4 ms·
The government only has so many levers it can pull, though. Even if we, the enlightened of HN have some idea of which investments are beneficial (for example, h
by jlund-molfese 3y ago
The government only has so many levers it can pull, though. Even if we, the enlightened of HN have some idea of which investments are beneficial (for example, hiring a good CISO instead of buying the $50K cybersecurity box), laws and policies move too slowly and are too hard to change once enacted.
So this situation still seems better than a rule which only benefits companies that hire Cisco Certified Security Posture Experts or something. There's at least a chance that some of these companies have competent CTOs (or equivalents, at smaller utilities) and will spend in the right area.
- balderdash 3y agoGovernment has plenty of levers to pull - they just don’t pull them. Want to have utilities (or any industry) put cyber security front of mind? Just tell them that they are liable for consequential damages for any service outages related to a cyber security incident, and watch how good they get at cybersecurity.
- 0xBDB 3y agoGovernment absolutely does pull those levers. I think people underestimate how closely utilities are regulated. It's a monopoly after all. The government tells them annually what their profit for the coming year will be. The state public utility / service commission determines how much profit a utility is allowed to make (really it's return on equity) based on federal guidelines. Every year the utility must make a rate case that includes what it's going to spend and why and why its shareholders deserve to get anything on top of that. If the utility has misbehaved that RoE number can literally be zero, though this would be rare. Punitive profit slashing (not quite that extreme) has definitely happened for major customer-facing IT issues and would probably happen for a major breach.