6 ms·

Colonial is being widely lambasted for a culture of absolutely lackadaisical security. Call me callous but numerous federal agencies exist to issue security be

Colonial is being widely lambasted for a culture of absolutely lackadaisical security. Call me callous but numerous federal agencies exist to issue security best practices and exploit announcements. numerous vendors also exist. play stupid games, win stupid prizes. Not paying the ransom would have been tantamount to complete dissolution of the company. it would have tirggered a much wider investigation into the company with shareholders abandoning it as the outage dragged on at the hands of an incompetent leadership. Unfortunately it seems to have been a Pyrrhic victory as paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...

HarryHirsch 5y ago
You'd damn well hope so. In civilized countries, when you leave the key in the ignition the cops will go after the thieves. The next thing that'll happen is that they'll also go after you because you just made the roads unsafe. And this isn't a car, this is infrastructure with national security implications. Someone needs to go and do time.
ethbr0 5y ago
If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods. This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry. If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment. Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.
- Miner49er 5y ago
  The market has already solved this in the form of ransomware groups. No need to have the government do it and issue a fine, ransomware groups literally are doing what you said. I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.
  - beardbandit 5y ago
    I'd rather the money and fines flow to the US government, not random hacker groups.
    - meepmorp 5y ago
      But the hacker groups let me pay in crypto.
- rini17 5y ago
  They could do it indirectly, by requiring insurance against security holes.
- kingaillas 5y ago
  >If the US were to be serious about corporate IT security What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications? Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should?? This just sounds like externalizing costs to the public while banking record private profits. How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.
  - miohtama 5y ago
    “Too big to fail” and investors do not get hurt. The problem does not fix itself until the investors start truly losing money, the care, unlike the Equifax case. Until the portfolio value cannot go down 90% there is not going to be a change in corporate actionism.
    - rawtxapp 5y ago
      They are starting to lose money, it's 5M$ today, who knows what it'll be tomorrow or how often it's going to happen.
  - dredmorbius 5y ago
    Self-regulation doesn't.
  - erosenbe0 5y ago
    Agree. The govt need not provide the teams as they must compete for talent like anyone else and don't have much to spare. The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.
TechBro8615 5y ago
I wasn’t aware of this policy. Is it totally apolitical or does the WH need to initiate the sanctions process? Consider the optics of sanctioning the domestic company providing your own country’s critical infrastructure, right after you spend a week discovering just how critical it really is.
dragonwriter 5y ago
> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury. Treasury doesn’t indict anyone, that’s Justice’s job.
nl 5y ago
> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury This (almost certainly) isn't true. It may put management at risk of sanctions, but shareholders are shielded by the corporate veil. I say "almost certainly" because in some cases prosecutors can go after shareholders, but this is limited to cases where a specific shareholder is involved in decision making. https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#United_States https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#Un...
njovin 5y ago
And yet Scripps healthcare in California is going on more than a week of all of their IT systems being down for the same reason and it’s disrupting operations enough that they’re diverting a incoming patients to other providers and a lot of their patients have no way of finding out whether their already-schedules procedures will still happen. Since healthcare is so heavily regulated it’ll be interesting to see what repercussions come of this. The company has been mostly silent on the matter despite it being severe enough that you can’t even get to their website.

HarryHirsch 5y ago

You'd damn well hope so. In civilized countries, when you leave the key in the ignition the cops will go after the thieves. The next thing that'll happen is that they'll also go after you because you just made the roads unsafe. And this isn't a car, this is infrastructure with national security implications. Someone needs to go and do time.

ethbr0 5y ago

If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods. This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry. If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment. Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.

Miner49er 5y ago
The market has already solved this in the form of ransomware groups. No need to have the government do it and issue a fine, ransomware groups literally are doing what you said. I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.
- beardbandit 5y ago
  I'd rather the money and fines flow to the US government, not random hacker groups.
  - meepmorp 5y ago
    But the hacker groups let me pay in crypto.
rini17 5y ago
They could do it indirectly, by requiring insurance against security holes.
kingaillas 5y ago
>If the US were to be serious about corporate IT security What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications? Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should?? This just sounds like externalizing costs to the public while banking record private profits. How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.
- miohtama 5y ago
  “Too big to fail” and investors do not get hurt. The problem does not fix itself until the investors start truly losing money, the care, unlike the Equifax case. Until the portfolio value cannot go down 90% there is not going to be a change in corporate actionism.
  - rawtxapp 5y ago
    They are starting to lose money, it's 5M$ today, who knows what it'll be tomorrow or how often it's going to happen.
- dredmorbius 5y ago
  Self-regulation doesn't.
- erosenbe0 5y ago
  Agree. The govt need not provide the teams as they must compete for talent like anyone else and don't have much to spare. The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.

TechBro8615 5y ago

I wasn’t aware of this policy. Is it totally apolitical or does the WH need to initiate the sanctions process? Consider the optics of sanctioning the domestic company providing your own country’s critical infrastructure, right after you spend a week discovering just how critical it really is.

dragonwriter 5y ago

> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury. Treasury doesn’t indict anyone, that’s Justice’s job.

nl 5y ago

> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury This (almost certainly) isn't true. It may put management at risk of sanctions, but shareholders are shielded by the corporate veil. I say "almost certainly" because in some cases prosecutors can go after shareholders, but this is limited to cases where a specific shareholder is involved in decision making. https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#United_States https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#Un...

njovin 5y ago

And yet Scripps healthcare in California is going on more than a week of all of their IT systems being down for the same reason and it’s disrupting operations enough that they’re diverting a incoming patients to other providers and a lot of their patients have no way of finding out whether their already-schedules procedures will still happen. Since healthcare is so heavily regulated it’ll be interesting to see what repercussions come of this. The company has been mostly silent on the matter despite it being severe enough that you can’t even get to their website.