Seems to me that the DNC had really sloppy security and that many groups could have compromised their servers. If the government has proof that Russian actors d

Seems to me that the DNC had really sloppy security and that many groups could have compromised their servers. If the government has proof that Russian actors did so, they do not appear to have any proof that the info was used maliciously. The whole report, and media coverage, and statements by public officials are so confused and confusing that they are useless in regards to security. I have to compare this to the FDA's HIPAA regulations which mostly are just instructions on how to correctly secure servers and applications. However, I wish that HIPAA did not have these regs in it because they are susceptible to falling out of date. Rather, I think the public would be better served by an official security standard that can be updated weekly with new advice and requirements. Then an org like the FDA can have one regulation covering security that says something like "all systems must be secured according to Federal Infosec Guidelines level B3 or higher". The specifics of what B3 might mean and higher levels of securing servers and apps, can be in a single document that would, I am sure, become a core part of the curriculum for developers and system administrators. Moaning and whining about water under the bridge is a waste of energy and of public funds. This is a fixable problem if only someone in leadership is willing to act. Not grandstand or apportion blame, but act to improve infosecurity for everyone. A well drafted set of infosec guidelines by industry experts along with a process for keeping it up to date will have incredible multiplier effects throughout industry as well as government, because it makes it much easier for management to order that things be secured, and it makes it much easier to get a consultant to validate that the guidelines have been correctly implemented.