4 ms·
Well, no official government-supported agency have even stepped in to establish a list of norms involving software security, to force large corporations to abid
by jokoon 7y ago
Well, no official government-supported agency have even stepped in to establish a list of norms involving software security, to force large corporations to abide by them.
While the private sector is the sole responsible for their own cyber security, and while the NSA wants to keep the upper hand in cybersecurity by holding a cyber-weaponry supremacy, events like these will keep happening.
Cyber chaos will continue because the NSA is obviously holding massive advancements in cyber weapons. The day the NSA will have an adversary that can be at least 50% as good as the NSA, you can be sure you will see cyber security standards being passed into law.
If you think about it, having cyber supremacy is a good way to have total power over the world. When you have all the information, you have everything you need to do whatever you want. That sort of describes the US right now.
- idoh 7y agoThe government does actually have security policies / norms, see NIST 800-171 as an example.
- Craighead 7y agoThis is a bad take. Russian exploit-to-admin rights is 12 minutes
- xp84 7y ago>list of norms involving software security These norms are already well-known. However they are never followed 100% because they all rest upon a sandy foundation of: "Don't be clueless." Social engineering/phishing will always eventually work on someone somewhere in a company with more than 20 employees. Not to mention the other part, where passwords are allowed to be a vital link in the security chain, yet software vendors like Citrix simultaneously discourage password managers by getting in the way of using them and by forcing perfectly good passwords to be cycled endlessly. Resulting in people using passwords like Citrix20! (will change to Citrix21! in 90 days... iron clad security there guys.)