Happy new year everyone! One of our new year’s resolution is to promote the security community in different ways – sponsoring security conferences, publish new vulnerabilities and to write blog posts about leading security researchers that work and strengthen their local community. One of the best things of being part of the cyber security community … Continue reading Know your community – Orange Tsai →
from Know your community – Orange Tsai
Sunday, January 1, 2017
The DFIR Hierarchy of Needs & Critical Security Controls
As you weigh how best to improve your organization's digital forensics and incident response (DFIR) capabilities heading into 2017, consider Matt Swann's Incident Response Hierarchy of Needs. Likely, at some point in your career (or therapy 😉) you've heard reference to Maslow's Hierarchy of Needs. In summary, Maslow's terms, physiological, safety, belongingness & love, esteem, self-actualization, and self-transcendence, describe a pattern that human motivations generally move through, a pattern that is well represented in the form of a pyramid.
Matt has made great use of this model to describe an Incident Response Hierarchy of Needs, through which your DFIR methods should move. I argue that his powerful description of capabilities extends to the whole of DFIR rather than response alone. From Matt's Github, "the Incident Response Hierarchy describes the capabilities that organizations must build to defend their business assets. Bottom capabilities are prerequisites for successful execution of the capabilities above them:"
"The capabilities may also be organized into plateaus or phases that organizations may experience as they develop these capabilities:"
As visualizations, these representations really do speak for themselves, and I applaud Matt's fine work. I would like to propose that a body of references and controls may be of use to you in achieving this hierarchy to its utmost. I also welcome your feedback and contributions regarding how to achieve each of these needs and phases. Feel free to submit controls, tools, and tactics you have or would deploy to be successful in these endeavors; I'll post your submission along with your preferred social media handle.
Aspects of the Center for Internet Security Critical Security Controls Version 6.1 (CIS CSC) can be mapped to each of Matt's hierarchical entities and phases. Below I offer one control and one tool to support each entry. Note that there is a level of subjectivity to these mappings and tooling, but the intent is to help you adopt this thinking and achieve this agenda. Following is an example for each one, starting from the bottom of the pyramid.
INVENTORY - Can you name the assets you are defending?
Critical Security Control #1: Inventory of Authorized and Unauthorized Devices
Family: System
Control: 1.4
"Maintain an asset inventory of all systems connected to the network and the network devices themselves, recording at least the network addresses, machine name(s), purpose of each system, an asset owner responsible for each device, and the department associated with each device. The inventory should include every system that has an Internet protocol (IP) address on the network, including but not limited to desktops, laptops, servers, network equipment (routers, switches, firewalls, etc.), printers, storage area networks, Voice Over-IP telephones, multi-homed addresses, virtual addresses, etc. The asset inventory created must also include data on whether the device is a portable and/or personal device. Devices such as mobile phones, tablets, laptops, and other portable electronic devices that store or process data must be identified, regardless of whether they are attached to the organization’s network."
Tool option:
Spiceworks Inventory
TELEMETRY - Do you have visibility across your assets?
Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Family: System
Control: 6.6 "Deploy a SIEM (Security Information and Event Management) or log analytic tools for log aggregation and consolidation from multiple machines and for log correlation and analysis. Using the SIEM tool, system administrators and security personnel should devise profiles of common events from given systems so that they can tune detection to focus on unusual activity, avoid false positives, more rapidly identify anomalies, and prevent overwhelming analysts with insignificant alerts."
Tool option:
AlienVault OSSIM
DETECTION - Can you detect unauthorized actvity?
Critical Security Control #8: Malware Defenses
Family: System
Control: 8.1
"Employ automated tools to continuously monitor workstations, servers, and mobile devices with anti-virus, anti-spyware, personal firewalls, and host-based IPS functionality. All malware detection events should be sent to enterprise anti-malware administration tools and event log servers."
Tool option:
OSSEC Open Source HIDS SECurity
TRIAGE - Can you accurately classify detection results?
Critical Security Control #4: Continuous Vulnerability Assessment and Remediation
Family: System
Control: 4.3
"Correlate event logs with information from vulnerability scans to fulfill two goals. First, personnel should verify that the activity of the regular vulnerability scanning tools is itself logged. Second, personnel should be able to correlate attack detection events with prior vulnerability scanning results to determine whether the given exploit was used against a target known to be vulnerable."
Tool option:
OpenVAS
THREATS - Who are your adversaries? What are their capabilities?
Critical Security Control #19: Incident Response and Management
Family: Application
Control: 19.7
"Conduct periodic incident scenario sessions for personnel associated with the incident handling team to ensure that they understand current threats and risks, as well as their responsibilities in supporting the incident handling team."
Tool option:
Security Incident Response Testing To Meet Audit Requirements
BEHAVIORS - Can you detect adversary activity within your environment?
Critical Security Control #5: Controlled Use of Administrative Privileges
Family: System
Control: 5.1
"Minimize administrative privileges and only use administrative accounts when they are required. Implement focused auditing on the use of administrative privileged functions and monitor for anomalous behavior."
Tool option:
Local Administrator Password Solution (LAPS)
HUNT - Can you detect an adversary that is already embedded?
Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Family: System
Control: 6.4
"Have security personnel and/or system administrators run biweekly reports that identify anomalies in logs. They should then actively review the anomalies, documenting their findings."
Tool option:
GRR Rapid Response
TRACK - During an intrusion, can you observe adversary activity in real time?
Critical Security Control #12: Boundary Defense
Family: Network
Control: 12.10
"To help identify covert channels exfiltrating data through a firewall, configure the built-in firewall session tracking mechanisms included in many commercial firewalls to identify TCP sessions that last an unusually long time for the given organization and firewall device, alerting personnel about the source and destination addresses associated with these long sessions."
Tool option:
Bro
ACT - Can you deploy countermeasures to evict and recover?
Critical Security Control #20: Penetration Tests and Red Team Exercises
Family: Application
Control: 20.3
"Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively."
Tool option:
Red vs Blue - PowerSploit vs PowerForensics
Can you collaborate with trusted parties to disrupt adversary campaigns?
Critical Security Control #19: Incident Response and Management
Family: Application
Control: 19.5
"Assemble and maintain information on third-party contact information to be used to report a security incident (e.g., maintain an e-mail address of security@organization.com or have a web page http://organization.com/security)."
Tool option:
MISP
I've also started to map the hierarchy to the controls in CIS CSC 6.1 spreadsheet, again based on my experience and perspective, your may differ, but consider similar activity.
I'll make my first pass at the spreadsheet mapping effort available here shortly.
I truly hope you familiarize yourself with Matt's Incident Response Hierarchy of Needs and find ways to implement, validate, and improve your capabilities accordingly. Consider that the controls and tools mentioned here are but a starting point and that you have many other options available to you. I look forward to hearing from you regarding your preferred tactics and tools as well. Kudos to Matt for framing this essential discussion so distinctly.
from The DFIR Hierarchy of Needs & Critical Security Controls
Matt has made great use of this model to describe an Incident Response Hierarchy of Needs, through which your DFIR methods should move. I argue that his powerful description of capabilities extends to the whole of DFIR rather than response alone. From Matt's Github, "the Incident Response Hierarchy describes the capabilities that organizations must build to defend their business assets. Bottom capabilities are prerequisites for successful execution of the capabilities above them:"
 |
|||||||||
| The Incident Response Hierarchy of Needs |
 |
| Hierarchy plateaus or phases |
Aspects of the Center for Internet Security Critical Security Controls Version 6.1 (CIS CSC) can be mapped to each of Matt's hierarchical entities and phases. Below I offer one control and one tool to support each entry. Note that there is a level of subjectivity to these mappings and tooling, but the intent is to help you adopt this thinking and achieve this agenda. Following is an example for each one, starting from the bottom of the pyramid.
INVENTORY - Can you name the assets you are defending?
Critical Security Control #1: Inventory of Authorized and Unauthorized Devices
Family: System
Control: 1.4
"Maintain an asset inventory of all systems connected to the network and the network devices themselves, recording at least the network addresses, machine name(s), purpose of each system, an asset owner responsible for each device, and the department associated with each device. The inventory should include every system that has an Internet protocol (IP) address on the network, including but not limited to desktops, laptops, servers, network equipment (routers, switches, firewalls, etc.), printers, storage area networks, Voice Over-IP telephones, multi-homed addresses, virtual addresses, etc. The asset inventory created must also include data on whether the device is a portable and/or personal device. Devices such as mobile phones, tablets, laptops, and other portable electronic devices that store or process data must be identified, regardless of whether they are attached to the organization’s network."
Tool option:
Spiceworks Inventory
TELEMETRY - Do you have visibility across your assets?
Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Family: System
Control: 6.6 "Deploy a SIEM (Security Information and Event Management) or log analytic tools for log aggregation and consolidation from multiple machines and for log correlation and analysis. Using the SIEM tool, system administrators and security personnel should devise profiles of common events from given systems so that they can tune detection to focus on unusual activity, avoid false positives, more rapidly identify anomalies, and prevent overwhelming analysts with insignificant alerts."
Tool option:
AlienVault OSSIM
DETECTION - Can you detect unauthorized actvity?
Critical Security Control #8: Malware Defenses
Family: System
Control: 8.1
"Employ automated tools to continuously monitor workstations, servers, and mobile devices with anti-virus, anti-spyware, personal firewalls, and host-based IPS functionality. All malware detection events should be sent to enterprise anti-malware administration tools and event log servers."
Tool option:
OSSEC Open Source HIDS SECurity
TRIAGE - Can you accurately classify detection results?
Critical Security Control #4: Continuous Vulnerability Assessment and Remediation
Family: System
Control: 4.3
"Correlate event logs with information from vulnerability scans to fulfill two goals. First, personnel should verify that the activity of the regular vulnerability scanning tools is itself logged. Second, personnel should be able to correlate attack detection events with prior vulnerability scanning results to determine whether the given exploit was used against a target known to be vulnerable."
Tool option:
OpenVAS
THREATS - Who are your adversaries? What are their capabilities?
Critical Security Control #19: Incident Response and Management
Family: Application
Control: 19.7
"Conduct periodic incident scenario sessions for personnel associated with the incident handling team to ensure that they understand current threats and risks, as well as their responsibilities in supporting the incident handling team."
Tool option:
Security Incident Response Testing To Meet Audit Requirements
BEHAVIORS - Can you detect adversary activity within your environment?
Critical Security Control #5: Controlled Use of Administrative Privileges
Family: System
Control: 5.1
"Minimize administrative privileges and only use administrative accounts when they are required. Implement focused auditing on the use of administrative privileged functions and monitor for anomalous behavior."
Tool option:
Local Administrator Password Solution (LAPS)
HUNT - Can you detect an adversary that is already embedded?
Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Family: System
Control: 6.4
"Have security personnel and/or system administrators run biweekly reports that identify anomalies in logs. They should then actively review the anomalies, documenting their findings."
Tool option:
GRR Rapid Response
TRACK - During an intrusion, can you observe adversary activity in real time?
Critical Security Control #12: Boundary Defense
Family: Network
Control: 12.10
"To help identify covert channels exfiltrating data through a firewall, configure the built-in firewall session tracking mechanisms included in many commercial firewalls to identify TCP sessions that last an unusually long time for the given organization and firewall device, alerting personnel about the source and destination addresses associated with these long sessions."
Tool option:
Bro
ACT - Can you deploy countermeasures to evict and recover?
Critical Security Control #20: Penetration Tests and Red Team Exercises
Family: Application
Control: 20.3
"Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively."
Tool option:
Red vs Blue - PowerSploit vs PowerForensics
Can you collaborate with trusted parties to disrupt adversary campaigns?
Critical Security Control #19: Incident Response and Management
Family: Application
Control: 19.5
"Assemble and maintain information on third-party contact information to be used to report a security incident (e.g., maintain an e-mail address of security@organization.com or have a web page http://organization.com/security)."
Tool option:
MISP
I've also started to map the hierarchy to the controls in CIS CSC 6.1 spreadsheet, again based on my experience and perspective, your may differ, but consider similar activity.
I'll make my first pass at the spreadsheet mapping effort available here shortly.
I truly hope you familiarize yourself with Matt's Incident Response Hierarchy of Needs and find ways to implement, validate, and improve your capabilities accordingly. Consider that the controls and tools mentioned here are but a starting point and that you have many other options available to you. I look forward to hearing from you regarding your preferred tactics and tools as well. Kudos to Matt for framing this essential discussion so distinctly.
from The DFIR Hierarchy of Needs & Critical Security Controls
2016 InfoSec Tweet Awards
In 2016 I reduced the number of accounts I follow and I'm not as obsessive about reading every tweet, but there were still plenty of gems to choose from.
As in previous years, there are no actual awards. These are just funny or thought provoking tweets that I've "favorited" over the year (I still refuse to call them "likes"). As always, categories are completely arbitrary and I make them up as I go along...
Best Tweet Inspired by a TV Show
Fell for one little ARP spoof and my mom got scared— SwiftOnSecurity (@SwiftOnSecurity) January 26, 2016
Said you're implementing DHCP MitM monitoring with Snare
Best Tweet Inspired by a Movie
Star Wars and infosec. You’re convinced you need Death Stars to keep you secure, when actually you should teach your stormtroopers to shoot.— Ben Hughes (@benjammingh) April 11, 2016
Best Tweet About CISSPs
@wimremes sometimes good people get CISSPs because it's just easier than not having one— FaithSpottedBald🦅 (@ErrataRob) April 18, 2016
Best Tweet About Auditors
Auditor: How would you rate your company's cyber resiliency?— Info Security Jerk (@infosecjerk) January 28, 2016
Me: It depends. Relative to what and on what scale?
Auditor: ..Nevermind.
Best Tweet About DevOps
To err is human, to propagate that error to all servers is devops #owaspsheffield— Robin (@digininja) February 25, 2016
Best Tweet About A Text Editor
My safe word is :q!— GonzoHacker (@GonzoHacker) April 1, 2016
Best Tweet About Education in InfoSec
If I win $1.3 billion, I might be able to take some SANS classes.— Sam Bowne (@sambowne) January 14, 2016
Best Tweet About Skill Shortage in InfoSec
"We can't get enough qualified people in infosec"— Paul L (@dcept905) February 23, 2016
"OMG! Breach! Fire people in charge of security!"#DoingItWrong
Best Tweet About Travel (tie)
Dear bright eyed naive souls who really want a job with lots of travel, be careful what you wish for. You're asking for fatigue & bed bugs.— b̈́͐̐̊́͠͝͝ȁ̈́̓̅̂̓̏̄t͒ (@mzbat) December 7, 2016
He wasn't a violent person unless he had to be, and took no pleasure in it. But these people were blocking the power outlets at the airport.— Infosec Noir (@InfosecNoir) January 6, 2016
Best Tweet About Dating in InfoSec (tie)
On every first date, I bring an NDA and sign it right in front of him so he's not scared I'm going to go tweet mean things about him— Dana Schwartz (@DanaSchwartzzz) January 2, 2016
OH: "You know your boyfriend works in Information Security when he gives you keys to his house before he gives you his wifi password."— J Wolfgang Goerlich (@jwgoerlich) February 25, 2016
emacs or vim?#BestFirstDateQuestions— b̈́͐̐̊́͠͝͝ȁ̈́̓̅̂̓̏̄t͒ (@mzbat) March 14, 2016
Best "Threat Landscape" Tweet
All this talk of the "threat landscape", does that make us threat landscapers? I've got a pickup truck, mower, and chainsaws- I'm ready.— Jack Daniel (@jack_daniel) December 2, 2016
Best Poem in a Tweet
Roses are red.— b̈́͐̐̊́͠͝͝ȁ̈́̓̅̂̓̏̄t͒ (@mzbat) February 13, 2016
Smurfs are blue.
If your e-card makes me install Flash,
I will stab you.
Best InfoSec Analogy in a Tweet
Fav qte "Security is like brushing Ur teeth: If U don’t brush Ur teeth U will get cavities. If U brush Ur teeth U will still get cavities."— Melissa Ryder (@SecuritySpice) April 22, 2016
Best Tweet Telling It Like It Is
So many people (and companies) focused on zero days while ignoring 5,437 days.— Jack Daniel (@jack_daniel) July 13, 2016
(That's days since XP was launched)
Well, that's a wrap for 2016. I know this year has sucked for a lot of you. We've lost loved ones and those who inspire us, but this does not diminish the impact they've had on our lives and the people we are because of them. With that said, on this New Year's Eve, let us celebrate the good things in our lives and cherish those who are still with us. I wish you all health and happiness in 2017 and hope to see many of you soon.
Happy New Year!
from 2016 InfoSec Tweet Awards
Your absurd story doesn’t make me a Snowden apologist
Defending truth in the Snowden Affair doesn't make one an "apologist", for either side. There plenty of ardent supporters on either side that need to be debunked. The latest (anti-Snowden) example is the HPSCI committee report on Snowden [*], and stories like this one in the Wall Street Journal [*]. Pointing out the obvious holes doesn't make us "apologists".
As Edward Epstein documents in the WSJ story, one of the lies Snowden told was telling his employer (Booz-Allen) that he was being treated for epilepsy when in fact he was fleeing to Hong Kong in order to give documents to Greenwald and Poitras.
Well, of course he did. If you are going to leak a bunch of documents to the press, you can't do that without a bunch of lies to your employer. That's the very definition of this sort of "whistleblowing". Snowden has been quite open to the public about the lies he told his employer, including this one.
Rather than evidence that there's something wrong with Snowden, the way Snowden-haters (is that the opposite of "apologist"?) seize on this is evidence that they are a bit unhinged.
The next "lie" is the difference between the number of documents Greenwald says he received (10,000) and the number investigators claim were stolen (1.5 million). This is not the discrepancy that it seems. A "document" counted by the NSA is not the same as the number of "files" you might get on a thumb drive, which was shown the various ways of counting the size of the Chelsea/Bradley Manning leaks. Also, the NSA can only see which files Snowden accessed, not which ones were then subsequently copied to a thumb drive.
Finally, there is the more practical issue that Snowden cannot review the documents while at work. He'd have to instead download databases and copy whole directories to his thumb drives. Only away from work would he have the chance to winnow down which documents he wanted to take to Hong Kong, deleting the rest. Nothing Snowden has said conflicts with him deleting lots of stuff he never gave journalists, that he never took with him to Hong Kong, or took with him to Moscow.
The next "lie" is that Snowden claims the US revoked his passport after he got on the plane from Hong Kong and before he landed in Moscow.
This is factually wrong, in so far as the US had revoked his passport and notified Hong Kong of the revocation a day before the plane took off. However, as numerous news reports of the time reported, the US information was contradictory and incomplete, and thus Hong Kong did nothing to stop Snowden from leaving [*]. The Guardian [*] quotes a Hong Kong official as saying Snowden left "through a lawful and normal channel".
It's the WSJ article that's clearly prevaricating here, quoting a news article where a Hong Kong official admits being notified, but not quoting the officials saying that the information was bad, that they took no action, and that Snowden left in the normal way.
The next item is Snowden's claim he destroyed all his copies of US secrets before going to Moscow. To debunk this, the WSJ refers to an NPR interview [*] with Frants Klintsevich, deputy chairman of the defense and security committee within the Duma at the time. Klintsevich is quoted as saying "Let's be frank, Snowden did share intelligence".
But Snowden himself debunks this:
The WSJ piece was written a week after this tweet. It's hard to imagine why they ignored it. Either it itself is a lie (in which case, it should've been added to the article), or it totally debunks the statement. If Klintsevich is "only speculating", then nothing after that point can be used to show Snowden is lying.
Thus, again we have proof that Epstein cannot be trusted. He clearly has an angle and bends evidence to service that angle, rather than being a reliable source of information.
I am no Snowden apologist. Most of my blogpost regarding Snowden have gone the other way, criticizing the way those like The Intercept warp Snowden disclosures in an anti-NSA/anti-USA manner. In areas of my experience (network stuff), I've blogged showing that those reporting on Snowden are clearly technically deficient.
But in this post, I show how Edward Epstein is clearly biased, and how he warps the facts into a character attack on Snowden. I've documented it in a clear way that you can easily refute I've I'm not correct. This is not because I'm a biased toward Snowden, but because I'm biased toward the truth.
from Your absurd story doesn’t make me a Snowden apologist
Snowden & apologists will brush this off w/ vague denials and counteraccusations. Burden's on them to square his representations w/ reality.— Susan Hennessey (@Susan_Hennessey) December 31, 2016
As Edward Epstein documents in the WSJ story, one of the lies Snowden told was telling his employer (Booz-Allen) that he was being treated for epilepsy when in fact he was fleeing to Hong Kong in order to give documents to Greenwald and Poitras.
Well, of course he did. If you are going to leak a bunch of documents to the press, you can't do that without a bunch of lies to your employer. That's the very definition of this sort of "whistleblowing". Snowden has been quite open to the public about the lies he told his employer, including this one.
Rather than evidence that there's something wrong with Snowden, the way Snowden-haters (is that the opposite of "apologist"?) seize on this is evidence that they are a bit unhinged.
The next "lie" is the difference between the number of documents Greenwald says he received (10,000) and the number investigators claim were stolen (1.5 million). This is not the discrepancy that it seems. A "document" counted by the NSA is not the same as the number of "files" you might get on a thumb drive, which was shown the various ways of counting the size of the Chelsea/Bradley Manning leaks. Also, the NSA can only see which files Snowden accessed, not which ones were then subsequently copied to a thumb drive.
Finally, there is the more practical issue that Snowden cannot review the documents while at work. He'd have to instead download databases and copy whole directories to his thumb drives. Only away from work would he have the chance to winnow down which documents he wanted to take to Hong Kong, deleting the rest. Nothing Snowden has said conflicts with him deleting lots of stuff he never gave journalists, that he never took with him to Hong Kong, or took with him to Moscow.
The next "lie" is that Snowden claims the US revoked his passport after he got on the plane from Hong Kong and before he landed in Moscow.
This is factually wrong, in so far as the US had revoked his passport and notified Hong Kong of the revocation a day before the plane took off. However, as numerous news reports of the time reported, the US information was contradictory and incomplete, and thus Hong Kong did nothing to stop Snowden from leaving [*]. The Guardian [*] quotes a Hong Kong official as saying Snowden left "through a lawful and normal channel".
It's the WSJ article that's clearly prevaricating here, quoting a news article where a Hong Kong official admits being notified, but not quoting the officials saying that the information was bad, that they took no action, and that Snowden left in the normal way.
The next item is Snowden's claim he destroyed all his copies of US secrets before going to Moscow. To debunk this, the WSJ refers to an NPR interview [*] with Frants Klintsevich, deputy chairman of the defense and security committee within the Duma at the time. Klintsevich is quoted as saying "Let's be frank, Snowden did share intelligence".
But Snowden himself debunks this:
Moreover, Klintsevich states clearly in the audio (which NPR omits from English translation) that he's only speculating ("Ya dumayu sto...")— Edward Snowden (@Snowden) December 22, 2016
The WSJ piece was written a week after this tweet. It's hard to imagine why they ignored it. Either it itself is a lie (in which case, it should've been added to the article), or it totally debunks the statement. If Klintsevich is "only speculating", then nothing after that point can be used to show Snowden is lying.
Thus, again we have proof that Epstein cannot be trusted. He clearly has an angle and bends evidence to service that angle, rather than being a reliable source of information.
I am no Snowden apologist. Most of my blogpost regarding Snowden have gone the other way, criticizing the way those like The Intercept warp Snowden disclosures in an anti-NSA/anti-USA manner. In areas of my experience (network stuff), I've blogged showing that those reporting on Snowden are clearly technically deficient.
But in this post, I show how Edward Epstein is clearly biased, and how he warps the facts into a character attack on Snowden. I've documented it in a clear way that you can easily refute I've I'm not correct. This is not because I'm a biased toward Snowden, but because I'm biased toward the truth.
from Your absurd story doesn’t make me a Snowden apologist
Book review: The wisdom of crowds – A leveraging tool
The book by James Surowiecki titled "The wisdom of crowds" fell into my hands and I read it during the summer of 2015. These are the main learning points that I drew from its reading.Disclaimer: By no means this personal and non-comprehensive post aims...
from Book review: The wisdom of crowds – A leveraging tool
from Book review: The wisdom of crowds – A leveraging tool
Saturday, December 31, 2016
US government subcontractor leaks confidential military personnel data
The leak exposed personal data including Social Security numbers to the assigned posts of critical members of the US military, some of whom hold the highest levels of security clearance.
from US government subcontractor leaks confidential military personnel data
from US government subcontractor leaks confidential military personnel data
Subscribe to:
Posts (Atom)