Dave Naffziger's Blog

There are plenty of misconceptions about the NSA, chief among them is what the NSA does. I love the various Hollywood misconceptions (Sneakers Enemy of the State, Mercury Rising), as well as the many shocked blog posts every time the NSA puts out a security guide, or, gasp, helps industry secure their shit.

The NSA is divided into two organizations:

1. Signals intelligence. This is the role most of us think of w.r.t. the NSA. They are responsible for deriving intelligence from signals (phones, faxes, computers, etc) this is notably different form human intelligence (the CIA’s stomping ground). They are also responsible for code breaking, and are said to employ the most mathematicians of any organization in the US.
2. Information assurance. Protecting US government systems, especially all classified and sensitive information. Intrusion monitoring and response, penetration testing, cryptography support (protecting us from other snoops). Imagine trying to protect the computers used by several million high school and college kids. Yeah, that’s about what they get to do.

Next time you see a security guide from the NSA or a report that they helped CompanyA secure their software understand that its in their best interest to actually secure systems.