4 ms·

I think this is long overdue and virtually all posts in this thread seem to be generic, entirely contentless 'EU bureaucracy' rants. From the article: (i) it i

I think this is long overdue and virtually all posts in this thread seem to be generic, entirely contentless 'EU bureaucracy' rants. From the article: (i) it is designed to run with elevated privilege or manage privileges; (ii) it has direct or privileged access to networking or computing resources; (iii) it is designed to control access to data or operational technology; (iv) it performs a function critical to trust, in particular security functions such as network control, endpoint security, and network protection. (b) the intended use in sensitive environments, including in industrial settings[...] There's a clear distinction here between what the EU labels 'critical products' and non-critical software. Seeing the increasingly insecure global situation, the importance of software in infrastructure and the potential threats I think it's wild that something like this hasn't passed a decade ago. Digital infrastructure needs to be as secure as physical infrastructure. I wonder what would happen if some Heartbleed-esque bug that went undiscovered for years took out a huge chunk of a nation's electricity grid in a military conflict. What the EU needs in addition is if course also more funding for software security, but they're already doing a halfway decent job. If you didn't know, if you fix open source bugs in the EU you can get paid for doing just that: https://ec.europa.eu/info/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-jan-19_en https://ec.europa.eu/info/news/european-commissions-open-sou...

UncleEntity 4y ago
> it has direct or privileged access to networking or computing resources Sure, but what does “direct” mean in this context? My little IRC client library or a device driver in the kernel? Either one could be used in an exploit chain to take down the EU power grid. Theoretically, of course, because I don’t actually have an IRC lib and I don’t think it would be used to control a power grid if I did…at least I would hope so.
oytis 4y ago
It would be totally reasonable to require special certification for software running on critical infrastructure (is it not the case already by the way?). They are trying to blanket cover the whole market though which looks like another attempt to fight the market reality frankly, with predictable outcome.
ExoticPearTree 4y ago
The EU, in their misguided attempts to regulate everything, invented the NIS and NIS2 directives where the government can interfere in a company's security practices and tell it how to run its business. This is complete and utter non-sense. The sensible approach to so called critical infrastructure would be to just make a company provide free service for a number of days for every hour/day of downtime for preventable errors. Like say the power went out for an hour, you get 100kW of free electricity. You didn't have natural gas for 1 hour, you get 100cm of gas for free. And I find this approach better than having some random person from a government agency with a clipboard and a checklist fining you because you don't have antivirus on your phone or some other stupid thing like this. If there's a sophisticated cyber attack, then the utilities get to walk away scot-free. Just like the insurance company waives all liabilities in case of unforeseen circumstances like war & stuff.

UncleEntity 4y ago

> it has direct or privileged access to networking or computing resources Sure, but what does “direct” mean in this context? My little IRC client library or a device driver in the kernel? Either one could be used in an exploit chain to take down the EU power grid. Theoretically, of course, because I don’t actually have an IRC lib and I don’t think it would be used to control a power grid if I did…at least I would hope so.

oytis 4y ago

It would be totally reasonable to require special certification for software running on critical infrastructure (is it not the case already by the way?). They are trying to blanket cover the whole market though which looks like another attempt to fight the market reality frankly, with predictable outcome.

ExoticPearTree 4y ago

The EU, in their misguided attempts to regulate everything, invented the NIS and NIS2 directives where the government can interfere in a company's security practices and tell it how to run its business. This is complete and utter non-sense. The sensible approach to so called critical infrastructure would be to just make a company provide free service for a number of days for every hour/day of downtime for preventable errors. Like say the power went out for an hour, you get 100kW of free electricity. You didn't have natural gas for 1 hour, you get 100cm of gas for free. And I find this approach better than having some random person from a government agency with a clipboard and a checklist fining you because you don't have antivirus on your phone or some other stupid thing like this. If there's a sophisticated cyber attack, then the utilities get to walk away scot-free. Just like the insurance company waives all liabilities in case of unforeseen circumstances like war & stuff.