4 ms·

That is going to be very hard to do given that in most companies IT Admins and even software devs are not really in control to make security and other choices,

by syshum 5y ago

That is going to be very hard to do given that in most companies IT Admins and even software devs are not really in control to make security and other choices, we present options to business leaders who make the choice. My guess that if you look at the vast majority of security incidents it is not due to negligence on the part of an IT Worker but instead due the business choices to prioritize some new feature, or performance, or anything else over security. If you put the liability on the head if the IT guy/gal who has been saying "hey that system is insecure" only to be ignored by the business well that is a real good way worsen the shortage in qualified people. I sure as hell am not going to assume legal liability over systems I do not really have control over.

chucksta 5y ago
Its not that hard, its up to the personnel to inform the company, and the company is liable. The book should be thrown twice as hard at a company which fails to acknowledge said IT. There is already SOX audit, and several others with clearly established rules and repercussions
- syshum 5y ago
  You are at odds with both the Parent comment, and the other people have that replied They are not talking about holding the companies responsible, they are wanting to establish standard of government licensure similar to that of a Doctor, or Civil Engineer, there by making the INDIVIDUAL responsible not the company.
  - chucksta 5y ago
    Yeah, the odds being there is no point to holding an individual accountable, due to the reasons the comment I relied to. Especially when there are already systems in place which would solve the issue much easier. All parent will do is institute more government organizations and insurance
setr 5y ago
> I sure as hell am not going to assume legal liability over systems I do not really have control over. That’s pretty much the goal, isn’t it? If everyone refuses to do the work without sufficient control, then power should shift accordingly (and your peers who continue to accept responsibility without control will eventually be eliminated from the system…). That is, the choice of security vs other priorities shouldn’t exist for certain classes of business/data, and sysadmins shouldn’t be doing that work without sufficient authority.
- syshum 5y ago
  The world is never that simple, and to put that simplistic lens on it will be a net negative. These types of regulatory burdens further serve to consolidate the world in the large corporations as they are the only ones that have the resources to either navigate them, or pay for loop holes to them for their particular business. The unintended consequences from that would be far worse than the security issues you hope to address
throwawaygh 5y ago
Accreditation and associated liability change this power dynamic. The struggle doesn't go away, but the dynamics do change. See how civil engineering works, for example.
midasuni 5y ago
If an architect designs a building that’s unsafe, they get serious consequences. If they design one that’s safe and the company ignores the design, doesn’t maintain it correctly, it’s the companies fault. From the article, both the architecture and the operation of the network was wrong - to the point that a kid in his bedroom could kill people with it. KPN and the judges asserted this network design and operation was a serious threat to human life. At the very least the health and safety authority should be shutting it down and arresting those responsible, and the CEO, CTO and CISO could then show how they weren’t responsible.

by syshum 5y ago

chucksta 5y ago

Its not that hard, its up to the personnel to inform the company, and the company is liable. The book should be thrown twice as hard at a company which fails to acknowledge said IT. There is already SOX audit, and several others with clearly established rules and repercussions

syshum 5y ago
You are at odds with both the Parent comment, and the other people have that replied They are not talking about holding the companies responsible, they are wanting to establish standard of government licensure similar to that of a Doctor, or Civil Engineer, there by making the INDIVIDUAL responsible not the company.
- chucksta 5y ago
  Yeah, the odds being there is no point to holding an individual accountable, due to the reasons the comment I relied to. Especially when there are already systems in place which would solve the issue much easier. All parent will do is institute more government organizations and insurance

setr 5y ago

> I sure as hell am not going to assume legal liability over systems I do not really have control over. That’s pretty much the goal, isn’t it? If everyone refuses to do the work without sufficient control, then power should shift accordingly (and your peers who continue to accept responsibility without control will eventually be eliminated from the system…). That is, the choice of security vs other priorities shouldn’t exist for certain classes of business/data, and sysadmins shouldn’t be doing that work without sufficient authority.

syshum 5y ago
The world is never that simple, and to put that simplistic lens on it will be a net negative. These types of regulatory burdens further serve to consolidate the world in the large corporations as they are the only ones that have the resources to either navigate them, or pay for loop holes to them for their particular business. The unintended consequences from that would be far worse than the security issues you hope to address

throwawaygh 5y ago

Accreditation and associated liability change this power dynamic. The struggle doesn't go away, but the dynamics do change. See how civil engineering works, for example.

midasuni 5y ago

If an architect designs a building that’s unsafe, they get serious consequences. If they design one that’s safe and the company ignores the design, doesn’t maintain it correctly, it’s the companies fault. From the article, both the architecture and the operation of the network was wrong - to the point that a kid in his bedroom could kill people with it. KPN and the judges asserted this network design and operation was a serious threat to human life. At the very least the health and safety authority should be shutting it down and arresting those responsible, and the CEO, CTO and CISO could then show how they weren’t responsible.