5 ms·

Great. Maybe we can finally put a price on lack of security protocol.

• olewhalehunter 9y ago
  OSHA violation in 2025: operator was not using a deterministic operating system
  • lilott8 9y ago
    what you are suggesting has grave realities for those who cannot or do not want to mess with formal verification techniques. This is the future of computing and a lot of people will be left behind once this catches on.
    • ktta 9y ago
      >lot of people will be left behind once this catches on if this catches on.
• merrickread 9y ago
  I dream of seeing a "security first" development process adopted ..
  • devcpp 9y ago
    Are you sure about that? You do know most organizations will implement that as a huge amount of bureaucracy for every commit, rather than proper man-hours of security-oriented development.
    • sillysaurus3 9y ago
      Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to know about except security companies. This way you can focus on development and we can focus on pointing out how to fix what's broken.
      • paulmd 9y ago
        Pentests aren't a magic bullet either. You can easily find a consultant who isn't going to rip you a new one. Security is a mindset. Any "checklist" approach will eventually devolve into ass-covering by an organization that is not internally motivated to run a tight ship. Legitimate variances will be hassled to no end, while actual security vulnerabilities will be ignored.
        • sillysaurus3 9y ago
          In the real world, one of the only reasons people get pentests is because another company is forcing them to. That results in a document saying company B is secure. This is a very effective approach at cutting through ass-covering. Company B has to fix the security problems uncovered in the pentest. There is no other option. And I've seen it take products from "SQL injection by typing an apostrophe" to "It'd be very difficult to exploit this app." If that's not proof that pentsts are effective, then I'm not sure what would be. We like to say that security is a mindset, but developers have way too much on their mind to be aware of every possible security vector. It's easier and more effective to punt and let us worry about it instead.
          • Consultant32452 9y ago
            There's different levels of penetration testing too. I worked at a SaaS startup and when we got our first big customer they demanded we get a third party to run a pen test on us. They basically ran their script and gave us a report. There might have been some minimal going back and forth about some false positives, but that was about it. That's better than nothing, but may not be what some of the more technically/security minded folks here at would consider a real pen test.
      • hutzlibu 9y ago
        "It's not hard." No, it is not, you just need skilled people working on it. Oh, those people want money for it ...
        • 9y ago
  • inb4dangshitban 9y ago
    I predict that this is might be a start of a something akin to few catastrophic bridge collapses that really showed the importance of credentials in engineering. Maybe the era of software "engineers" will come to an end eventually
    • golergka 9y ago
      What does it have to do with credentials?
    • narrator 9y ago
      Do you think the engineers at Microsoft who were responsible for these badly designed and buggy systems wouldn't have been able to get credentials?
  • ryankupyn 9y ago
    What I really want to see is security being integrated into the development process as a conscious tradeoff teams have to make. When a new feature is proposed, it's rare to hear someone object on the grounds that it could potentially add new vulnerabilities, but in the long run an approach that recognizes and considers those risks would be beneficial. At the same time, this is incredibly hard to do - managers celebrate employees who develop things that look cool and awesome, not employees who can mitigate risk and manage security effectively (hopefully this changes, but I can't imagine that many unaffected CEOs are calling up their sysadmins right now and congratulating them on their diligence in making sure all their machines are patched).
    • spydum 9y ago
      Definitely a problem. People (incorrectly) compare vulnerability scanning with pen testing. Vuln scanning often is a component of a pen test, but we do a bad job explaining the distinction. Pen test should attempt to use the app(s), maybe test the people and process, not just profile the software versions and complain they are out of date or misconfigured.
• cm2187 9y ago
  Or on some IT guy being asleep at the wheel...
  • pstuart 9y ago
    No. IT management owns this.
    • flukus 9y ago
      A lack of professionalism owns this. In other industries engineers can overrule management and have legal protection when doing so.
• mbesto 9y ago
  My company is actively helping enterprise companies and cyber insurers do just this.
• reaperducer 9y ago
  The article says the ransomware affects even patched Windows boxes. Perhaps what you mean to say is, "Great. Maybe we can finally put a price on using Windows."
  • flukus 9y ago
    Patched machines are affected, but they probably weren't the initial entry point. We still rely too much on having a single line of defense.
    • willstrafach 9y ago
      My understanding is that patched computers are only affected via pass-the-hash from an unpatched computer.
    • edejong 9y ago
      Yes, a zero-day is no excuse for a lack of defense in depth.