4 ms·

I'll take it a few steps further than you. Legislation won't fix it. Until the military is authorized to start up a new branch of the military to redteam corpor

by sh34r 3y ago

I'll take it a few steps further than you. Legislation won't fix it. Until the military is authorized to start up a new branch of the military to redteam corporations, nothing will ever change. If they don't patch immediately, throw the entire C-suite in Gitmo under suspicion of being enemy combatants. Does that sound hyperbolic? It really shouldn't. These negligent corporate parasites are by far the greatest national security threat we've ever faced. bin Laden couldn't have dreamed of doing as much damage to the US as they have. China will hand us our asses on a silver platter if we ever go to war with them, because these rootless global capitalists have betrayed their country with every budget they've approved with 100x more given to stock buybacks than infosec. Taiwan better start reading Mao's little red book, because we don't stand a chance. Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It's just going to make it so no qualified person will ever take the CISO fall-guy position, only exacerbating the problem further. It's not the CISO's fault.

Cpoll 3y ago
> Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It might? In civil engineering it kind of works like this, doesn't it?
- sh34r 3y ago
  I don't believe professional engineers are held liable for a legacy bridge that they can't get funding to repair, or a project that was built in violation of their specifications by a corrupt contractor. They're only held liable when the engineering work is flawed.
- rjzzleep 3y ago
  It doesn't actually. It just means construction becomes extremely slow and backwards because engineering subcontracting firms now send unlimited amounts of construction delay notices to cover their asses when things are wrong and then ultimately still building the wrong and outdated things and leaving it up to the auditors later to fail the audit review to allow people into the building. So if your goal is to not have people die, you accomplished your mission, but if your goal was to make the project owner be responsible not to fuck up you still failed.
halJordan 3y ago
What you've described is essentially China, so no I can't agree with you. I can't imagine ever wanting to live in that world, but if you do it's never been cheaper to fly across the world.
- sh34r 3y ago
  The only similarity is that China holds corporate executives accountable. The idea isn't to backdoor every company like the CCP or the NSA and leave them sitting ducks, it's to make them close the backdoors. The country I'd point to for inspiration on this is actually Israel, a country even less deserving of praise than China in my opinion, but hey, good ideas can come from bad places. There's tight integration between the Israeli private cybersecurity sector and the Israeli military. Israel had a very prosperous tech industry, at least until the present constitutional crisis. The IDF trains cyber soldiers for four years, then the private sector hires them. You can't solve the cyber warfare problem without the military. Capitalism is structurally incapable of doing it alone, any more than Detroit's manufacturing plants could've defeated Japan without the military nationalizing them. Cyber policies and products without the military's direct involvement is like guns without bullets.

by sh34r 3y ago

Cpoll 3y ago

> Throwing the CISO in prison because the CEO/CFO won't fund infused isn't going to change anything. It might? In civil engineering it kind of works like this, doesn't it?

sh34r 3y ago
I don't believe professional engineers are held liable for a legacy bridge that they can't get funding to repair, or a project that was built in violation of their specifications by a corrupt contractor. They're only held liable when the engineering work is flawed.
rjzzleep 3y ago
It doesn't actually. It just means construction becomes extremely slow and backwards because engineering subcontracting firms now send unlimited amounts of construction delay notices to cover their asses when things are wrong and then ultimately still building the wrong and outdated things and leaving it up to the auditors later to fail the audit review to allow people into the building. So if your goal is to not have people die, you accomplished your mission, but if your goal was to make the project owner be responsible not to fuck up you still failed.

halJordan 3y ago

What you've described is essentially China, so no I can't agree with you. I can't imagine ever wanting to live in that world, but if you do it's never been cheaper to fly across the world.

sh34r 3y ago
The only similarity is that China holds corporate executives accountable. The idea isn't to backdoor every company like the CCP or the NSA and leave them sitting ducks, it's to make them close the backdoors. The country I'd point to for inspiration on this is actually Israel, a country even less deserving of praise than China in my opinion, but hey, good ideas can come from bad places. There's tight integration between the Israeli private cybersecurity sector and the Israeli military. Israel had a very prosperous tech industry, at least until the present constitutional crisis. The IDF trains cyber soldiers for four years, then the private sector hires them. You can't solve the cyber warfare problem without the military. Capitalism is structurally incapable of doing it alone, any more than Detroit's manufacturing plants could've defeated Japan without the military nationalizing them. Cyber policies and products without the military's direct involvement is like guns without bullets.