My colleagues and I submitted a similar talk/paper for a different NCSC conference (but weren't accepted). I see that this talk by Bert Hubert covers mostly the

My colleagues and I submitted a similar talk/paper for a different NCSC conference (but weren't accepted). I see that this talk by Bert Hubert covers mostly the ground. so I am pleased, but worried about what this take misses out. Hubert is addressing much of the ground that lies between security and resilience. Our emphasis is on how mitigation lies in education and autonomous systems over regulation. Not that regulation is wrong, just that it doesn't work as a stick without a carrot. We also looked at timescales and how so much is already too late because of the lag-time from drafting to efficacy. And what I know from hanging out here on HN is that technologists appear hostile to regulation, but giant companies love it so long as they get to write the rules that give them more monopoly power. Where we went wrong I think is lack of political tact. Hubert stops himself from even finishing off the remark about the quality of Microsoft products. But I don't think the real problem can be ignored for much longer. Instead, we went all-in and emphasised (as previously here [0]) that "Big Tech is the cybersecurity problem" (as Bruce Schniere recently echoed) because it pushes (in addition to highly centralised single points of failure) an irresilient "insecurity industry" that is based on protection not security. Hubert's talk doesn't get to the key issue; Security and protection are not the same thing. Protection leads to dependency that ultimately erodes real security. However "protection" is easy and profitable to sell. Real security is not. That is ths succinct way in which it must be put. If the intel appraisal is accurate and we are entering a serious war footing than we can have no more patience for the profitable but dangerous "insecurity industry" that gives an appearance and simulation of security, without the reality. [0] https://techrights.org/o/2021/11/29/teaching-cybersecurity/ https://techrights.org/o/2021/11/29/teaching-cybersecurity/