4 ms·

So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? We have law enforcement so everyone can be fr

So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t

throwawaygh 6y ago
> So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? First, in many jurisdictions, paying protection money for physical security is illegal. Second, Colonial Pipeline has an operating revenue of $1.32 billion. I suppose in the USA it's technically a person, but... it's not actually a person. > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t I submit that oil pipeline operators, hospitals, and large corps are part of that 1%.
- FredPret 6y ago
  You have a point. They should do minimum due diligence to harden their networks. However... how much do you want to bet that the CEO of a pipeline company has the knowledge to make this happen? One has to be an intelligent customer to make something like this happen.
  - WJW 6y ago
    Well then, perhaps there should be minimum requirements to become CEO of a large corporation in regulated areas like pipelines? If the alternative is large harm to the public, this seems like a no-brainer to me for future legislation.
    - FredPret 6y ago
      It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.
    - briandear 6y ago
      So should the president of the United States be an expert on tactical jet engines? And also have a PHD in economics? And also be an expert in immunology? And power plant operations? How about the national airspace system? People are quick to conclude that Colonial’s security was “bad.” But do we know that to be true? A sophisticated, potentially state-sponsored organization initiated this attack. The best security in the world is not 100% secure. It might be wise to get the facts before rushing to judgement.
  - Siira 6y ago
    He's a CEO. His job is to ask others to find him the experts needed and manage them. He doesn't need to know any actual security engineering.
    - FredPret 6y ago
      He needs to know the basics. How does he know someone is a real expert?
- Vrondi 6y ago
  So, you are saying that there are jurisdictions where home security systems are illegal? Night watchmen/security guards and body guards are illegal? Where would these jurisdictions be located?
  - throwawaygh 6y ago
    I don't think that's even close to what I'm saying. I'm not even really sure what you are trying to communicate here; are you insinuating that ADT or Ring hire roving bands of bandits who break into houses that aren't protected by their security systems? If not, I genuinely don't know what you're trying to say here.
nradov 6y ago
That's a non sequitur. Certainly law enforcement should aggressively pursue criminals who engage in assault, burglary, and extortion. But that has nothing to do with paying off ransomware gangs.
- FredPret 6y ago
  Yes it does, it’s a crime, in this case a class of crime perpetrated, prosecuted, and prevented by experts. It falls under law enforcement
dumpsterdiver 6y ago
> We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. No, that's why we have division of labor. Law enforcement is just another brick in the wall. If a company is already making massive profits from the public by running critical services, why should tax payers fund their lack of diligence? Should we just fund their entire payroll while we're at it?

throwawaygh 6y ago

> So let people who aren’t experts at physical security suffer break-ins, and physically weak people get beaten up? First, in many jurisdictions, paying protection money for physical security is illegal. Second, Colonial Pipeline has an operating revenue of $1.32 billion. I suppose in the USA it's technically a person, but... it's not actually a person. > We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. I love security but 99% of people don’t, and shouldn’t I submit that oil pipeline operators, hospitals, and large corps are part of that 1%.

FredPret 6y ago
You have a point. They should do minimum due diligence to harden their networks. However... how much do you want to bet that the CEO of a pipeline company has the knowledge to make this happen? One has to be an intelligent customer to make something like this happen.
- WJW 6y ago
  Well then, perhaps there should be minimum requirements to become CEO of a large corporation in regulated areas like pipelines? If the alternative is large harm to the public, this seems like a no-brainer to me for future legislation.
  - FredPret 6y ago
    It’s probably cleaner and easier to run this if the spooks set up a bureau of cyber security standards and fine strategically important companies for non-compliance. The gov can do security audits on these corps.
  - briandear 6y ago
    So should the president of the United States be an expert on tactical jet engines? And also have a PHD in economics? And also be an expert in immunology? And power plant operations? How about the national airspace system? People are quick to conclude that Colonial’s security was “bad.” But do we know that to be true? A sophisticated, potentially state-sponsored organization initiated this attack. The best security in the world is not 100% secure. It might be wise to get the facts before rushing to judgement.
- Siira 6y ago
  He's a CEO. His job is to ask others to find him the experts needed and manage them. He doesn't need to know any actual security engineering.
  - FredPret 6y ago
    He needs to know the basics. How does he know someone is a real expert?
Vrondi 6y ago
So, you are saying that there are jurisdictions where home security systems are illegal? Night watchmen/security guards and body guards are illegal? Where would these jurisdictions be located?
- throwawaygh 6y ago
  I don't think that's even close to what I'm saying. I'm not even really sure what you are trying to communicate here; are you insinuating that ADT or Ring hire roving bands of bandits who break into houses that aren't protected by their security systems? If not, I genuinely don't know what you're trying to say here.

nradov 6y ago

That's a non sequitur. Certainly law enforcement should aggressively pursue criminals who engage in assault, burglary, and extortion. But that has nothing to do with paying off ransomware gangs.

FredPret 6y ago
Yes it does, it’s a crime, in this case a class of crime perpetrated, prosecuted, and prevented by experts. It falls under law enforcement

dumpsterdiver 6y ago

> We have law enforcement so everyone can be free to focus on their own value-add in life without having to learn 1000 skills to cover their own ass. No, that's why we have division of labor. Law enforcement is just another brick in the wall. If a company is already making massive profits from the public by running critical services, why should tax payers fund their lack of diligence? Should we just fund their entire payroll while we're at it?