3 ms·

OK, but then not patching your shit, having root/root as your db password, exposing data to the internet that does not need to be exposed and collecting data th

OK, but then not patching your shit, having root/root as your db password, exposing data to the internet that does not need to be exposed and collecting data that does not need to be collected also has to be treated like a crime. We called it "computer virus" for a reason. This stuff is just part of the environment. We yell at people for not vaccinating, we condemn people who are not wearing mask and follow social distancing protocols. Also, if we call this cyber terrorism, we also have to call the NSA and similar terrorist organisations and shut them down: they find vulnerabilities and keep them secret to use them themselves, and they buy exploits, funnelling money into the black market. Just imagines: a hospital shuts down after being hit by an exploit, that was developed with NSA money and they didn't tell the public about.

bollu 6y ago
I'm sure it will be called "cyber preparedness", just as biological warfare was dubbed "biopreparat" by the USSR...
waihtis 6y ago
In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/inherit a well-organized network or a complete clusterf*ck depending on the organization. Management deploys resources to a level to not annoy owners / investors. This level is influenced by external forces, like regulation. So regulators need to step their game way up, but are also time & resource-constrained. How do regulators pull the needed resources? Tax money. How to justify tax money? Have a public that is informed of the danger and criticality of having hospitals operated in the way they are right now. This is of course a big simplification, but the chain goes much further than just "IT that doesn't patch."
- turbinerneiter 6y ago
  Obviously management and lawmakers have responsibility! As an IT person, get a paper trail to prove you warned them! Also consider refusing their orders if it literally puts lives at risk! Nobody can claim not to know about the problem.

bollu 6y ago

I'm sure it will be called "cyber preparedness", just as biological warfare was dubbed "biopreparat" by the USSR...

waihtis 6y ago

In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/inherit a well-organized network or a complete clusterf*ck depending on the organization. Management deploys resources to a level to not annoy owners / investors. This level is influenced by external forces, like regulation. So regulators need to step their game way up, but are also time & resource-constrained. How do regulators pull the needed resources? Tax money. How to justify tax money? Have a public that is informed of the danger and criticality of having hospitals operated in the way they are right now. This is of course a big simplification, but the chain goes much further than just "IT that doesn't patch."

turbinerneiter 6y ago
Obviously management and lawmakers have responsibility! As an IT person, get a paper trail to prove you warned them! Also consider refusing their orders if it literally puts lives at risk! Nobody can claim not to know about the problem.