> $10 says they've been systematically underinvesting in security and nows it's biting them in the a*. But it doesn't matter because they've basically managed t

> $10 says they've been systematically underinvesting in security and nows it's biting them in the a*. But it doesn't matter because they've basically managed to become a monopoly [...]. The next step is to move to declare this critical national infrastructure and create all sorts of new obtuseness rules and regulations [...] There really only need to be 3 for critical infrastructure. #1 - Patch your shit according to industry standards, and have documented audit records that you've done that in a timely manner. #2 - You're fair game for NSA and DoD offensive pen testing. Failed pen tests are responsibility disclosed, then reported to the market after delay. #3 - So goes CISO, so goes CEO. Along with a ban from leadership roles for a number of years (5?). The issue is that the CEOs of these companies hire fall-on-your-sword guy as CISO, ignore the issues / listen to their CISO glossing over deficiencies, then claim breaches came out of nowhere, fire the CISO, and repeat business as usual. It's not going to change until CEOs have a realistic expectation that deficiencies will be found and personal consequences when they are.