant. They also have their pentesting team in-house, and they are fuckig sharp. They know their contracts, rules of engagement, and exactly what they are and aren't allowed to do.

These folks do this stuff for their livelihood. They test contractor, state, and fed systems at all scopes and levels.

And if 2 broke in (yes, you work in teams ABSOLUTELY onprem), they had the contract explicitly allowing physical penetration ON THEIR BODY. That contract is the difference between felony trespass and 100% legal.

I would LOVE to be a fly on the wall and watching the conversation between State IT and the public safety community there, and especially with the AG, who will have to release them.

14 comments

crankylinuxuser

Reply
mrb  6 years ago

That's right. If I had to bet who was incompetent, Coalfire or the state agency, my bet is on the latter. The state agency probably didn't understand/read the full contract or maybe some internal miscommunication through hierarchy lead to confusion about what was or wasn't allowed in the pentest. I'll be waiting for Coalfire's press release who will probably confirm the contract did allow physical pentest...

  • godzillabrennus  6 years ago

    This is dealing directly with the government. I doubt we ever hear of this again if the government screwed up.

    No way coalfire would embarrass a client if they can avoid it.

    I feel bad for the contractors who now have arrest records. They are the victims here.

    • crankylinuxuser  6 years ago

      > This is dealing directly with the government. I doubt we ever hear of this again if the government screwed up.

      Exactly. We won't hear of it. They do work all across the US in the state and federal space. It's too lucrative to give up to shame them into submission publicly. Privately, sure.

      > I feel bad for the contractors who now have arrest records. They are the victims here.

      Well, they've been arrested. So their clearances have been yanked already, as per standard for Confidential/TS/SCI. Unless they can get complete restoration, including expungement of the arrest, and admission of unlawful arrest, they're done in federal/state infosec.

  • mrb  6 years ago

    Coalfire just released their statement and, yup, I was right: «Coalfire and State Court Administration believed they were in agreement regarding the physical security assessments for the locations included in the scope of work. Yet, recent events have shown that Coalfire and State Court Administration had different interpretations of the scope of the agreement» https://finance.yahoo.com/news/coalfire-comments-penetration...

october_sky  6 years ago

Ya, I've spoken with Coalfire employees in the past and have respect for them. I'm very curious to follow-up on the outcome of this case, and I feel for the employees sitting in jail right now. Hope it ends well for them

jcrawfordor  6 years ago

From my background with FedRAMP, a firm's involvement in FedRAMP assessments does not improve my confidence in them. :)

That said, yes, Coalfire is large enough and old enough that I would be very surprised if they made such a mistake - but I still think it's quite possible. Consider that such an established firm would also be absolutely expected to coordinate this kind of testing with the PD beforehand - a blind test of a PD's response on a contract with another agency of the state government is something I have never heard of before and raises huge concerns for personal safety and taxpayer expense. I would consider Coalfire to also be extremely irresponsible for knowingly entering such a situation.

C1sc0cat  6 years ago

That was my though I suspect some jobsworth promoted above their natural pay grade threw their teddy's out of the pram, when their poor security got penetrated.