8 ms·

After 20 years in IT, listening to all the bullshit by "Management" about "Audits" and "accepting the risk", "lessons learned" and whatnot. Honestly, I would b

After 20 years in IT, listening to all the bullshit by "Management" about "Audits" and "accepting the risk", "lessons learned" and whatnot. Honestly, I would be glad if a high impact issue like this, would change any of that for the better. I am unfortunately also a cynic (after 20 years in, well anywhere really) so I doubt it will. This means it will only negatively impact people who need the healthcare, and a bunch of consultants will make millions on sweeping up the mess, and creating the next failure-to-be. I'm making popcorn.

madez 9y ago
I've also become a cynic. I welcome national services to lose control of their systems and their data. I have had countless talks with people here in Germany about why computers and therefore open and libre software and hardware are a matter of national interest. Obvious disaster, at least and last, will hopefully make them get what I mean. Having said that, I feel bad, but I just don't see any other way.
- k-mcgrady 9y ago
  >> I've also become a cynic. I welcome national services to lose control of their systems and their data. Quite a moronic point of view when lives could be potentially put at risk.
  - madez 9y ago
    I agree as to that it sounds moronic. Maybe it even is. However, think about a levee about which you know that it will not hold when a storm comes, but people don't believe you and are not even willing to listen to you. Would you think it's moronic to welcome a storm as a shot across the bows so people realized what you are talking about? The constructive solution to this problem is to find a way to convey the message such that people are willing to listen. But that can be very difficult.
    - graphitezepp 9y ago
      In a similar vein Karl Marx is said to have been pro free trade, as it would lead to what he believed would happen to capitalism much faster. Also the colloquial expression "kick in the teeth". Often actual change requires drastic consequences.
    - anigbrowl 9y ago
      I don't feel you're moronic and I absolutely get your sense of frustration, but welcoming a storm is implicitly saying that you think the suffering of some others is an acceptable price to pay for opening the eyes of the higher-ups. I'd like to suggest that the reason people in management don't listen to people in IT is because the people in IT aren't willing to make them, despite having direct and often primary access to the organizational levers of power. Have you ever considered the possibility that management deliberately selects for this kind of passivity and conflict aversion when staffing IT departments, hiring exactly the sort of people who might roll their eyes or grumble at things but will reliably do what they're told?
  - dasil003 9y ago
    I disagree. Every day we become more and more dependent on computers, and more specifically, networked computers. The IoT is exploding with horrific security implications. Everyone is focused on the next big thing, and no one is paying attention to the house of cards we are building. So for something like this to happen now is much better than it happening later, because people need events like this to wake up and motivate action.
  - dredmorbius 9y ago
    You do realise that very nearly every engineering standard ever established, or regulation imposed, is written in the blood and memorialises the souls of those who died because it wasn't in place. Turn on your gas stove for a moment, but don't light it. That smell you detect is a memorial to the 295 students and teachers of the New London School: https://en.m.wikipedia.org/wiki/New_London_School_explosion https://en.m.wikipedia.org/wiki/New_London_School_explosion Early in 1937, the school board canceled their natural gas contract and had plumbers install a tap into Parade Gasoline Company's residue gas line to save money. This practice—while not explicitly authorized by local oil companies—was widespread in the area. The natural gas extracted with the oil was considered a waste product and was flared off. As there was no value to the natural gas, the oil companies turned a blind eye. This "raw" or "wet" gas varied in quality from day to day, even from hour to hour.
- anigbrowl 9y ago
  You're frustrated, but what are you doing to provide a better alternative? If national services lose control of their systems, what then? What is it that you expect to happen? The same people in charge, but making better decisions? A revolution that will magically fix everything? I understand that you've been trying to persuade people of the merits of openness, but as you have experienced it's very difficult for an individual to persuade people of things without being a politician or offering some commercial bargains. Managers keep making bad decisions because they can always find someone who will write the code instead, but for some reason developers are unwilling to act in concerted opposition to this and so find themselves endlessly ignored and overruled.
  - tgragnato 9y ago
    > Managers keep making bad decisions because they can always find someone who will write the code instead, but for some reason developers are unwilling to act in concerted opposition to this and so find themselves endlessly ignored and overruled. A labor union that protects you when you refuse to implement things that should not be implemented? IMHO it is a difficult thing to manage and integrate into the tech culture. Leaks? Maybe, we're seeing them.
    - anigbrowl 9y ago
      It suits the management class very well to minimize the formation of organizational structures among technologists. While I'm not a big fan of unions or guilds - insofar as they rely on internal hierarchies that just reproduce existing and faulty control structures - those who resist or deny the possibility of organization among technologists are not necessarily disinterested in the outcome.
jordwest 9y ago
It's so easy to throw up a veil of security while doing absolutely nothing at all. Just today I was helping somebody retrieve an export of older transactions from PayPal, and they were forced to go through a series of steps to sign up for "secure" access to a special account in order to download a "secure" zip file that PayPal had uploaded containing the transactions. The password on the zip file? PayPal123.
- wordupmaking 9y ago
  Which doesn't just mean that file had a crap password; I'd be willing to bet it means a whole bucket or type of files has the same password. So at least there's that.
- sorokod 9y ago
  Doesn't sound that this password is frequently changed
rrggrr 9y ago
Fault will be leveled against Bitcoin for facilitating the ransom, against Microsoft, against NHS budget underfunding... everywhere EXCEPT where the blame belongs. Products liability law applied to IT security would put a quick end to most vulnerabilities.
- nopcode 9y ago
  >Products liability law Wouldn't that hold Microsoft liable then?
  - blowski 9y ago
    Depends. And that's exactly why it's easy to say "we need product liability law", but very difficult to say how it would work in practice.
  - UK-AL 9y ago
    Maybe, but a patch for this issue being exploited has been out for quite some time. What's happened is that unpatched versions are being exploited.
- gwright 9y ago
  Seems strange to not mention the ransomers as having culpability. I'm 100% in favor of better systems/processes/technology to prevent exploits, but I'm also 100% in favor of blaming the perpetrators of the ransom also. In the real world we don't accept the argument that the victim is primarily at fault. * leaving your car unlocked doesn't mean that is OK for someone to steal it and demand a ransom for its return * leaving your house/apartment unlocked doesn't mean that it is OK for someone to swap out the locks and demand ransom for the new keys And it really isn't about being locked/unlocked. Doors and locks can generally be easily broken or bypassed, doesn't mean that everyone should have to purchase industrial strength doors and locking systems (and windows, and...).
  - ryandrake 9y ago
    Leaving your car or house unlocked means that you're negligent, not that the attack is your fault.
peterwwillis 9y ago
The alternative is massive investment in security, which would raise costs to insurers/patients, and introducing procedures that would slow down the speed of medical practice, which is already too slow. One example i've seen is the "medical system", a conglomerate of healthcare providers under one brand. At a high level, the priority is simply to swallow up as many healthcare solutions as you can, to reduce cost and increase profit, and make healthcare process more seamless for the patients. At a medium level, this means you have 50 different organizations connected to your network, and you may or may not have centralized control over any of them. You don't have the cash, time or resources to go in and overhaul all the networks. So you tell them all to connect through your central office and throw every single transparent filter or proxy at them to try to catch all the crap flying out the door (and there is a lot of it). At a local level, doctors are already stymied by the complex process of providing care to patients. I've worked with them to try to find tailored solutions to speed up simple things like returning lab results. It's surprisingly difficult to improve on. Add new security procedures and their time shrinks even more, adding on top of all their existing procedure. Healthcare is just always going to suck at security. The alternative is more costly and slower healthcare.
6stringmerc 9y ago
In the aftermath I wonder if we'll ever find out how the attack was enabled. As in, who opened the attachment. My hunch? An Executive high enough in Leadership who won't get fired. Will be interesting to see.
UK-AL 9y ago
The result will be intensify what they are already doing rather than to rethink the system.
- graphitezepp 9y ago
  Until it crashes and burns dramatically, the way it has happened since time immemorial.
mavhc 9y ago
Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is already penetrated and design for that. Store no data locally, client machines run something like ChromeOS by default. Timeout anything that's not used for 6 months. Don't use passwords, only SmartCards. Snapshot data for ease of restore.
nopcode 9y ago
I work for one of those consultancy firms. Typically, this is the kind of stuff that's required to get us through the door in the first place.
holyavengerone 9y ago
Software development seems to be one of the rare branches of engineering where people and businesses are ready to accept such low quality standards, both in terms of functionality and security. We wouldn't accept from a civil engineer that "the bridge might collapse" but that it's "no big deal, takes a moment to rebuild". It was one thing when software was controlling some random machinery in a basement or fueling our BBSes, but nowadays large-scale software failure can end a lot of lives, nothing less. And yet, society is largely oblivious to how fragile it all is...
- dagaci 9y ago
  A bridge is a largely static unmoving object, but even bridges require maintenance - some bridges require more maintenance frequent maintenance than others. It's not that bridges are necessarily of low quality. If a the bridge maintainer instructed you that a column needed replacing it would be replaced. Everything constructed in reality requires maintenance in one way or another. Your house, your car, your bridge and yourself for example. To suggest that software should be different is an interesting point of view.
  - jacquesm 9y ago
    > A bridge is a largely static unmoving object, but even bridges require maintenance - some bridges require more maintenance frequent maintenance than others. It's not that bridges are necessarily of low quality. That's a laymans impression of what a bridge is. In reality bridges are in an extremely dynamic environment with loads changing magnitude and direction constantly, unpredictably. The fact that you think that a bridge is 'a largely static unmoving object' is a tribute to the engineers that designed it and the contractors that built it, it's whole function can be described as 'appear not to move'. But if you looked at the bridge in a little bit more detail and you would see how the bridge copes with the load your estimate would change to 'a bridge is an extremely versatile structure that dynamically responds to a wide variety of loads by rejecting those loads onto the foundation and soil around it'.
    - dagaci 9y ago
anigbrowl 9y ago
Have you considered going on strike along with the other IT people? I can well imagine how draining 20 years of management BS is (I grew up with one), but one of the reasons I decided to get out of corporate IT after a decade in it was the realization that the IT were frequently used as a buffer between management and the rest of the workforce. I certainly don't blame you for making popcorn, but surely part of why poor operating practices and decisions get entrenched if that the people doing the work passively go along with whatever bad idea management is proposing while hoping that either inevitable failure or some higher level of management will intervene to vindicate the initial objections of the technical people and topple a few of the more inept managers from their perches. Because IT people tend not to be organized into a union or professional association, they have little to no political leverage of their own so any personal sense of organizational mission or ethical scruples don't count for much in the event of a conflict with the management people, who may sweep aside objections on the basis that the IT person 'doesn't understand the big picture' or somesuch. I don't mean to suggest that you should be reiterating old faulty models of social organization like unions or guilds; if anything the lesson of technology is that we should be restructuring our pyramidal structures of control and authority (whether corporate, political or whatever) into more effective network paradigms. But I do think that if you just munch on popcorn and hope to see some bad managers ousted and some technical people finally lifted up to positions of seniority within the existing decision structure, then it will just be more of the same until the system is forced into a state of collapse. Why leave everything to he management and consulting types 'sweeping up the mess, and creating the next failure-to-be' as you eloquently put it, when you have one of those rare opportunities to force change?
nickpsecurity 9y ago
People will have to die before that happens without a regulation push. Possibly in a horrific way but done remotely. A few entered my mind. The risk is there. Thing is, it took things like THERAC poisoning in the past to establish importance of software safety. Security will probably be similar as it has been damage first, correct behavior second in other sectors.
pasbesoin 9y ago
Just as in the performance review process, Management (aka "the winners", be default and decree) write the story. I remember spending more time pushing against the inertia and self-interest, than actually solving the problems. Solutions that, in a fairly straightforward and rather conservative fashion, stopped problems like these. We are already seeing the uptake of the "rubber hose" in IT/IS oversight. Up to the Federal level, in the U.S. It's not going to be a matter of who is responsible and who is technically capable. It's going to be the rubber hose and the lead pipe. Whether that's a winning strategy...? I guess that's why you're making popcorn.

madez 9y ago

I've also become a cynic. I welcome national services to lose control of their systems and their data. I have had countless talks with people here in Germany about why computers and therefore open and libre software and hardware are a matter of national interest. Obvious disaster, at least and last, will hopefully make them get what I mean. Having said that, I feel bad, but I just don't see any other way.

k-mcgrady 9y ago
>> I've also become a cynic. I welcome national services to lose control of their systems and their data. Quite a moronic point of view when lives could be potentially put at risk.
- madez 9y ago
  I agree as to that it sounds moronic. Maybe it even is. However, think about a levee about which you know that it will not hold when a storm comes, but people don't believe you and are not even willing to listen to you. Would you think it's moronic to welcome a storm as a shot across the bows so people realized what you are talking about? The constructive solution to this problem is to find a way to convey the message such that people are willing to listen. But that can be very difficult.
  - graphitezepp 9y ago
    In a similar vein Karl Marx is said to have been pro free trade, as it would lead to what he believed would happen to capitalism much faster. Also the colloquial expression "kick in the teeth". Often actual change requires drastic consequences.
  - anigbrowl 9y ago
    I don't feel you're moronic and I absolutely get your sense of frustration, but welcoming a storm is implicitly saying that you think the suffering of some others is an acceptable price to pay for opening the eyes of the higher-ups. I'd like to suggest that the reason people in management don't listen to people in IT is because the people in IT aren't willing to make them, despite having direct and often primary access to the organizational levers of power. Have you ever considered the possibility that management deliberately selects for this kind of passivity and conflict aversion when staffing IT departments, hiring exactly the sort of people who might roll their eyes or grumble at things but will reliably do what they're told?
- dasil003 9y ago
  I disagree. Every day we become more and more dependent on computers, and more specifically, networked computers. The IoT is exploding with horrific security implications. Everyone is focused on the next big thing, and no one is paying attention to the house of cards we are building. So for something like this to happen now is much better than it happening later, because people need events like this to wake up and motivate action.
- dredmorbius 9y ago
  You do realise that very nearly every engineering standard ever established, or regulation imposed, is written in the blood and memorialises the souls of those who died because it wasn't in place. Turn on your gas stove for a moment, but don't light it. That smell you detect is a memorial to the 295 students and teachers of the New London School: https://en.m.wikipedia.org/wiki/New_London_School_explosion https://en.m.wikipedia.org/wiki/New_London_School_explosion Early in 1937, the school board canceled their natural gas contract and had plumbers install a tap into Parade Gasoline Company's residue gas line to save money. This practice—while not explicitly authorized by local oil companies—was widespread in the area. The natural gas extracted with the oil was considered a waste product and was flared off. As there was no value to the natural gas, the oil companies turned a blind eye. This "raw" or "wet" gas varied in quality from day to day, even from hour to hour.
anigbrowl 9y ago
You're frustrated, but what are you doing to provide a better alternative? If national services lose control of their systems, what then? What is it that you expect to happen? The same people in charge, but making better decisions? A revolution that will magically fix everything? I understand that you've been trying to persuade people of the merits of openness, but as you have experienced it's very difficult for an individual to persuade people of things without being a politician or offering some commercial bargains. Managers keep making bad decisions because they can always find someone who will write the code instead, but for some reason developers are unwilling to act in concerted opposition to this and so find themselves endlessly ignored and overruled.
- tgragnato 9y ago
  > Managers keep making bad decisions because they can always find someone who will write the code instead, but for some reason developers are unwilling to act in concerted opposition to this and so find themselves endlessly ignored and overruled. A labor union that protects you when you refuse to implement things that should not be implemented? IMHO it is a difficult thing to manage and integrate into the tech culture. Leaks? Maybe, we're seeing them.
  - anigbrowl 9y ago
    It suits the management class very well to minimize the formation of organizational structures among technologists. While I'm not a big fan of unions or guilds - insofar as they rely on internal hierarchies that just reproduce existing and faulty control structures - those who resist or deny the possibility of organization among technologists are not necessarily disinterested in the outcome.

jordwest 9y ago

It's so easy to throw up a veil of security while doing absolutely nothing at all. Just today I was helping somebody retrieve an export of older transactions from PayPal, and they were forced to go through a series of steps to sign up for "secure" access to a special account in order to download a "secure" zip file that PayPal had uploaded containing the transactions. The password on the zip file? PayPal123.

wordupmaking 9y ago
Which doesn't just mean that file had a crap password; I'd be willing to bet it means a whole bucket or type of files has the same password. So at least there's that.
sorokod 9y ago
Doesn't sound that this password is frequently changed

rrggrr 9y ago

Fault will be leveled against Bitcoin for facilitating the ransom, against Microsoft, against NHS budget underfunding... everywhere EXCEPT where the blame belongs. Products liability law applied to IT security would put a quick end to most vulnerabilities.

nopcode 9y ago
>Products liability law Wouldn't that hold Microsoft liable then?
- blowski 9y ago
  Depends. And that's exactly why it's easy to say "we need product liability law", but very difficult to say how it would work in practice.
- UK-AL 9y ago
  Maybe, but a patch for this issue being exploited has been out for quite some time. What's happened is that unpatched versions are being exploited.
gwright 9y ago
Seems strange to not mention the ransomers as having culpability. I'm 100% in favor of better systems/processes/technology to prevent exploits, but I'm also 100% in favor of blaming the perpetrators of the ransom also. In the real world we don't accept the argument that the victim is primarily at fault. * leaving your car unlocked doesn't mean that is OK for someone to steal it and demand a ransom for its return * leaving your house/apartment unlocked doesn't mean that it is OK for someone to swap out the locks and demand ransom for the new keys And it really isn't about being locked/unlocked. Doors and locks can generally be easily broken or bypassed, doesn't mean that everyone should have to purchase industrial strength doors and locking systems (and windows, and...).
- ryandrake 9y ago
  Leaving your car or house unlocked means that you're negligent, not that the attack is your fault.

peterwwillis 9y ago

The alternative is massive investment in security, which would raise costs to insurers/patients, and introducing procedures that would slow down the speed of medical practice, which is already too slow. One example i've seen is the "medical system", a conglomerate of healthcare providers under one brand. At a high level, the priority is simply to swallow up as many healthcare solutions as you can, to reduce cost and increase profit, and make healthcare process more seamless for the patients. At a medium level, this means you have 50 different organizations connected to your network, and you may or may not have centralized control over any of them. You don't have the cash, time or resources to go in and overhaul all the networks. So you tell them all to connect through your central office and throw every single transparent filter or proxy at them to try to catch all the crap flying out the door (and there is a lot of it). At a local level, doctors are already stymied by the complex process of providing care to patients. I've worked with them to try to find tailored solutions to speed up simple things like returning lab results. It's surprisingly difficult to improve on. Add new security procedures and their time shrinks even more, adding on top of all their existing procedure. Healthcare is just always going to suck at security. The alternative is more costly and slower healthcare.

6stringmerc 9y ago

In the aftermath I wonder if we'll ever find out how the attack was enabled. As in, who opened the attachment. My hunch? An Executive high enough in Leadership who won't get fired. Will be interesting to see.

UK-AL 9y ago

The result will be intensify what they are already doing rather than to rethink the system.

graphitezepp 9y ago
Until it crashes and burns dramatically, the way it has happened since time immemorial.

mavhc 9y ago

Is there some kind of saying: You can't secure a network that contains legacy systems? Start from scratch, don't connect anything legacy. Assume the LAN is already penetrated and design for that. Store no data locally, client machines run something like ChromeOS by default. Timeout anything that's not used for 6 months. Don't use passwords, only SmartCards. Snapshot data for ease of restore.

nopcode 9y ago

I work for one of those consultancy firms. Typically, this is the kind of stuff that's required to get us through the door in the first place.

holyavengerone 9y ago

Software development seems to be one of the rare branches of engineering where people and businesses are ready to accept such low quality standards, both in terms of functionality and security. We wouldn't accept from a civil engineer that "the bridge might collapse" but that it's "no big deal, takes a moment to rebuild". It was one thing when software was controlling some random machinery in a basement or fueling our BBSes, but nowadays large-scale software failure can end a lot of lives, nothing less. And yet, society is largely oblivious to how fragile it all is...

dagaci 9y ago
A bridge is a largely static unmoving object, but even bridges require maintenance - some bridges require more maintenance frequent maintenance than others. It's not that bridges are necessarily of low quality. If a the bridge maintainer instructed you that a column needed replacing it would be replaced. Everything constructed in reality requires maintenance in one way or another. Your house, your car, your bridge and yourself for example. To suggest that software should be different is an interesting point of view.
- jacquesm 9y ago
  > A bridge is a largely static unmoving object, but even bridges require maintenance - some bridges require more maintenance frequent maintenance than others. It's not that bridges are necessarily of low quality. That's a laymans impression of what a bridge is. In reality bridges are in an extremely dynamic environment with loads changing magnitude and direction constantly, unpredictably. The fact that you think that a bridge is 'a largely static unmoving object' is a tribute to the engineers that designed it and the contractors that built it, it's whole function can be described as 'appear not to move'. But if you looked at the bridge in a little bit more detail and you would see how the bridge copes with the load your estimate would change to 'a bridge is an extremely versatile structure that dynamically responds to a wide variety of loads by rejecting those loads onto the foundation and soil around it'.
  - dagaci 9y ago

anigbrowl 9y ago

Have you considered going on strike along with the other IT people? I can well imagine how draining 20 years of management BS is (I grew up with one), but one of the reasons I decided to get out of corporate IT after a decade in it was the realization that the IT were frequently used as a buffer between management and the rest of the workforce. I certainly don't blame you for making popcorn, but surely part of why poor operating practices and decisions get entrenched if that the people doing the work passively go along with whatever bad idea management is proposing while hoping that either inevitable failure or some higher level of management will intervene to vindicate the initial objections of the technical people and topple a few of the more inept managers from their perches. Because IT people tend not to be organized into a union or professional association, they have little to no political leverage of their own so any personal sense of organizational mission or ethical scruples don't count for much in the event of a conflict with the management people, who may sweep aside objections on the basis that the IT person 'doesn't understand the big picture' or somesuch. I don't mean to suggest that you should be reiterating old faulty models of social organization like unions or guilds; if anything the lesson of technology is that we should be restructuring our pyramidal structures of control and authority (whether corporate, political or whatever) into more effective network paradigms. But I do think that if you just munch on popcorn and hope to see some bad managers ousted and some technical people finally lifted up to positions of seniority within the existing decision structure, then it will just be more of the same until the system is forced into a state of collapse. Why leave everything to he management and consulting types 'sweeping up the mess, and creating the next failure-to-be' as you eloquently put it, when you have one of those rare opportunities to force change?

nickpsecurity 9y ago

People will have to die before that happens without a regulation push. Possibly in a horrific way but done remotely. A few entered my mind. The risk is there. Thing is, it took things like THERAC poisoning in the past to establish importance of software safety. Security will probably be similar as it has been damage first, correct behavior second in other sectors.

pasbesoin 9y ago

Just as in the performance review process, Management (aka "the winners", be default and decree) write the story. I remember spending more time pushing against the inertia and self-interest, than actually solving the problems. Solutions that, in a fairly straightforward and rather conservative fashion, stopped problems like these. We are already seeing the uptake of the "rubber hose" in IT/IS oversight. Up to the Federal level, in the U.S. It's not going to be a matter of who is responsible and who is technically capable. It's going to be the rubber hose and the lead pipe. Whether that's a winning strategy...? I guess that's why you're making popcorn.