3 ms·

People in the know have been complaining about this for many years, and it's corporate bean counters that collude with a sclerotic corporate IT mentality to be

by cmurf 9y ago

People in the know have been complaining about this for many years, and it's corporate bean counters that collude with a sclerotic corporate IT mentality to be conservative in all things including software. And the reality is, the overwhelming majority of IT people have no training or background in risk assessment, they are not computer security people. But the bean counters, always optimizing, without good information let alone perfect information, have assessed risk incorrectly. And now there's a wildfire in progress, and basically being incompetent at the task they were handed, are all surprised. Many other people who have considered this eventuality are not surprised.

davidf18 9y ago
> "And the reality is, the overwhelming majority of IT people have no training or background in risk assessment,..." But in this case, as in the case of credit card hacks of Target and Home Depot, it was simply a matter of following manufacturers maintenance instructions and upgrading the OS version from an unsupported version to a supported version. As many have pointed out, in the case of Windows 10, the upgrades had been free at no charge from Microsoft.
- cmurf 9y ago
  As many others have pointed out, the software company needs to run on that OS may not run on Windows 10, may not be supported on Windows 10, or maybe require a whole new licensing scheme and fees to move to a version of the software that will run on Windows 10. And IT and bean counters have very typically taken the position of "if it's not broken don't fix it" and do not consider constant migration in their best interest. Also, that it was free for consumers doesn't mean it was free for enterprises. That licensing is different. And even if the licensing is free, the cost to know how by your IT staff is not free. Either you're getting new staff who can support it, or you're sending the staff to currency training. Doctors, lawyers, pilots, have done such recurrency training for decades, but in IT it's not a given it's very much driven by the CTO. And some of them do not care to have a staff more capable than minions. They're cheap. That's all they care about. And then this happens and they quickly will have to look for someone to blame.
  - davidf18 9y ago
    The bean counters ultimately work for the shareholders if a public corporation or the public if it is government. The shareholders empower management and the public elects their leadership. The CEO of Target got fired for not upgrading their point of sale software from an unsupported version of Microsoft Windows embedded (XP) to a later version which caused their system to be hacked. Ultimately, this is going to be a problem as long as firms don't treat computers as any other form of capital equipment (such as repair vehicles) that need ongoing maintenance. Boards need to be asking their management about keeping their capital equipment under maintenance. As for software that doesn't run on Windows 10, perhaps it is best to avoid firms that produce software where they don't upgrade it to the most secure version of the OS. I think this is mostly a hypothetical for most and it is probably important that firms change vendors if the vendor isn't willing to upgrade to the latest version of the OS.
digikata 9y ago
There are a class of bean-counters that specialize in assessing risk quantitatively. They would be found in the insurance industry. Though I would caveat that with the guess that the vast majority of that assessment is with models of risk attached to lines of insurance that have been long established and change fairly slowly.

by cmurf 9y ago

davidf18 9y ago

> "And the reality is, the overwhelming majority of IT people have no training or background in risk assessment,..." But in this case, as in the case of credit card hacks of Target and Home Depot, it was simply a matter of following manufacturers maintenance instructions and upgrading the OS version from an unsupported version to a supported version. As many have pointed out, in the case of Windows 10, the upgrades had been free at no charge from Microsoft.

cmurf 9y ago
As many others have pointed out, the software company needs to run on that OS may not run on Windows 10, may not be supported on Windows 10, or maybe require a whole new licensing scheme and fees to move to a version of the software that will run on Windows 10. And IT and bean counters have very typically taken the position of "if it's not broken don't fix it" and do not consider constant migration in their best interest. Also, that it was free for consumers doesn't mean it was free for enterprises. That licensing is different. And even if the licensing is free, the cost to know how by your IT staff is not free. Either you're getting new staff who can support it, or you're sending the staff to currency training. Doctors, lawyers, pilots, have done such recurrency training for decades, but in IT it's not a given it's very much driven by the CTO. And some of them do not care to have a staff more capable than minions. They're cheap. That's all they care about. And then this happens and they quickly will have to look for someone to blame.
- davidf18 9y ago
  The bean counters ultimately work for the shareholders if a public corporation or the public if it is government. The shareholders empower management and the public elects their leadership. The CEO of Target got fired for not upgrading their point of sale software from an unsupported version of Microsoft Windows embedded (XP) to a later version which caused their system to be hacked. Ultimately, this is going to be a problem as long as firms don't treat computers as any other form of capital equipment (such as repair vehicles) that need ongoing maintenance. Boards need to be asking their management about keeping their capital equipment under maintenance. As for software that doesn't run on Windows 10, perhaps it is best to avoid firms that produce software where they don't upgrade it to the most secure version of the OS. I think this is mostly a hypothetical for most and it is probably important that firms change vendors if the vendor isn't willing to upgrade to the latest version of the OS.

digikata 9y ago

There are a class of bean-counters that specialize in assessing risk quantitatively. They would be found in the insurance industry. Though I would caveat that with the guess that the vast majority of that assessment is with models of risk attached to lines of insurance that have been long established and change fairly slowly.