5 ms·

Whenever I see the phrase "investment in cybersecurity", I sigh a little bit. It's nice to spend money on important things, and you can seldom improve anything

Whenever I see the phrase "investment in cybersecurity", I sigh a little bit. It's nice to spend money on important things, and you can seldom improve anything without spending money on it. But cybersecurity is one of the things that you can't improve just by enlarging its budget. You build a culture. You hire personnel who care about it. You train your employees. You set policies and establish structures. You can't just purchase a "deluxe cybersecurity firewall appliance" and plug it into your network, even if it costs $50,000. I bet that a lot of people believe that's what it takes, though. Compare this to, say, education funding. It's good to spend more money on schools, right? I mean, teachers gotta be paid, students need (Chrome)books. But I always vote "no" on municipal school bond measures. I believe that money isn't everything, and I believe that it funds the wrong kind of things. The measures always pass, though, so don't worry, I'm not oppressing all the little kids in town.

jlund-molfese 3y ago
The government only has so many levers it can pull, though. Even if we, the enlightened of HN have some idea of which investments are beneficial (for example, hiring a good CISO instead of buying the $50K cybersecurity box), laws and policies move too slowly and are too hard to change once enacted. So this situation still seems better than a rule which only benefits companies that hire Cisco Certified Security Posture Experts or something. There's at least a chance that some of these companies have competent CTOs (or equivalents, at smaller utilities) and will spend in the right area.
- balderdash 3y ago
  Government has plenty of levers to pull - they just don’t pull them. Want to have utilities (or any industry) put cyber security front of mind? Just tell them that they are liable for consequential damages for any service outages related to a cyber security incident, and watch how good they get at cybersecurity.
  - 0xBDB 3y ago
    Government absolutely does pull those levers. I think people underestimate how closely utilities are regulated. It's a monopoly after all. The government tells them annually what their profit for the coming year will be. The state public utility / service commission determines how much profit a utility is allowed to make (really it's return on equity) based on federal guidelines. Every year the utility must make a rate case that includes what it's going to spend and why and why its shareholders deserve to get anything on top of that. If the utility has misbehaved that RoE number can literally be zero, though this would be rare. Punitive profit slashing (not quite that extreme) has definitely happened for major customer-facing IT issues and would probably happen for a major breach.
candiddevmike 3y ago
All I see here is a government subsidy for security vendors. I'd rather see more liability and insurance requirements for security breaches, including personal liability for executives. Whatever it takes to get past checkbox-driven security.
- gtowey 3y ago
  And schools are just a subsidy for the textbook industry. Regulation & incentives are literally the tools governments have to shape policy. It's a start, but moving the needle on issues can be hard, slow work -- especially when it seems like so many people have the attitude that if a particular action wasn't the their perfect, preferred solution, then it shouldn't have been done at all.
  - hedora 3y ago
    In your analogy, the vendors are the people manufacturing textbooks that are mandatory, but never get opened and cannot be resold on the used market. The regulators are the administrators (or whoever) that require the useless textbooks. Of course, there are many useful textbooks with none of the above properties, but they don’t require complicated incentive structures to ensure they’re made mandatory.
halJordan 3y ago
This is intensely defeatist. Regulations and compliance are essentially what you described and they work for banks (despite the clever responses I'm sure are incoming). For the critical industry sectors they need to be buying the 50k appliance. And they need to be looking at a checklist that they only want to complete to avoid fines. Culture will accrete later.
- hedora 3y ago
  I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security appliances. Everyone involved correctly comes to the conclusion that the company’s security policy is purely performative. The people that care leave. The people that don’t care about securing the system implement the useless checkboxes and put the standalone box in the correct room (and might even plug it in), then get promoted. FIPS security certifications are the poster child for this. There’s basically no way to get a securely architected system certified, so you end up adding vulnerabilities and (in the best case) a configuration parameter like the old “enable FIPS certification (default off; do not enable unless you are required to do so)” button from windows.
- kortilla 3y ago
  50k appliance doesn’t do shit if people work from their personal laptop and use shared passwords. The only thing a regulation that mandates a 50k appliance will do is boost the appliance makers sales.
  - hinkley 3y ago
    An appliance also externalizes responsibility. I don’t need to think of anything, because we have the box that goes, “ping”.
- Veserv 3y ago
  It emphatically does not work for banks. They spend hundreds of millions of dollars a year and any bank CISO would tell you, off the record, that their systems could be completely breached for less then a million dollars. That is not because they suck at doing it, that is because commercial cybersecurity is just plain garbage. That is literally the best you can get no matter how much you spend and no matter how “good” your people are if you use commercial IT security practices. Nobody does better than that who uses anything from a big brand cybersecurity vendor. The only reason banks are not totally wrecked by cyberattacks is that: 1) They actually are being constantly attacked by ransomware and the like, they just do not disclose it; I do not remember the budget line item the payments all go under but it is one of those compliance/administrative ones such as for insurance. 2) Cyberattacks, contrary to their standard portrayal as always being run by “state-sponsored” groups to make the companys being destroyed look better, are largely run by kids. They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.e. do not know how to use say investment bank deal details to do effective trades), and how to actually cash out large amounts of money undetectably. 3) The non cybersecurity processes and fraud detection are actually fairly effective. There are large number of accounting checks in place that make it very hard to do simple hacks (like make the numbers in one account higher) that can not be detected. Banks have the equivalent of very complex, bespoke DRM systems that requires knowledge of financial systems and of their internal processes to crack. As I said before, the hackers are largely financially unsophisticated, so it is very hard for them to do this. No, it is intensely defeatist to just give up on actually solving the problem and demanding useless security theater in the vain hopes that it will somehow improve the situation.
enkid 3y ago
Money isn't everything, but it's really hard to run an effective school or cyber security enterprise without money.
- piuantiderp 3y ago
  This is lost to many in the West. There are things you cannot buy or strong arm your way out
- NoZebra120vClip 3y ago
  Well that's a strawman. I've seen churches, corporations, and families being run on amazing shoestring budgets, but you couldn't tell from the outside, because the holder of the purse strings was judicious about spending. Years ago, I learned a peculiar thing about corporate or municipal budgets: sometimes a line item has to be spent or it won't come back next year. So there is often some strong impetus to spend $XXX,XXX -- or else -- and the deadline comes on June 30, and often that is how you arrive at bad spending decisions, because it's "burning a hole in your pocket".
  - enkid 3y ago
    That's not what the word strawman means.
    - NoZebra120vClip 3y ago
      "it's really hard to run an effective school or cyber security enterprise without money." GP is actually understating this; if my budget and revenue is $0, then I cannot run a school or enterprise at all and it will file for bankruptcy and close. A strawman is the informal fallacy of refuting an argument different from the one being discussed. I never said that a budget should be $0 or "without money". That's a reductio ad absurdum.
evanreichard 3y ago
So just be smart about how you spend your money? Like any other department?
- balderdash 3y ago
  It’s not about smarts it’s about incentives, if I’m incentivized to buy cybersecurity equipment but there is no incentive or penalty for not actually preventing cybersecurity breaches, a whole bunch of stuff is going to be bought with little effect.
bojo 3y ago
Having helped implement NIST 800-171 for a small enterprise company preparing to work prime government contracts I can assure you it costs money either way. Time and money spent working with cybersecurity professionals writing SOG/SOPs which map the business practices to the standard. Money spent buying and setting up some of the necessary equipment to handle CUI properly. Time (indirectly money) spent redoing decades old business processes to map to the new paradigm. Time (indirectly money) as the business spent time training their staff up on the components relevant to their business units. I agree that building a culture is at the root of it, however, that culture alone isn't going to move the needle unless everything else is in place as well. Worse, you have to walk the company through the 5 phases of grief because in general people don't entirely understand what is actually going on and why it's important. "So you can get government prime contracts" is an easy answer, but doesn't erase the confusion behind all of the hand-wavy procedural work required to execute them.
- konschubert 3y ago
  I'm not convinced that implementing cybersecurity standards actually improves security.
  - bojo 3y ago
    No disagreements there. What's a better answer though? No one wants to do it, most non-tech people don't understand it, yet the standards and procedures need to improve to reduce the attack surface area - especially for businesses which support critical infrastructure.
    - konschubert 3y ago
      You could legally mandate companies to insure themselves against cybersecurity risks. It's really an interesting idea: https://www.cato.org/sites/cato.org/files/serials/files/regulation/2013/3/v36n1-10.pdf https://www.cato.org/sites/cato.org/files/serials/files/regu... This creates a "market for effective practices", because companies that follow good security practices would get cheaper insurance. But it would allow insurances and companies to figure out dynamically what is cost effective and what isn't. There would be lots of financial incentive to figure out what protects you effectively and what is just security theatre.
mac-chaffee 3y ago
> You can't just purchase a "deluxe cybersecurity firewall appliance" and plug it into your network, even if it costs $50,000 Those cost a quarter of a million per year nowadays...
carabiner 3y ago
I worked at an electric utility in the tech side and we had a steady brain drain of guys going to Google, Meta in order to 2x or 3x their TC. Money talks.
- KennyBlanken 3y ago
  https://www.google.com/search?q=US+electric+industry+profits https://www.google.com/search?q=US+electric+industry+profits That seems to be a "management is unwilling to pay enough" problem, not a "the industry is struggling and needs a government handout for relief from the burden of enhancing security" problem. Congresscritters are demanding we cut "fat" out of basic social assistance programs by increasing requirements from beneficiaries but we're going to give electrical companies, making half a trillion in profits running basic infrastructure, a big handout, with trivial or no requirements? Pass.
  - 0xBDB 3y ago
    You're looking at revenue numbers, not profits. Profit in the utility industry is 0 on operations and maintenance expenses and 0-9% (depending on whether you are a public utility or co-op, of which there are many, and whether your regulator thinks you've been good or bad lately) on capital expenses. Expenses must be approved by the regulator as well. How strict that is depends on the state but in New York for example it's approved at the department level. All utility salaries are below non-utility equivalents and keeping people from going to Google or Meta by paying higher salaries is effectively illegal. This is not to boo-hoo for utilities. The ones that are for-profit do fine. But they are not parasitically extracting vast profits because that isn't allowed.
kyawzazaw 3y ago
Don’t you need money(investment) to hire personnel, training, etc?
deleted 3y ago
[deleted]
nunuvit 3y ago
Never heard of a hardware vendor accepting payment in the form of company culture.
buggythebug 3y ago
It's a utility company - someones uncle booger works there - there will always be zero culture there face palm

jlund-molfese 3y ago

The government only has so many levers it can pull, though. Even if we, the enlightened of HN have some idea of which investments are beneficial (for example, hiring a good CISO instead of buying the $50K cybersecurity box), laws and policies move too slowly and are too hard to change once enacted. So this situation still seems better than a rule which only benefits companies that hire Cisco Certified Security Posture Experts or something. There's at least a chance that some of these companies have competent CTOs (or equivalents, at smaller utilities) and will spend in the right area.

balderdash 3y ago
Government has plenty of levers to pull - they just don’t pull them. Want to have utilities (or any industry) put cyber security front of mind? Just tell them that they are liable for consequential damages for any service outages related to a cyber security incident, and watch how good they get at cybersecurity.
- 0xBDB 3y ago
  Government absolutely does pull those levers. I think people underestimate how closely utilities are regulated. It's a monopoly after all. The government tells them annually what their profit for the coming year will be. The state public utility / service commission determines how much profit a utility is allowed to make (really it's return on equity) based on federal guidelines. Every year the utility must make a rate case that includes what it's going to spend and why and why its shareholders deserve to get anything on top of that. If the utility has misbehaved that RoE number can literally be zero, though this would be rare. Punitive profit slashing (not quite that extreme) has definitely happened for major customer-facing IT issues and would probably happen for a major breach.

candiddevmike 3y ago

All I see here is a government subsidy for security vendors. I'd rather see more liability and insurance requirements for security breaches, including personal liability for executives. Whatever it takes to get past checkbox-driven security.

gtowey 3y ago
And schools are just a subsidy for the textbook industry. Regulation & incentives are literally the tools governments have to shape policy. It's a start, but moving the needle on issues can be hard, slow work -- especially when it seems like so many people have the attitude that if a particular action wasn't the their perfect, preferred solution, then it shouldn't have been done at all.
- hedora 3y ago
  In your analogy, the vendors are the people manufacturing textbooks that are mandatory, but never get opened and cannot be resold on the used market. The regulators are the administrators (or whoever) that require the useless textbooks. Of course, there are many useful textbooks with none of the above properties, but they don’t require complicated incentive structures to ensure they’re made mandatory.

halJordan 3y ago

This is intensely defeatist. Regulations and compliance are essentially what you described and they work for banks (despite the clever responses I'm sure are incoming). For the critical industry sectors they need to be buying the 50k appliance. And they need to be looking at a checklist that they only want to complete to avoid fines. Culture will accrete later.

hedora 3y ago
I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security appliances. Everyone involved correctly comes to the conclusion that the company’s security policy is purely performative. The people that care leave. The people that don’t care about securing the system implement the useless checkboxes and put the standalone box in the correct room (and might even plug it in), then get promoted. FIPS security certifications are the poster child for this. There’s basically no way to get a securely architected system certified, so you end up adding vulnerabilities and (in the best case) a configuration parameter like the old “enable FIPS certification (default off; do not enable unless you are required to do so)” button from windows.
kortilla 3y ago
50k appliance doesn’t do shit if people work from their personal laptop and use shared passwords. The only thing a regulation that mandates a 50k appliance will do is boost the appliance makers sales.
- hinkley 3y ago
  An appliance also externalizes responsibility. I don’t need to think of anything, because we have the box that goes, “ping”.
Veserv 3y ago
It emphatically does not work for banks. They spend hundreds of millions of dollars a year and any bank CISO would tell you, off the record, that their systems could be completely breached for less then a million dollars. That is not because they suck at doing it, that is because commercial cybersecurity is just plain garbage. That is literally the best you can get no matter how much you spend and no matter how “good” your people are if you use commercial IT security practices. Nobody does better than that who uses anything from a big brand cybersecurity vendor. The only reason banks are not totally wrecked by cyberattacks is that: 1) They actually are being constantly attacked by ransomware and the like, they just do not disclose it; I do not remember the budget line item the payments all go under but it is one of those compliance/administrative ones such as for insurance. 2) Cyberattacks, contrary to their standard portrayal as always being run by “state-sponsored” groups to make the companys being destroyed look better, are largely run by kids. They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.e. do not know how to use say investment bank deal details to do effective trades), and how to actually cash out large amounts of money undetectably. 3) The non cybersecurity processes and fraud detection are actually fairly effective. There are large number of accounting checks in place that make it very hard to do simple hacks (like make the numbers in one account higher) that can not be detected. Banks have the equivalent of very complex, bespoke DRM systems that requires knowledge of financial systems and of their internal processes to crack. As I said before, the hackers are largely financially unsophisticated, so it is very hard for them to do this. No, it is intensely defeatist to just give up on actually solving the problem and demanding useless security theater in the vain hopes that it will somehow improve the situation.

enkid 3y ago

Money isn't everything, but it's really hard to run an effective school or cyber security enterprise without money.

piuantiderp 3y ago
This is lost to many in the West. There are things you cannot buy or strong arm your way out
NoZebra120vClip 3y ago
Well that's a strawman. I've seen churches, corporations, and families being run on amazing shoestring budgets, but you couldn't tell from the outside, because the holder of the purse strings was judicious about spending. Years ago, I learned a peculiar thing about corporate or municipal budgets: sometimes a line item has to be spent or it won't come back next year. So there is often some strong impetus to spend $XXX,XXX -- or else -- and the deadline comes on June 30, and often that is how you arrive at bad spending decisions, because it's "burning a hole in your pocket".
- enkid 3y ago
  That's not what the word strawman means.
  - NoZebra120vClip 3y ago
    "it's really hard to run an effective school or cyber security enterprise without money." GP is actually understating this; if my budget and revenue is $0, then I cannot run a school or enterprise at all and it will file for bankruptcy and close. A strawman is the informal fallacy of refuting an argument different from the one being discussed. I never said that a budget should be $0 or "without money". That's a reductio ad absurdum.

evanreichard 3y ago

So just be smart about how you spend your money? Like any other department?

balderdash 3y ago
It’s not about smarts it’s about incentives, if I’m incentivized to buy cybersecurity equipment but there is no incentive or penalty for not actually preventing cybersecurity breaches, a whole bunch of stuff is going to be bought with little effect.

bojo 3y ago

Having helped implement NIST 800-171 for a small enterprise company preparing to work prime government contracts I can assure you it costs money either way. Time and money spent working with cybersecurity professionals writing SOG/SOPs which map the business practices to the standard. Money spent buying and setting up some of the necessary equipment to handle CUI properly. Time (indirectly money) spent redoing decades old business processes to map to the new paradigm. Time (indirectly money) as the business spent time training their staff up on the components relevant to their business units. I agree that building a culture is at the root of it, however, that culture alone isn't going to move the needle unless everything else is in place as well. Worse, you have to walk the company through the 5 phases of grief because in general people don't entirely understand what is actually going on and why it's important. "So you can get government prime contracts" is an easy answer, but doesn't erase the confusion behind all of the hand-wavy procedural work required to execute them.

konschubert 3y ago
I'm not convinced that implementing cybersecurity standards actually improves security.
- bojo 3y ago
  No disagreements there. What's a better answer though? No one wants to do it, most non-tech people don't understand it, yet the standards and procedures need to improve to reduce the attack surface area - especially for businesses which support critical infrastructure.
  - konschubert 3y ago
    You could legally mandate companies to insure themselves against cybersecurity risks. It's really an interesting idea: https://www.cato.org/sites/cato.org/files/serials/files/regulation/2013/3/v36n1-10.pdf https://www.cato.org/sites/cato.org/files/serials/files/regu... This creates a "market for effective practices", because companies that follow good security practices would get cheaper insurance. But it would allow insurances and companies to figure out dynamically what is cost effective and what isn't. There would be lots of financial incentive to figure out what protects you effectively and what is just security theatre.

mac-chaffee 3y ago

> You can't just purchase a "deluxe cybersecurity firewall appliance" and plug it into your network, even if it costs $50,000 Those cost a quarter of a million per year nowadays...

carabiner 3y ago

I worked at an electric utility in the tech side and we had a steady brain drain of guys going to Google, Meta in order to 2x or 3x their TC. Money talks.

KennyBlanken 3y ago
https://www.google.com/search?q=US+electric+industry+profits https://www.google.com/search?q=US+electric+industry+profits That seems to be a "management is unwilling to pay enough" problem, not a "the industry is struggling and needs a government handout for relief from the burden of enhancing security" problem. Congresscritters are demanding we cut "fat" out of basic social assistance programs by increasing requirements from beneficiaries but we're going to give electrical companies, making half a trillion in profits running basic infrastructure, a big handout, with trivial or no requirements? Pass.
- 0xBDB 3y ago
  You're looking at revenue numbers, not profits. Profit in the utility industry is 0 on operations and maintenance expenses and 0-9% (depending on whether you are a public utility or co-op, of which there are many, and whether your regulator thinks you've been good or bad lately) on capital expenses. Expenses must be approved by the regulator as well. How strict that is depends on the state but in New York for example it's approved at the department level. All utility salaries are below non-utility equivalents and keeping people from going to Google or Meta by paying higher salaries is effectively illegal. This is not to boo-hoo for utilities. The ones that are for-profit do fine. But they are not parasitically extracting vast profits because that isn't allowed.

kyawzazaw 3y ago

Don’t you need money(investment) to hire personnel, training, etc?

deleted 3y ago

[deleted]

nunuvit 3y ago

Never heard of a hardware vendor accepting payment in the form of company culture.

buggythebug 3y ago

It's a utility company - someones uncle booger works there - there will always be zero culture there face palm