7 ms·

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to mo

by jmclnx 6y ago

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. That will get them serious about security.

mcny 6y ago
> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. I would love to see this but somehow I doubt it will happen any more than my pipe dream of holding the CXO and the board criminally liable for the criminal actions of management/employees/contractors/agents of a corporation during the course of their work for the corporation. It is nice to dream though. I would certainly welcome any kind of accountability.
ruskimir 6y ago
We should also shut down Russian infrastructure through cyberattacks. The Russian government supports DarkSide.
- motoxpro 6y ago
  Totally, take out all the hospitals, education and basic needs for the rest of the innocent people. Or just nuke them, that will teach um. On a serious note, sure retaliate, probably don't hurt innocent people.
  - pasquinelli 6y ago
    or maybe the notion that russia is even behind it is a lie aimed at stoking tensions between the united states and russia, probably for the sake of profitting companies like digital shadows--or wharever it was called.
darkerside 6y ago
> companies are chasing profits at any cost What does that mean? This was addressed in the article. Critical services are on the internet because remote workers need access to them. I don't see how profits factor into it.
- mensetmanusman 6y ago
  Those remote workers wouldn’t have to be ‘remote’ if there were other workers hired on site.
  - rhodozelia 6y ago
    Many sites are in the middle of nowhere so it is inconvenient to go to them, so accessing them over a network saves a lot of travel time and cost.
    - mensetmanusman 6y ago
      This is true for nuclear weapons infrastructure. Paying for commutes and lodging are used there, might be useful to consider?
      - rhodozelia 6y ago
        At one extreme a Nuclear weapons accident can kill millions of people and destroy the environment of a large area for a long time. And then a sliding scale of risk and cost of getting hacked vs savings and increases in efficiency resulting from remote access. Are you for or against Tesla having remote access to all of the Tesla vehicles? Are their OTA updates innovative or reckless?
  - PeterisP 6y ago
    What "on site"? The various valves that need to be controlled remotely often are just a box, perhaps even underground, in a place where's no buildings for people to stay - a mechanical team can access the hardware on-site, but building and maintaining an actual office on each site is not practical. The same applies for power grids - you can't staff every substation with people. A remote operator can manage dozens of such sites, a single "local" person might be close to one point, but the next control point is going to be miles away, so you either need much, much more people to station one at every valve, or have a situation where flipping a switch in all the "sites" is very slow because requires the "local" person to drive many miles visiting each location. No, there's a reasonable objective need for this management to be actually remote - there's a discussion on how this should be implemented in a secure way, but it does have to be remote.
nbardy 6y ago
Agreed. Our companies are driven to increase profit at all cost. Even cost to their function and utility. Our over financialization is squeezing everyone and everything.
- StandardFuture 6y ago
  To clarify: this is not from "financialization" generally speaking. This is specifically from consolidation for the sake of increasing efficiency and thus margins (as you pointed out). This is opposed to increased competition (which also increases volatility) in the markets. The reason why the markets are so consolidated is because it removes short-term risk. If there is an obvious market and only one (or a few) companies involved then everyone makes money (magic, I know). This is why Wall Street lobbies for regulations so hard. They have ownership in all the existing major companies that can afford those regulations and it consolidates the profits (and thus returns). De facto Crony Capitalism at its finest. Your aristocratic oligarchs. So, stop giving your money to large index funds. (And every time there is a comment on HN telling you to, and there are plenty, downvote them and tell them a proper F-off). The idea that no one can/should ever lose is what is killing the economy. It got its birth in the boomer-retirement-fund markets of the past few decades. To recap, it is consolidation for margins that is the problem. That is not the same as general "financialization" (increased trading) that helps increase volatility in the markets and actually increases the size of the economy. We desperately need real markets and not this crony capitalism that seems self-persistent. The current system is such a marriage between corrupt politicians and wall street (which is now heavily extended into SV, btw) that it is absolutely disgusting.
  - sarakayakomzin 6y ago
    > To clarify: this is not from "financialization" generally speaking. This is specifically from consolidation for the sake of increasing efficiency and thus margins (as you pointed out). ??? Can you give an example of governments that continue to give back to their "shareholders" once they decide they have enough military capacity?
wyager 6y ago
> if you are a critical service ... for each occurances 10% of your total revenue ... are forfeited You can achieve the same effect without all the arbitrary political decision-making inherent in this proposal by requiring these companies to buy delivery insurance or something. The insurance company will charge them proportionally to the risk of attack, which will internalize the cost.
- rapind 6y ago
  Like AIG insuring investments during the 2008 crisis? I think for critical infra you want some extra care and redundancy (not arbitrary though of course).
kingsuper20 6y ago
> That will get them serious about security. My guess is that they only get serious about security after a breach occurs. You can view it all as strengthening an immune system. Without attacks, and the occasional successful ones, nobody is going to bother to harden anything.
- tbihl 6y ago
  Is that like how the banks all got serious about evaluating their risk carefully after the first time [1] they saw their models, and consequently their liquidity, evaporate? Obviously I agree about your dissatisfaction with the other proposed solution: that just lets corporate entities put a low (10%) ceiling on what should be unlimited liability, allowing them to say that failing catastrophically by utter neglect to security is reliably a survivable offense (I recognize that in reality the liability of course ends at the dissolution of the corporation.) I don't know what the actual answer is. [1] https://en.m.wikipedia.org/wiki/List_of_economic_crises https://en.m.wikipedia.org/wiki/List_of_economic_crises
- world_peace42 6y ago
  I don’t think the analogy applies. We are humans, capable of observing the failures of others and making rational decisions to avoid those same failures. The immune system is programmed to react one specific way. For example, we can choose or choose not to go out of our way to get vaccinated. If someone doesn’t get vaccinated and infects a dozen other people and then get really sick themselves, it’s hard for me to have sympathy. Unfortunately here, when there’s an illness, millions of people have private information leaked. This should simply be an unacceptable.
surround 6y ago
> Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home.
- rckoepke 6y ago
  I would disagree with this. No petrochemical company I've worked with had OT/PLC/SCADA layers enabled for remote login. Other middle layers, like the historian, potentially. But not the control system itself. It's possible to enable this but knowing the culture at Colonial Pipeline first-hand, I strongly doubt they did this during COVID.
unethical_ban 6y ago
It's multi-dimensional. SCADA itself being networked, and it reaching other systems that may be internet-enabled. * What systems are affected by the hack? * Could the shutdown be needed because of critical data the ICS gets from business? * Or is it shut down because business needs real-time data from ICS it can't ingest? In general, the idea of completely isolating an ICS from any other network is a tough one. My question is, how often are these critical suppliers audited by the federal government? I have worked in banking cybersecurity and the amount of auditing from federal and state regulators is mind boggling. If a single company controls 45% of fuel transport to the east coast, it should carry some designation as a quasi-state entity subject to federal cybersecurity audits like banks.
- bredren 6y ago
  This question of missing cyber security audits came up for me in discussion of the Verkada hack. That’s the startup providing security cameras inside hospitals, prisons and schools. It seems like cybersecurity and audits of security readiness need to be demanded from any authority over companies operating in sensitive areas.
raggles 6y ago
They aren't 'on the internet'. They are connected via several layers of networks with firewalls etc in between to a system which has direct access to the internet. There often is no practical way around this - data from these networks needs to be shared with business users, other companies, regulators and so on. Data diodes can be applicable in some situations, but I've never worked with a company that uses one. I don't know the details of this situation, but demanding that it be impossible to compromise infrastructure networks is ridiculous. If you throw enough money and resources at it, no network is secure.
- rckoepke 6y ago
  Indeed the best evidence supporting this view is that Natanz was fully air-gapped and still got destroyed by the Stuxnet hack. That said I have heard of customers expressing desire to control valves and pumps using iPhones, and believe there are several initiatives at SCADA/PLC/DCS/System Integrator companies to provide this. However I've seen as many of those in practice as I have data-diodes, which is to say, none/never.
JumpCrisscross 6y ago
> US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited This sounds good in theory but suffers from the cobra effect [1]; you think you’re incentivising security. You’re actually pushing obscurity. Colonial preëmptively shut down its pipe to prevent physical damage. Attach a fine to the discovery and disclosure and you disincentivise that prudence. Better: make it easier for industry to build securely and incentivise redundancy. [1] https://en.m.wikipedia.org/wiki/Perverse_incentive#The_original_cobra_effect https://en.m.wikipedia.org/wiki/Perverse_incentive#The_origi...
- ignoramous 6y ago
  I reckon air-gapped networks are a valid defense. If something needn't be connected, why let it? It mitigates so many threats.
  - arcticbull 6y ago
    Can an individual not accidentally or intentionally infect a computer not connected to the internet?
    - fennecfoxen 6y ago
      It's called Stuxnet, and it ruined 20% of Iran's uranium centrifuges. Which were air-gapped.
    - zaroth 6y ago
      Air gaps didn’t save Iran. Air gaps are just one layer in the onion.
      - bobmaxup 6y ago
        Is the argument that Iran was attacked on air-gapped network, so its not worth doing?
WalterBright 6y ago
> companies are chasing profits at any cost Government systems get hacked all the time, too. Just because the government doesn't have a profit motive doesn't change a long list of human motivations that can be counterproductive. The profit motive also incentivizes improved quality. If the product is bungled, the company is not likely to get the next contract. If the government agency bungles the product, they'll get a budget increase next time.
- pasquinelli 6y ago
  "If the product is bungled, the company is not likely to get the next contract."
JackFr 6y ago
> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. Make it a crime to pay the ransom in a ransomware attack. Make it a crime to fail to report a ransomware attack in a timely manner. Ransomware attacks (and companies with poor security practices) will go away.
- hanniabu 6y ago
  Just like all other laws that companies break, they'll just get a slap on the wrist and continue their ways
- wutXthree 6y ago
  >Make it a crime to fail to report a ransomware attack in a timely manner. You mean like "18 U.S. Code § 4 - Misprision of felony" [0]? [0] https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4
- clarkmoody 6y ago
  Make it a crime to possess, consume, or distribute substances that are bad for people. Make it a crime for people to knowingly withhold information about such activities from the authorities. Abuse of substances, trafficking, and associated criminality will go away. But seriously... > Make it a crime to pay the ransom in a ransomware attack. Ok, so ... what should a company do? File a report with some government agency or with an insurance company and wait until the bureaucratic process maybe results in being able to pay the ransom to resume business operations? Punishing the victim of a crime? Really? > Make it a crime to fail to report a ransomware attack in a timely manner. Further punishing the victim of a crime? Really? > Ransomware attacks (and companies with poor security practices) will go away. lol
  - JackFr 6y ago
    I don’t see an analogy to drug laws. Is your point simply that such a law is impractical to enforce? Paying extortionists begets more extortion. The only argument I’m seeing is a bunch of hand waving and people telling me I’m being hopelessly naive. I don’t think I am.
ignoramous 6y ago
> It needs to be asked again, why are critical services on the Internet? From TFA: Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home... believe DarkSide bought account login details relating to remote desktop software like TeamViewer and Microsoft Remote Desktop.
- gbear605 6y ago
  So fast food workers were “essential workers” but oil pipeline control system engineers aren’t? Projects that require a security clearance have to be done from inside of a secure facility. This clearly needs to be the same level.
unclebucknasty 6y ago
>if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. The problem is that it matters less than we'd like to think how "serious they are about security". I'm seeing a lot of discussion about the responsibility of the victims to secure their networks, and it's mostly valid. But it's strange that we're talking about how to punish the victims versus the criminal conspirators. We virtually let the malicious, overtly criminal party off the hook. It's almost like we're saying we expect criminals to be criminals and these guys are so hard to catch that the onus is entirely on the targets to repel their incessant attacks, else they're negligently malicious themselves. Sure, most of these victims can do better in just about every case. But, people here know better than most how difficult it is to 100% secure every layer of the stack from software to firmware to hardware, with multiple vendors and vectors, OSS, zero days, etc. And the bad guys only have to be right once across this broad attack surface. It's impossible to defend completely. There will always be breaches. So, there's another element of this that has to be addressed, and that's getting serious about punishing these people. As it is, there's zero disincentive for them to just keep trying until they get through, but the upside is massive. Most if not all of this activity originates from nations that are adversarial towards the US. So, we need to start treating these instances as official sovereign actions, especially when they originate from nations wherein the government and their intelligence services exert control over (and outright sponsor) such criminal schemes, and wield these attacks as a projection of national power. These regimes also tend to feature oppressive criminal justice systems and harsh reprisals for even political dissidents. So, the message is, "we're not going to argue whether you're sanctioning these acts, but we're also not buying that you can't stop them, so we'll treat each incident as an official act of the state. We're holding you responsible for your criminals when they attack us and we will respond accordingly". Detailed discussion around exactly how the most recent exploit might be mitigated is interesting and useful. But the balance in these discussions between mitigation and reprisals for the perpetrators needs to be shifted much more towards the latter. Otherwise, we can expect these discussions ad infinitum.
m0llusk 6y ago
Critical services are on the Internet because they are provided by the lowest bidder.
- rckoepke 6y ago
  They are not always the lowest bidder. Colonial Pipeline was known for selecting the higher bids sometimes in order to ensure quality of work. They'd generally evaluate risk vs. quality vs. price. Colonial also kept multiple overlapping vendors for their last SCADA upgrade in order to make sure that no contractor was too overloaded during a "boom time". They'd generally stagger the work between locations (they had to upgrade dozens of stations along the pipeline) and keep track of the performance of everyone they hired and try to keep a steady workflow for everyone over a multi-year period. It was generally not about the lowest bid.
reedjosh 6y ago
Couldn't a service provider use an internet backbone with a one time pad comms protocol to essentially have a secure controls channel? Then once a year a rep could fly out a few terabytes of OTP to each location and all comms would be impenetrable. Sure beats a parallel physical comms system cost wise.
- justin_oaks 6y ago
  Maybe that'd make sense if it was the encryption that was broken. I wouldn't suggest a one-time pad for anything where modern encryption works just fine.
axiolite 6y ago
People whine about infrastructure being accessible over the internet, but in the old days it was just accessible over the phone network instead of the internet. It's not realistic for every bit of infrastructure to have the security protocols of military systems.
dheera 6y ago
Also, why do critical services run Microsoft systems?
- throw_m239339 6y ago
  The real question right here. When will the US government finally take Linux seriously and invest heavily in it instead of relying on Microsoft solutions?
  - raggles 6y ago
    so then we rely on linux solutions instead? I've seen lots of control systems running linux and windows, personally I'd rather keep a mix of the two. Something about eggs and baskets.
jb775 6y ago
Lost revenue would be justified by execs as cost of doing business. And they'd probably buy hacker-insurance to cover some/all of that risk. They'd pay for the hacker-insurance by getting a shittier employee benefit plan, and cutting the employee 401k match by 2%. For each quarter they aren't hacked, they'd probably receive a credit from the hacker-insurance company, which would be distributed to execs via performance bonuses.
kingsuper20 6y ago
>We all know why, companies are chasing profits at any cost, I wonder if that's even true 100% of the time. It could simply be programmers + feature creep, bolting great wads of software to systems with small value on the margin. It would be interesting to talk to software people in the gambling business, you'd think that would be Ground Zero for nefarious attacks.

by jmclnx 6y ago

mcny 6y ago

> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. I would love to see this but somehow I doubt it will happen any more than my pipe dream of holding the CXO and the board criminally liable for the criminal actions of management/employees/contractors/agents of a corporation during the course of their work for the corporation. It is nice to dream though. I would certainly welcome any kind of accountability.

ruskimir 6y ago

We should also shut down Russian infrastructure through cyberattacks. The Russian government supports DarkSide.

motoxpro 6y ago
Totally, take out all the hospitals, education and basic needs for the rest of the innocent people. Or just nuke them, that will teach um. On a serious note, sure retaliate, probably don't hurt innocent people.
- pasquinelli 6y ago
  or maybe the notion that russia is even behind it is a lie aimed at stoking tensions between the united states and russia, probably for the sake of profitting companies like digital shadows--or wharever it was called.

darkerside 6y ago

> companies are chasing profits at any cost What does that mean? This was addressed in the article. Critical services are on the internet because remote workers need access to them. I don't see how profits factor into it.

mensetmanusman 6y ago
Those remote workers wouldn’t have to be ‘remote’ if there were other workers hired on site.
- rhodozelia 6y ago
  Many sites are in the middle of nowhere so it is inconvenient to go to them, so accessing them over a network saves a lot of travel time and cost.
  - mensetmanusman 6y ago
    This is true for nuclear weapons infrastructure. Paying for commutes and lodging are used there, might be useful to consider?
    - rhodozelia 6y ago
      At one extreme a Nuclear weapons accident can kill millions of people and destroy the environment of a large area for a long time. And then a sliding scale of risk and cost of getting hacked vs savings and increases in efficiency resulting from remote access. Are you for or against Tesla having remote access to all of the Tesla vehicles? Are their OTA updates innovative or reckless?
- PeterisP 6y ago
  What "on site"? The various valves that need to be controlled remotely often are just a box, perhaps even underground, in a place where's no buildings for people to stay - a mechanical team can access the hardware on-site, but building and maintaining an actual office on each site is not practical. The same applies for power grids - you can't staff every substation with people. A remote operator can manage dozens of such sites, a single "local" person might be close to one point, but the next control point is going to be miles away, so you either need much, much more people to station one at every valve, or have a situation where flipping a switch in all the "sites" is very slow because requires the "local" person to drive many miles visiting each location. No, there's a reasonable objective need for this management to be actually remote - there's a discussion on how this should be implemented in a secure way, but it does have to be remote.

nbardy 6y ago

Agreed. Our companies are driven to increase profit at all cost. Even cost to their function and utility. Our over financialization is squeezing everyone and everything.

StandardFuture 6y ago
To clarify: this is not from "financialization" generally speaking. This is specifically from consolidation for the sake of increasing efficiency and thus margins (as you pointed out). This is opposed to increased competition (which also increases volatility) in the markets. The reason why the markets are so consolidated is because it removes short-term risk. If there is an obvious market and only one (or a few) companies involved then everyone makes money (magic, I know). This is why Wall Street lobbies for regulations so hard. They have ownership in all the existing major companies that can afford those regulations and it consolidates the profits (and thus returns). De facto Crony Capitalism at its finest. Your aristocratic oligarchs. So, stop giving your money to large index funds. (And every time there is a comment on HN telling you to, and there are plenty, downvote them and tell them a proper F-off). The idea that no one can/should ever lose is what is killing the economy. It got its birth in the boomer-retirement-fund markets of the past few decades. To recap, it is consolidation for margins that is the problem. That is not the same as general "financialization" (increased trading) that helps increase volatility in the markets and actually increases the size of the economy. We desperately need real markets and not this crony capitalism that seems self-persistent. The current system is such a marriage between corrupt politicians and wall street (which is now heavily extended into SV, btw) that it is absolutely disgusting.
- sarakayakomzin 6y ago
  > To clarify: this is not from "financialization" generally speaking. This is specifically from consolidation for the sake of increasing efficiency and thus margins (as you pointed out). ??? Can you give an example of governments that continue to give back to their "shareholders" once they decide they have enough military capacity?

wyager 6y ago

> if you are a critical service ... for each occurances 10% of your total revenue ... are forfeited You can achieve the same effect without all the arbitrary political decision-making inherent in this proposal by requiring these companies to buy delivery insurance or something. The insurance company will charge them proportionally to the risk of attack, which will internalize the cost.

rapind 6y ago
Like AIG insuring investments during the 2008 crisis? I think for critical infra you want some extra care and redundancy (not arbitrary though of course).

kingsuper20 6y ago

> That will get them serious about security. My guess is that they only get serious about security after a breach occurs. You can view it all as strengthening an immune system. Without attacks, and the occasional successful ones, nobody is going to bother to harden anything.

tbihl 6y ago
Is that like how the banks all got serious about evaluating their risk carefully after the first time [1] they saw their models, and consequently their liquidity, evaporate? Obviously I agree about your dissatisfaction with the other proposed solution: that just lets corporate entities put a low (10%) ceiling on what should be unlimited liability, allowing them to say that failing catastrophically by utter neglect to security is reliably a survivable offense (I recognize that in reality the liability of course ends at the dissolution of the corporation.) I don't know what the actual answer is. [1] https://en.m.wikipedia.org/wiki/List_of_economic_crises https://en.m.wikipedia.org/wiki/List_of_economic_crises
world_peace42 6y ago
I don’t think the analogy applies. We are humans, capable of observing the failures of others and making rational decisions to avoid those same failures. The immune system is programmed to react one specific way. For example, we can choose or choose not to go out of our way to get vaccinated. If someone doesn’t get vaccinated and infects a dozen other people and then get really sick themselves, it’s hard for me to have sympathy. Unfortunately here, when there’s an illness, millions of people have private information leaked. This should simply be an unacceptable.

surround 6y ago

> Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home.

rckoepke 6y ago
I would disagree with this. No petrochemical company I've worked with had OT/PLC/SCADA layers enabled for remote login. Other middle layers, like the historian, potentially. But not the control system itself. It's possible to enable this but knowing the culture at Colonial Pipeline first-hand, I strongly doubt they did this during COVID.

unethical_ban 6y ago

It's multi-dimensional. SCADA itself being networked, and it reaching other systems that may be internet-enabled. * What systems are affected by the hack? * Could the shutdown be needed because of critical data the ICS gets from business? * Or is it shut down because business needs real-time data from ICS it can't ingest? In general, the idea of completely isolating an ICS from any other network is a tough one. My question is, how often are these critical suppliers audited by the federal government? I have worked in banking cybersecurity and the amount of auditing from federal and state regulators is mind boggling. If a single company controls 45% of fuel transport to the east coast, it should carry some designation as a quasi-state entity subject to federal cybersecurity audits like banks.

bredren 6y ago
This question of missing cyber security audits came up for me in discussion of the Verkada hack. That’s the startup providing security cameras inside hospitals, prisons and schools. It seems like cybersecurity and audits of security readiness need to be demanded from any authority over companies operating in sensitive areas.

raggles 6y ago

They aren't 'on the internet'. They are connected via several layers of networks with firewalls etc in between to a system which has direct access to the internet. There often is no practical way around this - data from these networks needs to be shared with business users, other companies, regulators and so on. Data diodes can be applicable in some situations, but I've never worked with a company that uses one. I don't know the details of this situation, but demanding that it be impossible to compromise infrastructure networks is ridiculous. If you throw enough money and resources at it, no network is secure.

rckoepke 6y ago
Indeed the best evidence supporting this view is that Natanz was fully air-gapped and still got destroyed by the Stuxnet hack. That said I have heard of customers expressing desire to control valves and pumps using iPhones, and believe there are several initiatives at SCADA/PLC/DCS/System Integrator companies to provide this. However I've seen as many of those in practice as I have data-diodes, which is to say, none/never.

JumpCrisscross 6y ago

> US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited This sounds good in theory but suffers from the cobra effect [1]; you think you’re incentivising security. You’re actually pushing obscurity. Colonial preëmptively shut down its pipe to prevent physical damage. Attach a fine to the discovery and disclosure and you disincentivise that prudence. Better: make it easier for industry to build securely and incentivise redundancy. [1] https://en.m.wikipedia.org/wiki/Perverse_incentive#The_original_cobra_effect https://en.m.wikipedia.org/wiki/Perverse_incentive#The_origi...

ignoramous 6y ago
I reckon air-gapped networks are a valid defense. If something needn't be connected, why let it? It mitigates so many threats.
- arcticbull 6y ago
  Can an individual not accidentally or intentionally infect a computer not connected to the internet?
  - fennecfoxen 6y ago
    It's called Stuxnet, and it ruined 20% of Iran's uranium centrifuges. Which were air-gapped.
  - zaroth 6y ago
    Air gaps didn’t save Iran. Air gaps are just one layer in the onion.
    - bobmaxup 6y ago
      Is the argument that Iran was attacked on air-gapped network, so its not worth doing?

WalterBright 6y ago

> companies are chasing profits at any cost Government systems get hacked all the time, too. Just because the government doesn't have a profit motive doesn't change a long list of human motivations that can be counterproductive. The profit motive also incentivizes improved quality. If the product is bungled, the company is not likely to get the next contract. If the government agency bungles the product, they'll get a budget increase next time.

pasquinelli 6y ago
"If the product is bungled, the company is not likely to get the next contract."

JackFr 6y ago

> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. Make it a crime to pay the ransom in a ransomware attack. Make it a crime to fail to report a ransomware attack in a timely manner. Ransomware attacks (and companies with poor security practices) will go away.

hanniabu 6y ago
Just like all other laws that companies break, they'll just get a slap on the wrist and continue their ways
wutXthree 6y ago
>Make it a crime to fail to report a ransomware attack in a timely manner. You mean like "18 U.S. Code § 4 - Misprision of felony" [0]? [0] https://www.law.cornell.edu/uscode/text/18/4 https://www.law.cornell.edu/uscode/text/18/4
clarkmoody 6y ago
Make it a crime to possess, consume, or distribute substances that are bad for people. Make it a crime for people to knowingly withhold information about such activities from the authorities. Abuse of substances, trafficking, and associated criminality will go away. But seriously... > Make it a crime to pay the ransom in a ransomware attack. Ok, so ... what should a company do? File a report with some government agency or with an insurance company and wait until the bureaucratic process maybe results in being able to pay the ransom to resume business operations? Punishing the victim of a crime? Really? > Make it a crime to fail to report a ransomware attack in a timely manner. Further punishing the victim of a crime? Really? > Ransomware attacks (and companies with poor security practices) will go away. lol
- JackFr 6y ago
  I don’t see an analogy to drug laws. Is your point simply that such a law is impractical to enforce? Paying extortionists begets more extortion. The only argument I’m seeing is a bunch of hand waving and people telling me I’m being hopelessly naive. I don’t think I am.

ignoramous 6y ago

> It needs to be asked again, why are critical services on the Internet? From TFA: Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home... believe DarkSide bought account login details relating to remote desktop software like TeamViewer and Microsoft Remote Desktop.

gbear605 6y ago
So fast food workers were “essential workers” but oil pipeline control system engineers aren’t? Projects that require a security clearance have to be done from inside of a secure facility. This clearly needs to be the same level.

unclebucknasty 6y ago

>if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. The problem is that it matters less than we'd like to think how "serious they are about security". I'm seeing a lot of discussion about the responsibility of the victims to secure their networks, and it's mostly valid. But it's strange that we're talking about how to punish the victims versus the criminal conspirators. We virtually let the malicious, overtly criminal party off the hook. It's almost like we're saying we expect criminals to be criminals and these guys are so hard to catch that the onus is entirely on the targets to repel their incessant attacks, else they're negligently malicious themselves. Sure, most of these victims can do better in just about every case. But, people here know better than most how difficult it is to 100% secure every layer of the stack from software to firmware to hardware, with multiple vendors and vectors, OSS, zero days, etc. And the bad guys only have to be right once across this broad attack surface. It's impossible to defend completely. There will always be breaches. So, there's another element of this that has to be addressed, and that's getting serious about punishing these people. As it is, there's zero disincentive for them to just keep trying until they get through, but the upside is massive. Most if not all of this activity originates from nations that are adversarial towards the US. So, we need to start treating these instances as official sovereign actions, especially when they originate from nations wherein the government and their intelligence services exert control over (and outright sponsor) such criminal schemes, and wield these attacks as a projection of national power. These regimes also tend to feature oppressive criminal justice systems and harsh reprisals for even political dissidents. So, the message is, "we're not going to argue whether you're sanctioning these acts, but we're also not buying that you can't stop them, so we'll treat each incident as an official act of the state. We're holding you responsible for your criminals when they attack us and we will respond accordingly". Detailed discussion around exactly how the most recent exploit might be mitigated is interesting and useful. But the balance in these discussions between mitigation and reprisals for the perpetrators needs to be shifted much more towards the latter. Otherwise, we can expect these discussions ad infinitum.

m0llusk 6y ago

Critical services are on the Internet because they are provided by the lowest bidder.

rckoepke 6y ago
They are not always the lowest bidder. Colonial Pipeline was known for selecting the higher bids sometimes in order to ensure quality of work. They'd generally evaluate risk vs. quality vs. price. Colonial also kept multiple overlapping vendors for their last SCADA upgrade in order to make sure that no contractor was too overloaded during a "boom time". They'd generally stagger the work between locations (they had to upgrade dozens of stations along the pipeline) and keep track of the performance of everyone they hired and try to keep a steady workflow for everyone over a multi-year period. It was generally not about the lowest bid.

reedjosh 6y ago

Couldn't a service provider use an internet backbone with a one time pad comms protocol to essentially have a secure controls channel? Then once a year a rep could fly out a few terabytes of OTP to each location and all comms would be impenetrable. Sure beats a parallel physical comms system cost wise.

justin_oaks 6y ago
Maybe that'd make sense if it was the encryption that was broken. I wouldn't suggest a one-time pad for anything where modern encryption works just fine.

axiolite 6y ago

People whine about infrastructure being accessible over the internet, but in the old days it was just accessible over the phone network instead of the internet. It's not realistic for every bit of infrastructure to have the security protocols of military systems.

dheera 6y ago

Also, why do critical services run Microsoft systems?

throw_m239339 6y ago
The real question right here. When will the US government finally take Linux seriously and invest heavily in it instead of relying on Microsoft solutions?
- raggles 6y ago
  so then we rely on linux solutions instead? I've seen lots of control systems running linux and windows, personally I'd rather keep a mix of the two. Something about eggs and baskets.

jb775 6y ago

Lost revenue would be justified by execs as cost of doing business. And they'd probably buy hacker-insurance to cover some/all of that risk. They'd pay for the hacker-insurance by getting a shittier employee benefit plan, and cutting the employee 401k match by 2%. For each quarter they aren't hacked, they'd probably receive a credit from the hacker-insurance company, which would be distributed to execs via performance bonuses.

kingsuper20 6y ago

>We all know why, companies are chasing profits at any cost, I wonder if that's even true 100% of the time. It could simply be programmers + feature creep, bolting great wads of software to systems with small value on the margin. It would be interesting to talk to software people in the gambling business, you'd think that would be Ground Zero for nefarious attacks.