3 ms·

> It’s the path of least resistance in action This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the

> It’s the path of least resistance in action This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation. Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. At least at the company I work at, management cared about security for about a month after Wannacry happened. Once all the PCs were patched for that specific issue, it was back to business as usual.

nickpsecurity 7y ago
"This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation" That's not true. There's tons of people that could setup VPN's or whatever for them that are better than what we see. The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. I've known a few engineers doing embedded systems telling me how their customers almost always ignored warnings if dollars invested was somewhere above zero.
- fuzz4lyfe 7y ago
  The above commenter said: > Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. That's the problem. Explaining to the beancounters why this is needed and why Susan can't just RDP in from home anymore. The implementation of these things are fairly trivial, the hand holding takes forever. Add the fact that lots of us got into IT to avoid playing these games and you've got the current state of affairs. I work on a safety critical piece of software. To give QE more than a day or two to test it is a fight every single release. After many unsuccessful attempts I stopped swinging at windmills. We pulled about half of the software releases we made last year due to patient safety issues discovered by customers. Management still wants "agile"
  - ficklepickle 7y ago
    "Agile" and safety critical, that is terrifying to me.
    - Tomte 7y ago
      It's common nowadays. The new edition of IEC 61508 that's being worked on is supposed to incorporate agile workflows.
    - InternetOfStuff 7y ago
      Not sure if your comment was aimed at agile vs. "agile". Agile and safety critical is fine. It works. "Agile" is a problem, safety-critical or no.
- shandor 7y ago
  > The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. Nor should they, if they act rationally. To be honest, I've started thinking that having a lot stronger regulation for punishing companies is the only way to improve the situation. GDPR is a good start in the EU, although it is privacy-focused. The free-market solution to this is that users (be they consumer or B2B) start shunning the companies and products with the worst security records, but the problem is that security (and privacy, it seems) are so hard to grasp that it's just not happening. Companies exist to make money, and it's sad how many of them won't actually care about anything else. So if that is the only thing that they care about, the only option to make them care about security is to make insecurity a bad road business-wise.
  - nickpsecurity 7y ago
    It was painful to admit as much myself in a counterpoint I wrote to Bruce Schneier: https://www.schneier.com/blog/archives/2011/06/yet_another_peo.html#c556377 https://www.schneier.com/blog/archives/2011/06/yet_another_p...

nickpsecurity 7y ago

"This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation" That's not true. There's tons of people that could setup VPN's or whatever for them that are better than what we see. The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. I've known a few engineers doing embedded systems telling me how their customers almost always ignored warnings if dollars invested was somewhere above zero.

fuzz4lyfe 7y ago
The above commenter said: > Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. That's the problem. Explaining to the beancounters why this is needed and why Susan can't just RDP in from home anymore. The implementation of these things are fairly trivial, the hand holding takes forever. Add the fact that lots of us got into IT to avoid playing these games and you've got the current state of affairs. I work on a safety critical piece of software. To give QE more than a day or two to test it is a fight every single release. After many unsuccessful attempts I stopped swinging at windmills. We pulled about half of the software releases we made last year due to patient safety issues discovered by customers. Management still wants "agile"
- ficklepickle 7y ago
  "Agile" and safety critical, that is terrifying to me.
  - Tomte 7y ago
    It's common nowadays. The new edition of IEC 61508 that's being worked on is supposed to incorporate agile workflows.
  - InternetOfStuff 7y ago
    Not sure if your comment was aimed at agile vs. "agile". Agile and safety critical is fine. It works. "Agile" is a problem, safety-critical or no.
shandor 7y ago
> The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. Nor should they, if they act rationally. To be honest, I've started thinking that having a lot stronger regulation for punishing companies is the only way to improve the situation. GDPR is a good start in the EU, although it is privacy-focused. The free-market solution to this is that users (be they consumer or B2B) start shunning the companies and products with the worst security records, but the problem is that security (and privacy, it seems) are so hard to grasp that it's just not happening. Companies exist to make money, and it's sad how many of them won't actually care about anything else. So if that is the only thing that they care about, the only option to make them care about security is to make insecurity a bad road business-wise.
- nickpsecurity 7y ago
  It was painful to admit as much myself in a counterpoint I wrote to Bruce Schneier: https://www.schneier.com/blog/archives/2011/06/yet_another_peo.html#c556377 https://www.schneier.com/blog/archives/2011/06/yet_another_p...