5 ms·

With the potential gutting/further defunding of EPA and other federal regulatory agencies. My money says there will be no action taken until an actual security

by xyst 2y ago

With the potential gutting/further defunding of EPA and other federal regulatory agencies. My money says there will be no action taken until an actual security incident occurs. Administrations don’t care about the long term health of the country, only what they can do in 4 year spans. Cybersecurity is unfortunately not “sexy” enough for the common American voter to get behind.

javajosh 2y ago
I think it is safe to say that few if anyone actually understands the common American voter and what they actually care about. Anecdotally, the prevalence of cyber-security plot points in action thriller movies/games/books indicates that there is at least some awareness of the threat.
frutiger 2y ago
Somehow I doubt the security posture was magnificent even before the defunding. This kind of thing is usually a simple checklist item for companies let alone government agencies.
015a 2y ago
Because it was being addressed before the defunding? I mean... clearly not. They haven't been defunded yet. The issue is unlikely to be money, nor is it likely to be technical. If throwing ever-increasing amounts of money at the problem isn't fixing it, maybe it isn't all that crazy to try the opposite.
- toomuchtodo 2y ago
  Republican lawmakers and the water industry sued the EPA saying it would be too expensive to secure water systems. > In a statement to Recorded Future News, an EPA spokesperson confirmed that the memorandum – handed down in March – was being withdrawn due to lawsuits filed by attorneys general in the States of Missouri, Arkansas, and Iowa as well as industry groups American Water Works Association (AWWA) and National Rural Water Association (NRWA). There is no point in trying to solve what there is no will to solve. Less money, more money, they just don’t want to have to do it or be liable. https://therecord.media/epa-says-litigation-from-republicans-and-water-companies-forced-withdrawal-of-cyber-memo https://therecord.media/epa-says-litigation-from-republicans... https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-biden-administration-over-new-cybersecurity-regulations-for-public-water/ https://www.iowaattorneygeneral.gov/newsroom/attorney-genera... https://content.govdelivery.com/attachments/IACIO/2023/04/18/file_attachments/2470891/Iowa%20Petition%20for%20Review.pdf https://content.govdelivery.com/attachments/IACIO/2023/04/18...
  - 015a 2y ago
    That's not how I read that. This statement from the EPA is the crux of it: "Most cybersecurity practices can be implemented at minimal cost."; a statement that anyone involved with software/cybersecurity knows has never been true about any software system, ever. It feels very reasonable to me that some of these dirt-poor counties could look at a new set of cyber requirements and say, we physically cannot pay for this; and while the EPA goes on to list sources of funding they offer, I don't know much about those; its possible that given they've already vastly underestimated the cost of securing an industrial software system, they're also vastly under-provisioning the grant funding available to do it. No one wants their water systems insecure. Republicans aren't a comic book villain; and to help empathize with how they think, right or wrong, consider this: What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). The EPA seems really good at drafting memorandums they have to redact and publishing reports about how insecure our water systems are; Republicans would argue, the money we spent on those things did nothing to help actually fix the problem, so maybe the solution is "less EPA". I'm not saying this is right, and I'm not saying its even representative of a cogent reality. I'm just saying, this is the line of thinking.
    - toomuchtodo 2y ago
      As a cybersecurity practitioner and owner of a mid 7 figures budget to defend an enterprise, I am not unfamiliar with the costs (controls, staff, implementation). But, the evidence is clear that the response was “no” to this effort, and no further action or negotiation to improve the security posture of these entities. I know what it looks like when someone says “we don’t have the funds for this, what can we do with what we have?” but also what it looks like when lack of funding is an excuse to take no further action. Republicans have made no effort to appropriate funding for this work at either the federal or state level, for example. If this matters to them, when can we expect this to happen? And how many people will have to be harmed first for it to happen? > Republicans aren't a comic book villain; Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. But if that’s what you vote for as a voter, who am I to get in your way? This isn’t a problem to be fixed, this is an indicator of electorate intent. > What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). This sounds like a recipe for fraud and waste due to the sophistication of those responsible at the local level, with no accountability.
- Spooky23 2y ago
  There has actually been a lot of investment in this area, especially in the last few years. Cyber is seen as a risk and most municipal utilities and auditors are treating it as such. The private companies… not so much unless there’s a clear financial benefit or mandate.
Eumenes 2y ago
> Cybersecurity is unfortunately not “sexy” enough for the common American voter to get behind. Government info-sec jobs suck too. Crap pay, red tape, onsite only. Also, alot of security people have ethics surrounding privacy, data security, etc. Why work for a culture that spies on its own citizens, its allies, and engages in global terrorism? The NSA can attract some decent mathematical minds but lacking on the security front.
- tetnis 2y ago
  the math people work towards the same goal. why single them out
  - Eumenes 2y ago
    The NSA famously recruits math geniuses and quants to solve abstract problems, esp. around cryptography. If you're a security person hired to harden infrastructure or web services, its not so abstract. People like Snowden for example.
    - alephnerd 2y ago
      NSA's early career recruiting pipeline is pretty strong at the collegiate level. They recruit from a LOT of good universities that top tech employers don't recruit from (eg. UTSA, Texas Tech). The issue is the US Government is hundreds of agencies, and each state in turn has hundreds of agencies as well. Each of these agencies has their own IT that manages that agencies's infra and security AND they are very limited funds wise and salary wise. For example, back when I was a PM, a customer of mine was the de facto CISO of a several hundred person agency yet only earned around $120k a year and had a less than $1M budget for all IT spend. The agency could not build it's own hiring pipeline (having to resort to USAJOBS and the department it was a part of) nor was there any truly unified security platform. While the naive answer would be "have everyone use a single platform", just about every presidential administration in the past 20 years has tried that and failed.
      - fsflover 2y ago

by xyst 2y ago

javajosh 2y ago

I think it is safe to say that few if anyone actually understands the common American voter and what they actually care about. Anecdotally, the prevalence of cyber-security plot points in action thriller movies/games/books indicates that there is at least some awareness of the threat.

frutiger 2y ago

Somehow I doubt the security posture was magnificent even before the defunding. This kind of thing is usually a simple checklist item for companies let alone government agencies.

015a 2y ago

Because it was being addressed before the defunding? I mean... clearly not. They haven't been defunded yet. The issue is unlikely to be money, nor is it likely to be technical. If throwing ever-increasing amounts of money at the problem isn't fixing it, maybe it isn't all that crazy to try the opposite.

toomuchtodo 2y ago
Republican lawmakers and the water industry sued the EPA saying it would be too expensive to secure water systems. > In a statement to Recorded Future News, an EPA spokesperson confirmed that the memorandum – handed down in March – was being withdrawn due to lawsuits filed by attorneys general in the States of Missouri, Arkansas, and Iowa as well as industry groups American Water Works Association (AWWA) and National Rural Water Association (NRWA). There is no point in trying to solve what there is no will to solve. Less money, more money, they just don’t want to have to do it or be liable. https://therecord.media/epa-says-litigation-from-republicans-and-water-companies-forced-withdrawal-of-cyber-memo https://therecord.media/epa-says-litigation-from-republicans... https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-biden-administration-over-new-cybersecurity-regulations-for-public-water/ https://www.iowaattorneygeneral.gov/newsroom/attorney-genera... https://content.govdelivery.com/attachments/IACIO/2023/04/18/file_attachments/2470891/Iowa%20Petition%20for%20Review.pdf https://content.govdelivery.com/attachments/IACIO/2023/04/18...
- 015a 2y ago
  That's not how I read that. This statement from the EPA is the crux of it: "Most cybersecurity practices can be implemented at minimal cost."; a statement that anyone involved with software/cybersecurity knows has never been true about any software system, ever. It feels very reasonable to me that some of these dirt-poor counties could look at a new set of cyber requirements and say, we physically cannot pay for this; and while the EPA goes on to list sources of funding they offer, I don't know much about those; its possible that given they've already vastly underestimated the cost of securing an industrial software system, they're also vastly under-provisioning the grant funding available to do it. No one wants their water systems insecure. Republicans aren't a comic book villain; and to help empathize with how they think, right or wrong, consider this: What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). The EPA seems really good at drafting memorandums they have to redact and publishing reports about how insecure our water systems are; Republicans would argue, the money we spent on those things did nothing to help actually fix the problem, so maybe the solution is "less EPA". I'm not saying this is right, and I'm not saying its even representative of a cogent reality. I'm just saying, this is the line of thinking.
  - toomuchtodo 2y ago
    As a cybersecurity practitioner and owner of a mid 7 figures budget to defend an enterprise, I am not unfamiliar with the costs (controls, staff, implementation). But, the evidence is clear that the response was “no” to this effort, and no further action or negotiation to improve the security posture of these entities. I know what it looks like when someone says “we don’t have the funds for this, what can we do with what we have?” but also what it looks like when lack of funding is an excuse to take no further action. Republicans have made no effort to appropriate funding for this work at either the federal or state level, for example. If this matters to them, when can we expect this to happen? And how many people will have to be harmed first for it to happen? > Republicans aren't a comic book villain; Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. But if that’s what you vote for as a voter, who am I to get in your way? This isn’t a problem to be fixed, this is an indicator of electorate intent. > What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). This sounds like a recipe for fraud and waste due to the sophistication of those responsible at the local level, with no accountability.
Spooky23 2y ago
There has actually been a lot of investment in this area, especially in the last few years. Cyber is seen as a risk and most municipal utilities and auditors are treating it as such. The private companies… not so much unless there’s a clear financial benefit or mandate.

Eumenes 2y ago

> Cybersecurity is unfortunately not “sexy” enough for the common American voter to get behind. Government info-sec jobs suck too. Crap pay, red tape, onsite only. Also, alot of security people have ethics surrounding privacy, data security, etc. Why work for a culture that spies on its own citizens, its allies, and engages in global terrorism? The NSA can attract some decent mathematical minds but lacking on the security front.

tetnis 2y ago
the math people work towards the same goal. why single them out
- Eumenes 2y ago
  The NSA famously recruits math geniuses and quants to solve abstract problems, esp. around cryptography. If you're a security person hired to harden infrastructure or web services, its not so abstract. People like Snowden for example.
  - alephnerd 2y ago
    NSA's early career recruiting pipeline is pretty strong at the collegiate level. They recruit from a LOT of good universities that top tech employers don't recruit from (eg. UTSA, Texas Tech). The issue is the US Government is hundreds of agencies, and each state in turn has hundreds of agencies as well. Each of these agencies has their own IT that manages that agencies's infra and security AND they are very limited funds wise and salary wise. For example, back when I was a PM, a customer of mine was the de facto CISO of a several hundred person agency yet only earned around $120k a year and had a less than $1M budget for all IT spend. The agency could not build it's own hiring pipeline (having to resort to USAJOBS and the department it was a part of) nor was there any truly unified security platform. While the naive answer would be "have everyone use a single platform", just about every presidential administration in the past 20 years has tried that and failed.
    - fsflover 2y ago