then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and working product and the other just developing a working product capitalism will weed out the secure product and pass the insecure one. This is because it is cheaper to create, will get to market more quickly and be easier to configure.
As these sorts of attacks are rare and there is no established and straight forward legal framework to economically punish those without security; the company with least security almost always wins. Then when someone does show the security holes the tendency is just to arrest them in order to keep this awful system going. :D
I'm not entirely sure how we start to fix this.
This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative...
Did Maersk recover from that ransomware attack two days ago?
I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention.
Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper:
https://blog.acolyer.org/2017/06/28/an-experimental-security...
I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
Somewhat-to-mostly, yes. http://gcaptain.com/maersk-operational-update-on-cyber-attac...
Still, it undoubtedly cost them a lot. The question is did it cost them more than the prevention would have?
You say of course, they only needed to be up-to-date on patches. But there's a cost to that, and we don't know that they don't insure (or self-insure) against IT disasters (they likely do, given their size and scope).
I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
It is more than budget constraints though. I have primarily determined that budget constraints, while a factor, are a side-effect issue of a more root cause. Namely, a lack of representation for the IT department to the decision makers, whether that be a board of directors, the C-levels, etc.
The problem is two-fold.
The first problem is the management types are failing to understand that they need that representation to help guard from issues like these. Instead they often see more people as in their way and extra salary costs, and I have seen a disturbing trend the past 10 years or so of straight up gutting IT departments, often replaced by half-assed msp type consultants and highly overworked t1 and t2s.
Second, is that the kinds of people that should be filling that role, often don't want to or don't have the business background to do it properly. Over on /r/sysadmin, ask how many senior sysadmins don't even have a CTO or CIO to report to, and instead are reporting straight to a CEO or even to a CFO. Often, when a CTO is hired, they are too far on the MBA side to do the department justice, or they are simply too focused on trying to be a techy often spending too much of their time pretending to be a programmer or something similar. Many of the sysadmins spend an inordinate amount of their time either supporting the business and trying to keep up with industry movement, to the point they often are failing to bridge the business-political gap that exists. They often understand the issue, but fail to put in to upper-management in a way that convinces them, which often leads to resentment or apathy over time, not to mention increased burn-out.
I think there is a lot of opportunity to fix these issues though. A good sysadmin who transitioned into an MBA style program and then attempted to take a CTO/CIO role could really shine. In general I feel like the role of CTO/CIO is ripe for a huge turnover of fresh blood able to push more radical changes needed to survive the future.
Another potential solution is in IT workers forming some type of actually useful or powerful union. LOPSA just doesn't cut it. We have seen union busting in the past, but the IT workforce is in a huge position of power to get a real union going, and hopefully with mechanisms to protect from the degredation and devolution other union forces have endured.
The bottom line is this, in the end, these problems are managements fault, and until management is punished monetarily, legally, or through some other mechanism, they will not change their ways.
bonus: you would be surprised at how many IT departments don't even have a budget (IE aren't given the numbers, or not in a proper form, etc. They get told to make proposals and they either get rejected or approved. You can guess which happens more.)
second bonus: excess proprietary black boxes and reliance on third-party support breeds contempt for security. Misconfigured or lazily configured crap because everyone is cutting corners.
I do wonder if the lack of security is because of budget constraints (i.e. it was proposed by engineers but rejected by management as a needless cost), or if everyone didn't even think that there would be the potential of a breach and the possibility of exploitation?