4 ms·

This is upside down. First - that vulnerabilities are 'known' does not mean any specific instance of vulnerability is 'known'. Second - that 'most attacks occ

by jasmer 4y ago

This is upside down. First - that vulnerabilities are 'known' does not mean any specific instance of vulnerability is 'known'. Second - that 'most attacks occur some other way' isn't hugely relevant. We don't 'not check the door locks' because most criminals 'go in through the window'. Having a government entity knock on the doors and remind folks that they have a problem gives the issue impetus, and even legitimacy within the organization aka instead of 'powerless IT figure from sector 8G' saying we have a problem, now, it's the Government saying 'you should to fix this' thereby giving execs the mandate to spend on it. This is exactly what the government should be doing - it's proportional, non-invasive, note hugely expensive or complicated, they're not making legal requirements here (because none are needed) etc.. Your litany of solutions is not comprehensive, moreover, item #5 'penalize those for not appropriately respond to bug bounty' is a bit glib - this would definitely be government overstepping their bounds. There are always bugs in software. Weighing the risk v. consequences is not something gov can do.

jollofricepeas 4y ago
Actually… Maybe you thought I made this stuff up but I just stated what the latest best practices and research shows for at least the last 3 years. 1. The specific vulns are known. We’re not talking about 0days here. 2. Attack vectors are completely relevant. Any security professional will tell you this. You may want to read up: - https://www.verizon.com/business/resources/reports/dbir/ https://www.verizon.com/business/resources/reports/dbir/ - https://zerotrust.cyber.gov/ https://zerotrust.cyber.gov/ - https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html?m=1 https://security.googleblog.com/2019/05/new-research-how-eff... - https://www.oecd.org/sti/consumer/37863861.doc https://www.oecd.org/sti/consumer/37863861.doc LASTLY… GDPR, SEC, HIPAA, NYDFS and NYSE all mandate risk management measures if not outright penalize companies and citizens for data breaches after the fact which unfortunately means your Grandmas Syphillis medication has to hit Twitter before there’s intervention. Without strong financial penalties or an impetus to fix at least critical vulns earlier we’ll continue with the status quo. I don't want that for you, your Grandma or my own. You shouldn’t want it either.

by jasmer 4y ago

jollofricepeas 4y ago

Actually… Maybe you thought I made this stuff up but I just stated what the latest best practices and research shows for at least the last 3 years. 1. The specific vulns are known. We’re not talking about 0days here. 2. Attack vectors are completely relevant. Any security professional will tell you this. You may want to read up: - https://www.verizon.com/business/resources/reports/dbir/ https://www.verizon.com/business/resources/reports/dbir/ - https://zerotrust.cyber.gov/ https://zerotrust.cyber.gov/ - https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html?m=1 https://security.googleblog.com/2019/05/new-research-how-eff... - https://www.oecd.org/sti/consumer/37863861.doc https://www.oecd.org/sti/consumer/37863861.doc LASTLY… GDPR, SEC, HIPAA, NYDFS and NYSE all mandate risk management measures if not outright penalize companies and citizens for data breaches after the fact which unfortunately means your Grandmas Syphillis medication has to hit Twitter before there’s intervention. Without strong financial penalties or an impetus to fix at least critical vulns earlier we’ll continue with the status quo. I don't want that for you, your Grandma or my own. You shouldn’t want it either.