8 ms·

Because proper cybersecurity should be treated as a cost of business, unlike the use of force which is an exclusive prerogative of the state. If large companies

by axlee 5y ago

Because proper cybersecurity should be treated as a cost of business, unlike the use of force which is an exclusive prerogative of the state. If large companies want the state to step in to absorb some of their costs, they should stop trying to avoid contributing to said state at every step of the way. If said public involvement came at the cost of partial ownership of companies requiring it, with complete disclosure of their financials including offshore, I would not mind at all. I am simply extremely tired of corporations running to daddy at every inconvenience - sometimes of their own doing - while actively trying to crash the whole system into the ground by starving it. You can't have your cake and eat it too.

3GuardLineups 5y ago
public ownership of tech companies is the last thing we need. I'm with you on paying their taxes, but partial public ownership is a bridge too far
ineedasername 5y ago
That assumes all cyber threats can be averted by private corporations. It's difficult for a company to play effective defense against nation-state levels of cyber attack R&D. Yes, companies need better security than they have now, but they cant do it without help.
- axlee 5y ago
  This is where the threat of retaliation comes in as a deterrent, and the country should be equipped to do so. But publicly subsidizing private cybersecurity is both impractical (how would that work exactly?) and would encourage underspending even further. Why do you think China or Russia prefer to hack foreign private competitors rather than sending a bunch of missiles on their infrastructure?
  - ineedasername 5y ago
    We publicly subsidize every other kind of security to some degree already. A company might have security guards, but police are certainly going to be there to provide a baseline policing the neighborhood, respond to calls, etc. And security via threat of retaliation does not sound like a practical or effective solution either: we already have plenty of capabilities in that area, and it didn't stop east coast oil & gas infrastructure from going down or a sizeable portion of the nation's meat processing from going the same way. These attacks are escalating rapidly, and relying in the free market to find a solution doesn't look like it's going to happen fast enough. This needs to be a national, not (just) a private corporate issue because of the enormous national security implications involved in cyber attacks against infrastructure. When a single company's security failure can cause national chaos, there needs to be a nation-level approach to this.
    - axlee 5y ago
      Then how about nationalizing that infrastructure, if it is so crucial for national security and the private sector is unwilling to spend enough to protect itself against threats? Let's not kid ourselves: this is first and foremost a matter of incentives and consequences rather than a lack of capabilities. I don't see what the public could do better than private entities, besides absorbing their costs. The only way I can see it practically working is if the private sectors would allow government entities full access to their IT infrastructure, submit themselves to random controls, audits and checks, and bear sizeable fines if they're found to be negligent.
      - ineedasername 5y ago
        The government could set & enforce standards for levels of security and disaster recovery, especially if critical systems. It could not just research but also pass on knowledge of vulnerabilities. I don't expect the government to actually run the security. I expect the government to provide the framework and tools so that everyone doesn't have to figure it out on their own.
      - Ericson2314 5y ago
        Yes thank you for your responses. People wine but we're clearly pathetic as an industry, limping along with Unix etc. We know so much about how to build better systems, and yet it's more bandages on the status quo, all the while increasing complexity which makes things largely futile. Unlike "real war", cyber defense also gets to design the battlefield, everytime time. There will always be social attacks, but the stupid C and Unix stuff that is the bread & butter today is completely preventable
- ixacto 5y ago
  The feds can’t even secure all their own systems. We had the OPM hack which resulted in the personal information of federal employees exfultrated who knows where. Also the federal government were still using passwords that were exposed in the breach 3 years after https://www.forbes.com/sites/leemathews/2018/11/15/office-of-personnel-management-still-vulnerable-3-years-after-massive-hack/ https://www.forbes.com/sites/leemathews/2018/11/15/office-of.... Tbh I trust the FAANG companies to run better security. Government is incompetent in this area.
  - ineedasername 5y ago
    Many times it's not the government securing their systems, they've outsourced it to places like SolarWinds. Maybe they would do a better job if political pressure didn't push for more and more privatization of critical operations.

by axlee 5y ago

3GuardLineups 5y ago

public ownership of tech companies is the last thing we need. I'm with you on paying their taxes, but partial public ownership is a bridge too far

ineedasername 5y ago

That assumes all cyber threats can be averted by private corporations. It's difficult for a company to play effective defense against nation-state levels of cyber attack R&D. Yes, companies need better security than they have now, but they cant do it without help.

axlee 5y ago
This is where the threat of retaliation comes in as a deterrent, and the country should be equipped to do so. But publicly subsidizing private cybersecurity is both impractical (how would that work exactly?) and would encourage underspending even further. Why do you think China or Russia prefer to hack foreign private competitors rather than sending a bunch of missiles on their infrastructure?
- ineedasername 5y ago
  We publicly subsidize every other kind of security to some degree already. A company might have security guards, but police are certainly going to be there to provide a baseline policing the neighborhood, respond to calls, etc. And security via threat of retaliation does not sound like a practical or effective solution either: we already have plenty of capabilities in that area, and it didn't stop east coast oil & gas infrastructure from going down or a sizeable portion of the nation's meat processing from going the same way. These attacks are escalating rapidly, and relying in the free market to find a solution doesn't look like it's going to happen fast enough. This needs to be a national, not (just) a private corporate issue because of the enormous national security implications involved in cyber attacks against infrastructure. When a single company's security failure can cause national chaos, there needs to be a nation-level approach to this.
  - axlee 5y ago
    Then how about nationalizing that infrastructure, if it is so crucial for national security and the private sector is unwilling to spend enough to protect itself against threats? Let's not kid ourselves: this is first and foremost a matter of incentives and consequences rather than a lack of capabilities. I don't see what the public could do better than private entities, besides absorbing their costs. The only way I can see it practically working is if the private sectors would allow government entities full access to their IT infrastructure, submit themselves to random controls, audits and checks, and bear sizeable fines if they're found to be negligent.
    - ineedasername 5y ago
      The government could set & enforce standards for levels of security and disaster recovery, especially if critical systems. It could not just research but also pass on knowledge of vulnerabilities. I don't expect the government to actually run the security. I expect the government to provide the framework and tools so that everyone doesn't have to figure it out on their own.
    - Ericson2314 5y ago
      Yes thank you for your responses. People wine but we're clearly pathetic as an industry, limping along with Unix etc. We know so much about how to build better systems, and yet it's more bandages on the status quo, all the while increasing complexity which makes things largely futile. Unlike "real war", cyber defense also gets to design the battlefield, everytime time. There will always be social attacks, but the stupid C and Unix stuff that is the bread & butter today is completely preventable
ixacto 5y ago
The feds can’t even secure all their own systems. We had the OPM hack which resulted in the personal information of federal employees exfultrated who knows where. Also the federal government were still using passwords that were exposed in the breach 3 years after https://www.forbes.com/sites/leemathews/2018/11/15/office-of-personnel-management-still-vulnerable-3-years-after-massive-hack/ https://www.forbes.com/sites/leemathews/2018/11/15/office-of.... Tbh I trust the FAANG companies to run better security. Government is incompetent in this area.
- ineedasername 5y ago
  Many times it's not the government securing their systems, they've outsourced it to places like SolarWinds. Maybe they would do a better job if political pressure didn't push for more and more privatization of critical operations.