3 ms·
> it absolutely does make sense for the government to force such companies Problem is, a) governments are infiltrated by russian assets and b) governments are
by egorfine 1y ago
> it absolutely does make sense for the government to force such companies
Problem is, a) governments are infiltrated by russian assets and b) governments are known to enforce detrimental IT regulations. Germany especially so.
> power plants, telco infra, traffic infrastructure or hospitals
Their system _will_ get hit by ransomware or APTs. It is not possible to mandate common sense or proper IT practices, no matter how strict the law. See the recent incident in South Korea with burned down data center with no backups.
- deleted 1y ago[deleted]
- hiharryhere 1y agoGovernment isn’t perfect but I’d be interested to know what alternative you propose?
- egorfine 1y agoa) Incarceration time for IT execs and responsible engineers. b) Let companies go out of business once they fail to protect their own crucial data. None of that is possible.
- throwaway_fjmr 1y agoso you are not proposing anything real then? I can pull "magic indestructible backup solution" out of my arse, too :(
- egorfine 1y agoNo propositions at this point. I have no idea how to fix the problem.
- scns 1y agoThose are only punishments, which are shown to not work. Solutions are needed
- msl 1y agoResponsible for what? If the government does not mandate any behavior, what basis does it have to incarcerate anyone?
- mschuster91 1y ago> Problem is, a) governments are infiltrated by russian assets and b) governments are known to enforce detrimental IT regulations. Germany especially so. The regulations are a framework called "BSI Grundschutz" and all parts are freely available for everyone [1]. Even if our government were fully corrupted by Russia like Orban's Hungary - just look at the regulations on their face values and tell me what exactly you would see as "detrimental" or against best practice? > It is not possible to mandate common sense or proper IT practices, no matter how strict the law. See the recent incident in South Korea with burned down data center with no backups. I think it actually is. The BSI Grundschutz criteria tend to feel "checkboxy", but if you tick all the checkboxes you'll end up with a pretty resilient system. And yes, I've been on the implementing side. The thing is, even if you're not fully compliant with BSI Grundschutz... if you just follow parts of it in your architecture, your security and resilience posture is already much stronger than much of the competition. [1] https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/IT-Grundschutz-Bausteine/Bausteine_Download_Edition_node.html https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisati...