As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems: "Firstly, a lot of infrastructure and data is

As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems: "Firstly, a lot of infrastructure and data is in civilian hands. The people and organizations responsible for securing things are not the ones responsible for retaliating against attacks. They can’t do it anyway because they lack the resources, capability, and legal authority to do so. As for investing in securing their systems, there is no regulatory requirement to do so. Indeed, for a board of directors, I’ve seen it suggested that they have a fiduciary duty to shareholders not to bear the cost burden of securing critical national infrastructure. It’s not their business to directly bear the costs of defending the nation, that’s what the nation state is for in the first place!" https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b7280 https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b...