It's hard because "we've been doing it this way all the time and nothing happened" is what I hear most of the times. Most of the times I still "sneak" in impro

It's hard because "we've been doing it this way all the time and nothing happened" is what I hear most of the times. Most of the times I still "sneak" in improvements where I can without disturbing operations but the whole thing needs a proper overhaul and it always is, as we say here: "a dance on the razor blade". What I hear from other colleges and contractors in the sector: it doesn't look better there. I don't want to leave out that there is a certain amount of IT personal which is responsible for it too. Most of them older guys (yes...they really are all guys) who also follow the mantra I mentioned above. There is hope though...there is a certification requirement coming up here in Germany. It covers most of the basic security measures. We fail to cover a significant part of it. We've just passed one of the deadlines. Two are coming up and than there is a certification process. I've presented management with the measures we'd have to take to fulfil those. They've been ignored. The whole issue is being actively ignored or played down. The day will come when it'll be too late and I wonder what will happen. Wouldn't be surprised if I lose my job about it since somebody will have to be blamed or the certification issue will be "made to work out" somehow. Seen that happening before.