|
|
|
|
|
by mpk
5395 days ago
|
|
My guess is yes, they do. If you read a bit deeper into their announcements you'll notice that this is not just 'the government taking over'. The breach post-mortem was handled by a private sector security company (Fox IT) and the SSL cert management was moved to another private sector firm (Getronics). Judging by the announcements this was overseen by the Ministry of Security and Justice, which has its own well-funded divisions of security specialists. The Dutch government sees digital infrastructure as crucial and invests a lot of time and money into it. Components such as PKI government, etc are initiated by the government but then sourced to the private sector (a fairly common practice). This allows the government to revoke contracts or otherwise intervene if the contractor is in breach of something (bad management, bad governance, failure to comply with security standards, failing audits, etc). I'm guessing that this is also the legal basis for taking over operations from DigiNotar at such short notice. Also, the Dutch government is a world-class player in the eavesdropping, interception, wiretapping and traffic monitoring game. That implies at least a basic in-house competency in network and crypto matters. |
|