4 ms·

These digital networks and devices have become so complex we can’t reason about them, or in any case can’t easily reason about them given the resources availabl

These digital networks and devices have become so complex we can’t reason about them, or in any case can’t easily reason about them given the resources available to most of the organizations running them. However, from what I’ve seen, most of these attacks are successful because these organizations are simply neglecting best practices (e.g. patch management, whitelisting, security awareness training).

noduerme 5y ago
Mostly, they're neglecting training their employees to keep the business running when the software is down.
cyanydeez 5y ago
like everything else in america, #1 priority is fèeding ceo salary and shareholder value. everything in corporate america is derived from the growing wealth inequality and these shake downs are precisely targetting the glut. soon enough, itll still be cheaper to have a bribe fund, just like tax evasion lawyers, lobbiests and the rest of the feeder classes than a holisitic defense.
- test_epsilon 5y ago
  This is a tiresome, meaningless religious mantra nowadays. Yes there is corruption. No not everybody is corrupt. No it does not only exist in USA nor is USA anywhere near the worst. No you can't blame anything and everything you don't like on corruption and greed.
  - deleted 5y ago
    [deleted]
  - FractalHQ 5y ago
    Perhaps, but of all the leading developed nations on Earth, the US has a particularly corrupt government that sells itself to the highest bidder thanks to Citizens United and armies of lobbyists. Our healthcare, prison, and student loan systems, for example, prey on US citizens without repercussions at lengths that don’t fly in most developed countries. I think it’s safe to say that corruption and greed are at the root of most problems in the US, and it’s important to call it like it is.
    - test_epsilon 5y ago
      Yes yes I know the scriptures, and yes I'm possessed by the secular-devil (who is that today? Putin? Hitler? Trump?) for not unthinkingly reciting them verbatim.
    - read_if_gay_ 5y ago
      > of all the leading developed nations on Earth, the US has a particularly corrupt government that sells itself to the highest bidder I would contend with that. The US government is just very visible. I know HN likes to glorify European nations but we're really really good at wasting taxpayer money, too. It's just less lobbying and more knowing the right people here.
    - noduerme 5y ago
      Market capitalism is greedy and brutal, but the discussion here is about ransomware, which is one of the things the market should be well equipped to solve. Rather than throwing broad shade at the system in general, consider the opportunity here. Faced with a threat to the increasing automation they rely on for YoY growth, corporations could react by ensuring better job security and higher pay, better workplace conditions and better training, to create more resilience. The market could support those shifts if they see the danger of relying totally on non-human decision making at the local level. The Russians might even be doing us a favor if we're adaptable enough to take advantage of what we're learning from it.
    - aksss 5y ago
      Oh, you’re one of the kids who thinks that the US had less regulatory capture and influence peddling before Citizens United. That is not how it was at all. Money simply follows the path of least resistance.
- kortilla 5y ago
  Such a brave meme. It might carry some water if the same problem didn’t apply to every country with both open and closed source projects.
- dehrmann 5y ago
  These particular decisions are driven more by compliance and CYA. It only feeds into executive compensation as executives avoiding getting fired. Even if you're the executive who approved this integration, you'll just say "I chose a known vendor with a respectable client list."
mac-chaffee 5y ago
> or in any case can’t easily reason about them given the resources available to most of the organizations running them. I really feel this. Any new piece of software needs a level of ongoing maintenance that no one seems to realize, not even many software engineers I've worked with. You can't "just" toss a binary onto a VM and forget about it. But all the work required to secure that and keep it secure is so invisible to management. And because the work is invisible, it might even hamper career growth. So good luck getting either management or devs to prioritize all the security tasks they should be prioritizing.

noduerme 5y ago

Mostly, they're neglecting training their employees to keep the business running when the software is down.

cyanydeez 5y ago

like everything else in america, #1 priority is fèeding ceo salary and shareholder value. everything in corporate america is derived from the growing wealth inequality and these shake downs are precisely targetting the glut. soon enough, itll still be cheaper to have a bribe fund, just like tax evasion lawyers, lobbiests and the rest of the feeder classes than a holisitic defense.

test_epsilon 5y ago
This is a tiresome, meaningless religious mantra nowadays. Yes there is corruption. No not everybody is corrupt. No it does not only exist in USA nor is USA anywhere near the worst. No you can't blame anything and everything you don't like on corruption and greed.
- deleted 5y ago
  [deleted]
- FractalHQ 5y ago
  Perhaps, but of all the leading developed nations on Earth, the US has a particularly corrupt government that sells itself to the highest bidder thanks to Citizens United and armies of lobbyists. Our healthcare, prison, and student loan systems, for example, prey on US citizens without repercussions at lengths that don’t fly in most developed countries. I think it’s safe to say that corruption and greed are at the root of most problems in the US, and it’s important to call it like it is.
  - test_epsilon 5y ago
    Yes yes I know the scriptures, and yes I'm possessed by the secular-devil (who is that today? Putin? Hitler? Trump?) for not unthinkingly reciting them verbatim.
  - read_if_gay_ 5y ago
    > of all the leading developed nations on Earth, the US has a particularly corrupt government that sells itself to the highest bidder I would contend with that. The US government is just very visible. I know HN likes to glorify European nations but we're really really good at wasting taxpayer money, too. It's just less lobbying and more knowing the right people here.
  - noduerme 5y ago
    Market capitalism is greedy and brutal, but the discussion here is about ransomware, which is one of the things the market should be well equipped to solve. Rather than throwing broad shade at the system in general, consider the opportunity here. Faced with a threat to the increasing automation they rely on for YoY growth, corporations could react by ensuring better job security and higher pay, better workplace conditions and better training, to create more resilience. The market could support those shifts if they see the danger of relying totally on non-human decision making at the local level. The Russians might even be doing us a favor if we're adaptable enough to take advantage of what we're learning from it.
  - aksss 5y ago
    Oh, you’re one of the kids who thinks that the US had less regulatory capture and influence peddling before Citizens United. That is not how it was at all. Money simply follows the path of least resistance.
kortilla 5y ago
Such a brave meme. It might carry some water if the same problem didn’t apply to every country with both open and closed source projects.
dehrmann 5y ago
These particular decisions are driven more by compliance and CYA. It only feeds into executive compensation as executives avoiding getting fired. Even if you're the executive who approved this integration, you'll just say "I chose a known vendor with a respectable client list."

mac-chaffee 5y ago

> or in any case can’t easily reason about them given the resources available to most of the organizations running them. I really feel this. Any new piece of software needs a level of ongoing maintenance that no one seems to realize, not even many software engineers I've worked with. You can't "just" toss a binary onto a VM and forget about it. But all the work required to secure that and keep it secure is so invisible to management. And because the work is invisible, it might even hamper career growth. So good luck getting either management or devs to prioritize all the security tasks they should be prioritizing.