4 ms·

The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security

by mlac 5y ago

The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that invested in security does not have strong market share or may have gone out of business. Or they invested, but not in the right areas, or there was a new attack through a zero day. They can be extremely competent in managing oil and gas (and the physical and operational safety that comes with it), but not be competent in Cybersecurity. It’s real, hard costs today for something that may or may not happen and paying for controls that might prevent an attack. In the best case, as a customer, nothing happens. Whether improving the likelihood that nothing happen is worth a $1 or $3 per barrel premium (or if that $2 is justified) is a hazy mess and hard to make a decision around.

panny 5y ago
>The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.
- User23 5y ago
  If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. It's impossible to prevent all attacks, physical or cyber, so at some point one needs to either submit to an order where attackers act with impunity, or otherwise invest in retribution.
  - mschuster91 5y ago
    > If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. For what it's worth, a couple weeks ago someone (according to a manifesto, an anarchist group) did exactly that in Munich - they set about 50 10 kV electricity cables that were laid bare due to construction works ablaze to strike against a military supplier and cut off about 20.000 households for over 36 hours until the utility managed to restore service: https://www.br.de/nachrichten/bayern/stromausfall-in-muenchen-bekennerschreiben-aufgetaucht,SYKlDag https://www.br.de/nachrichten/bayern/stromausfall-in-muenche... Sabotage or plain old theft against utilities is pretty common, but it's hard to do something physical that truly disrupts service for longer than a day or two - the networks are designed with reliability against all kinds of issues in mind. An IT-based attack leaves no traces if done well and can have a week to month long impact, simply because back when these networks were designed, IT threats were not existing.
- adventured 5y ago
  You're imagining what is essentially an impossible scenario, because your setup is factually badly wrong. The ransomeware attack in question wasn't capable of shuttering the pipeline as a target, whether the hackers wanted money or not. That was a voluntary action by the company, a questionable precaution they chose to take. The US military isn't directly restrained by that pipeline. They have their own fuel supply lines that do not particularly care about that specific pipeline. And even if they did, they can go to the source, they don't require that pipeline for fueling purposes. They have other means of mobilizing refueling, up to and including anything that is necessary from a transport, manpower and logistics standpoint (including commandeering approximately four zillion private fuel trucks and tankers to get fuel moving for defense purposes). There is no scenario where that pipeline existing or not existing tomorrow would shut down the US military or prevent its ability to defend against an impossible and amusingly implausible attempted land invasion of the US domestic territory. So, imagine if that was a nation state (uh, which one?) mobilizing for an invasion that can never happen, an invasion that could never get across the Atlantic or Pacific. No. Bombs start falling? From where? China? Russia? Russia is doing what, invading the east coast? With what ships? With what air cover? With what magical clandestine capability to hide a massive military as they sneak across the Atlantic on non-existent ships. With what aircraft carriers? And with China, so the US sends bombs back the other direction. The ability to throw a thousand nukes at China isn't restrained by the East Coast pipeline, and they know that, as does every other nation on the planet. Again, your setup is so far outside of reality that it's absurd.
  - mcguire 5y ago
    Two words: economic warfare.
- mlac 5y ago
  Pulling this thread: say the government regulates it - what do they require? Regulations that say you need to be secure enough to not be hacked? That requirement changes daily. Baseline security standards? Sure. But what is the baseline? And how influenced by lobbyists is that baseline? You know the big security companies would love to have their product be a government requirement. Attackers do not have regulations. They know the regulations and work around them. Makes it more difficult, but eventually they develop new attacks. So now you’ve got this government body making regulations that needs people who understand security to make the regulations, who then need some way to audit the companies to ensure compliance. The companies then have to focus on the audits and not on emerging threats, or do both, and it increases overhead. I’m not against government regulations when it is a good fit, but there are a lot of unintended consequences. The government is made up of people, too, and they may not be as close to the work to understand the optimal allocation of resources to minimize security risk.
  - throwaway3699 5y ago
    IT can't be looked at as a cost center anymore. The constant pressure of cost reduction is what causes these failures to happen in the first place, because nobody running the infrastructure really cares. If something goes wrong, they're out of a job anyway.
    - throwaway2037 5y ago
      This is an interesting point. If the relentless drive to reduce cost in IT is the root cause of so many corporate computer security issues, why isn't corporate accounting (which is covered in the US by near-draconian Sarbanes-Oxley rules) not similarly affected? I point to regulations. Further, would the same be true of giant pharma companies that create drugs that we ingest? ("Oh, skip those tests. If a few people get injured, we'll pay hush money.") Why don't we see it? Simple: Incredibly strong regulations in US/EU/Japan (the "big three" for global drug regulation & approval).
  - throwaway2037 5y ago
    Money laundering is a similarly difficult problem. Most of the rules are written in a "spirit" manner, instead of a "prescriptive" manner. With AML (anti-money laundering), you often hear the term "red flags". They are signs, but not a source of absolute truth. I could foresee something like AML in the form of corporate computer security coming soon. In the same way that Sarbanes-Oxley forever changed corporate accounting after the Worldcom and Enron accounting scandals of early 2000s (top execs now need to sign-off on yearly account) -- imagine if top execs need to sign-off on corporate computer security. As I see it, CTO-cum-head-of-security will soon be signing yearly audit documents in blood. And the trick to making AML regulations effective is massive fines -- fines so large that they genuinely affect quarterly earnings and stock prices. The same could be done with corporate computer security regulations.
- richardw 5y ago
  Or a foreign government paying more to not give back the data. Just for the economic impact. One that might be under sanctions from the target country, say.
- salawat 5y ago
  I'd actually be less worried about that to be honest. That type of mobilization puts out signals we're already well equipped to catch. The entire reason the pipeline hack is such a noteworthy event is that (and I truly believe this), someone was dumb enough to take a job bigger than their head. I don't think a nation state would have burned that opportunity by signaling their technical capability that way. Funnily enough, the pipeline hack and ransom wouldn't even be feasible without the advent of cryptocurrencies making the AML bypass feasible. As much as I despise those regulations in particular, I cannot argue with their efficacy.

by mlac 5y ago

panny 5y ago

>The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.

User23 5y ago
If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. It's impossible to prevent all attacks, physical or cyber, so at some point one needs to either submit to an order where attackers act with impunity, or otherwise invest in retribution.
- mschuster91 5y ago
  > If the goal was to disable the pipeline the attacker could just apply thermite somewhere along one of it's many unguarded miles. The reason that doesn't happen is because retribution for such an act would be striking to say the least. For what it's worth, a couple weeks ago someone (according to a manifesto, an anarchist group) did exactly that in Munich - they set about 50 10 kV electricity cables that were laid bare due to construction works ablaze to strike against a military supplier and cut off about 20.000 households for over 36 hours until the utility managed to restore service: https://www.br.de/nachrichten/bayern/stromausfall-in-muenchen-bekennerschreiben-aufgetaucht,SYKlDag https://www.br.de/nachrichten/bayern/stromausfall-in-muenche... Sabotage or plain old theft against utilities is pretty common, but it's hard to do something physical that truly disrupts service for longer than a day or two - the networks are designed with reliability against all kinds of issues in mind. An IT-based attack leaves no traces if done well and can have a week to month long impact, simply because back when these networks were designed, IT threats were not existing.
adventured 5y ago
You're imagining what is essentially an impossible scenario, because your setup is factually badly wrong. The ransomeware attack in question wasn't capable of shuttering the pipeline as a target, whether the hackers wanted money or not. That was a voluntary action by the company, a questionable precaution they chose to take. The US military isn't directly restrained by that pipeline. They have their own fuel supply lines that do not particularly care about that specific pipeline. And even if they did, they can go to the source, they don't require that pipeline for fueling purposes. They have other means of mobilizing refueling, up to and including anything that is necessary from a transport, manpower and logistics standpoint (including commandeering approximately four zillion private fuel trucks and tankers to get fuel moving for defense purposes). There is no scenario where that pipeline existing or not existing tomorrow would shut down the US military or prevent its ability to defend against an impossible and amusingly implausible attempted land invasion of the US domestic territory. So, imagine if that was a nation state (uh, which one?) mobilizing for an invasion that can never happen, an invasion that could never get across the Atlantic or Pacific. No. Bombs start falling? From where? China? Russia? Russia is doing what, invading the east coast? With what ships? With what air cover? With what magical clandestine capability to hide a massive military as they sneak across the Atlantic on non-existent ships. With what aircraft carriers? And with China, so the US sends bombs back the other direction. The ability to throw a thousand nukes at China isn't restrained by the East Coast pipeline, and they know that, as does every other nation on the planet. Again, your setup is so far outside of reality that it's absurd.
- mcguire 5y ago
  Two words: economic warfare.
mlac 5y ago
Pulling this thread: say the government regulates it - what do they require? Regulations that say you need to be secure enough to not be hacked? That requirement changes daily. Baseline security standards? Sure. But what is the baseline? And how influenced by lobbyists is that baseline? You know the big security companies would love to have their product be a government requirement. Attackers do not have regulations. They know the regulations and work around them. Makes it more difficult, but eventually they develop new attacks. So now you’ve got this government body making regulations that needs people who understand security to make the regulations, who then need some way to audit the companies to ensure compliance. The companies then have to focus on the audits and not on emerging threats, or do both, and it increases overhead. I’m not against government regulations when it is a good fit, but there are a lot of unintended consequences. The government is made up of people, too, and they may not be as close to the work to understand the optimal allocation of resources to minimize security risk.
- throwaway3699 5y ago
  IT can't be looked at as a cost center anymore. The constant pressure of cost reduction is what causes these failures to happen in the first place, because nobody running the infrastructure really cares. If something goes wrong, they're out of a job anyway.
  - throwaway2037 5y ago
    This is an interesting point. If the relentless drive to reduce cost in IT is the root cause of so many corporate computer security issues, why isn't corporate accounting (which is covered in the US by near-draconian Sarbanes-Oxley rules) not similarly affected? I point to regulations. Further, would the same be true of giant pharma companies that create drugs that we ingest? ("Oh, skip those tests. If a few people get injured, we'll pay hush money.") Why don't we see it? Simple: Incredibly strong regulations in US/EU/Japan (the "big three" for global drug regulation & approval).
- throwaway2037 5y ago
  Money laundering is a similarly difficult problem. Most of the rules are written in a "spirit" manner, instead of a "prescriptive" manner. With AML (anti-money laundering), you often hear the term "red flags". They are signs, but not a source of absolute truth. I could foresee something like AML in the form of corporate computer security coming soon. In the same way that Sarbanes-Oxley forever changed corporate accounting after the Worldcom and Enron accounting scandals of early 2000s (top execs now need to sign-off on yearly account) -- imagine if top execs need to sign-off on corporate computer security. As I see it, CTO-cum-head-of-security will soon be signing yearly audit documents in blood. And the trick to making AML regulations effective is massive fines -- fines so large that they genuinely affect quarterly earnings and stock prices. The same could be done with corporate computer security regulations.
richardw 5y ago
Or a foreign government paying more to not give back the data. Just for the economic impact. One that might be under sanctions from the target country, say.
salawat 5y ago
I'd actually be less worried about that to be honest. That type of mobilization puts out signals we're already well equipped to catch. The entire reason the pipeline hack is such a noteworthy event is that (and I truly believe this), someone was dumb enough to take a job bigger than their head. I don't think a nation state would have burned that opportunity by signaling their technical capability that way. Funnily enough, the pipeline hack and ransom wouldn't even be feasible without the advent of cryptocurrencies making the AML bypass feasible. As much as I despise those regulations in particular, I cannot argue with their efficacy.