4 ms·

I wonder what scale of disaster will have to occur before information security is placed under the same legal and regulatory scrutiny as physical security?

vanderZwan 11y ago
I think it won't happen until everyone in society has good "computer literacy".
- delecti 11y ago
  The number of people who have no idea how their car works, despite them being fairly ubiquitous for nearly 100 years makes be think that that will never happen. There will always be people who know only just enough about the technology around them to get by.
- cm3 11y ago
  That's not a reasonable requirement, it's just that there is no consequence for people administrating (installing, maintaining) systems and the software writers. If fines were involved, how long do you guess would it take for people to stop writing in C or system integrator setting up random software. Critical systems may only use software written and certified years ago, not be constantly updated.
this_user 11y ago
Even if you did that, there is still more than enough room for human error or sheer negligence. See: http://www.bloomberg.com/news/articles/2016-04-08/entergy-agrees-to-review-fire-safety-at-reactors-after-probe http://www.bloomberg.com/news/articles/2016-04-08/entergy-ag...
- Aelinsaar 11y ago
  So because your house might burn down, you leave your doors and windows unlocked?
DasIch 11y ago
Developing and maintaining software with a sufficiently large focus on information security will almost certainly cost so much money, that people will reconsider whether the investment is worth it. It probably takes several relatively large and frequent disasters not just to put the issue on the map politically but also to show that it's worth investing in information security besides the cost.
- Aelinsaar 11y ago
  I think you're right, and I think it will have to take some obvious loss of life at least once.
hunterjrj 11y ago
No disaster necessary. NERC CIP regulations have been in place (and enforced) at electric utilities since 2007: "In 2007, FERC designated NERC the ERO in accordance with Section 215 of the Federal Power Act, enacted by the Energy Policy Act of 2005. Upon FERC’s approval, NERC’s Reliability Standards became mandatory within the United States. These mandatory Reliability Standards include CIP standards 001 through 009, which address the security of cyber assets essential to the reliable operation of the electric grid." Source: http://www.nerc.com/pa/CI/Comp/Pages/default.aspx http://www.nerc.com/pa/CI/Comp/Pages/default.aspx (Edit: clarification)

vanderZwan 11y ago

I think it won't happen until everyone in society has good "computer literacy".

delecti 11y ago
The number of people who have no idea how their car works, despite them being fairly ubiquitous for nearly 100 years makes be think that that will never happen. There will always be people who know only just enough about the technology around them to get by.
cm3 11y ago
That's not a reasonable requirement, it's just that there is no consequence for people administrating (installing, maintaining) systems and the software writers. If fines were involved, how long do you guess would it take for people to stop writing in C or system integrator setting up random software. Critical systems may only use software written and certified years ago, not be constantly updated.

this_user 11y ago

Even if you did that, there is still more than enough room for human error or sheer negligence. See: http://www.bloomberg.com/news/articles/2016-04-08/entergy-agrees-to-review-fire-safety-at-reactors-after-probe http://www.bloomberg.com/news/articles/2016-04-08/entergy-ag...

Aelinsaar 11y ago
So because your house might burn down, you leave your doors and windows unlocked?

DasIch 11y ago

Developing and maintaining software with a sufficiently large focus on information security will almost certainly cost so much money, that people will reconsider whether the investment is worth it. It probably takes several relatively large and frequent disasters not just to put the issue on the map politically but also to show that it's worth investing in information security besides the cost.

Aelinsaar 11y ago
I think you're right, and I think it will have to take some obvious loss of life at least once.

hunterjrj 11y ago

No disaster necessary. NERC CIP regulations have been in place (and enforced) at electric utilities since 2007: "In 2007, FERC designated NERC the ERO in accordance with Section 215 of the Federal Power Act, enacted by the Energy Policy Act of 2005. Upon FERC’s approval, NERC’s Reliability Standards became mandatory within the United States. These mandatory Reliability Standards include CIP standards 001 through 009, which address the security of cyber assets essential to the reliable operation of the electric grid." Source: http://www.nerc.com/pa/CI/Comp/Pages/default.aspx http://www.nerc.com/pa/CI/Comp/Pages/default.aspx (Edit: clarification)