News for hackers. Stuff that matters.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by swebs on Thursday October 17, 2019 @01:31PM (#21284358)
How do we increase IT competence in the public sector? There's no reason important servers should be running on Windows machines with "backups" consisting of making a copy of a file on the same hard drive as the original.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by magashna on Thursday October 17, 2019 @01:39PM (#21284443)
You can't do anything but let it publicly fail. These incompetencies are usually the result of the top not believing that the cost is worth it. Also a well run IT department often gets "nothing's ever broken, what do they actually do?" so you get rewarded for doing break/fix.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by matthewaveryusa on Thursday October 17, 2019 @02:04PM (#21284753)
Reminds me of this quote in the preface of the art of war edition I have on my bookshelf -- I find it to be a fantastic little story:

According to an ancient Chinese parable, a lord once asked his physician – whose two brothers were also healers – which of the three was the most skilled. This doctor was renowned for his expertise and ability in healing throughout China, and he replied, “My eldest brother sees the spirit of sickness and removes it before it takes shape, so his name does not get out of the house. My elder brother cures sickness when it is still extremely minute, so his name does not get out of the neighborhood. As for me, I puncture veins, prescribe potions and massage skin, so my name gets out and is heard among the lords.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by toomuchtodo on Thursday October 17, 2019 @01:41PM (#21284460)
I am an infosec professional who pitches utilities and public government. This is spot on.

The second call back is always more expensive for them, but sometimes someone needs to touch the stove themselves to see it’s hot.

If you genuinely can’t afford it, I’ll help for free, but there’s only so much time in the day and I won’t eat the cost of stupid or politics.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by ben_jones on Thursday October 17, 2019 @01:47PM (#21284531)
Is it not also because the government contracting system is FUBAR? I.e. only certain kinds of companies can contract on the big projects, you need certain clearances for certain kinds of works, and the pay gap between public and private sector SWE & security?

Also aren't their some pretty tough mandates like x% of companies must be minority owned etc. I imagine it allows those companies to charge extortionist rates because they hit the relevant quotas and nobody else does.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by lliamander on Thursday October 17, 2019 @02:43PM (#21285134)
My first job out of college was working for a IT consulting firm on a project for a state government. All of this describes that experience precisely.

> Also aren't their some pretty tough mandates like x% of companies must be minority owned etc. I imagine it allows those companies to charge extortionist rates because they hit the relevant quotas and nobody else does.

One thing I saw was that the big players will have employees who fit the desired characteristics, and they just spin those employees off into their own corporation as needed.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by iguy on Thursday October 17, 2019 @01:54PM (#21284617)
Many of these complaints would apply to physical safety too. But we don't just wait for buildings to burn down to teach organizations a lesson about their heating contractors -- we have fire codes, and inspectors with teeth.

Is there any chance that something like this might be done for IT? Or is it all too young to be done sensibly?

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by wcip on Thursday October 17, 2019 @02:19PM (#21284924)
>But we don't just wait for buildings to burn down to teach organizations a lesson about their heating contractors -- we have fire codes, and inspectors with teeth.

We did wait for a fire to create building codes, it just was a long time before either of us were born: https://en.m.wikipedia.org/wiki/Triangle_Shirtwaist_Factory_...

There was certainly plenty of fires before that but this one was terrible enough to cause a public outcry.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by iguy on Wednesday October 23, 2019 @05:58PM (#21339488)
Sure, I agree that fire rules are written in blood. But not the blood of every single district. Once we've decided, we impose these rules across many cities, millions of buildings.

An individual city council is not free to learn the lessons again the hard way, no matter how tight the budget and how close the elections. Either it meets the code, or it gets closed down.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by AnotherNewName on Thursday October 17, 2019 @02:12PM (#21284839)
I worked in local govt as a consultant, then as their IT Director for a few years. Nowhere near as big of a place as Baltimore though.

The hardest thing for me to do was convince anyone to get me money. They STILL have servers running that were purchased in 2007-2008. (I moved all critical services off, and made damn sure backups worked). It took two years before I was able to convince the board to give me $5000 for server hardware alone. That went towards the most needed hardware too, not my wish list.

This was before I was able to get things set up so I was able to buy something under $500 without board approval, just needed IT Committee approval. The board required everyone in the county to go through the IT Committee for any purchase related to IT. Printer ink, a $10 wireless mouse, etc. That was the first thing I got rid of while I was there. They only reason they did that was because it gave them power over people. I've seen them turn down people over $15 purchases...

The other person who replied is pretty correct about politics. The board there HATED tech for no reason other than if you weren't in the "old boys club" you were garbage to them and they treated you like that.

So overall, it really gave me a great view on why so many counties are so dysfunctional and why government works so slow (for most things at least). I don't regret my time there, but I wish it didn't take such a toll on me.

/Edit Also, there's no reason that they couldn't have tested backups. I was the only IT person for a county of 350+ PCs and a hospital, and I still managed to test backups every month. Shadow Copies saved me so much time too. I also used linux /pfSense when applicable.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by krisoft on Thursday October 17, 2019 @02:34PM (#21285048)
Let me put my cynical hat on: legalese ransomware. Codify in law what is the fair price and a whole cottage industry will spring up to do the education for you.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by lliamander on Thursday October 17, 2019 @02:45PM (#21285169)
Time for me to figure out if I can register a corporation under the name Thieves Guild...
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by Spooky23 on Thursday October 17, 2019 @02:16PM (#21284888)
Consolidate with counties (for larger/populated counties) or the State. Bigger public sector entities are as effective as a comparable corporation.

Municipal government doesn't have a sustainable funding model for things like IT unless they are really small or really big. In my city (~100k people), they have 3 guys and a couple of freelancers that work <100 hours a year. The staff make like $40-55k/year.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by sailfast on Thursday October 17, 2019 @02:05PM (#21284766)
Apply for a job. Run towards the fire. Help fix it.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by brianlweiner on Thursday October 17, 2019 @03:16PM (#21285439)
I applied for the Baltimore City director of digital operations position. I interviewed with Frank Johnson and a variety of other city department heads.

I got the impression they were a group of people that broadly understood their problems and were finding it very difficult to steer the city towards good solutions.

Although Mr. Johnson was the City's Director of IT, realistically he had very nominal oversight over many of the city's actual IT departments - which were spread across a series of departments with their own employees, budgets, and resources. This was something he had been actively trying to improve but with limited progress.

I don't know what the best solution is - their hiring process is flawed and it's difficult to remove or replace problem employees. The budget is about 60% of what it probably needs to be and there's no path towards improving it.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by sailfast on Thursday October 17, 2019 @07:42PM (#21287360)
That sounds right. Good for you for going out for it. Hiring / firing in government is certainly not helping the situation, and budget fights are always a struggle.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by noonespecial on Thursday October 17, 2019 @02:29PM (#21285005)
All the worst jobs I've ever had shared one common characteristic.

Knowing exactly how to fix a problem, having the skills to do so, and being absolutely forbidden from actually doing it.

This sounds like one of those "opportunities".

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by sailfast on Thursday October 17, 2019 @02:53PM (#21285236)
I would argue in this case that there is no "exactly how to fix it" when it comes to public sector technology, that said - you're absolutely right. Organizations often want the competence and then align things against competent people working to accomplish that goal. In order to solve the problem effectively, you've got to be an organizational hacker with some patience as well as a technologist - which requires a slightly different skillset than solving the easier engineering problem.

All that said, laments about "how do we fix government X" will never be solved if we deem the cost of entry too high to even attempt to fix it ourselves. Obviously this is all in addition to and outside of any democratic process that would lead to reform of how these positions were managed, performed, etc.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by lliamander on Thursday October 17, 2019 @03:12PM (#21285399)
So I'm a software engineer in the private sector. What would be the path for me to take if I wanted to become an IT director for a local government?

It's actually not something that would be my first choice, but I do personally know people who have been harmed by incompetent/apathetic IT leadership in local governments. It angers me enough that I would consider a career change.

Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by plurple on Thursday October 17, 2019 @02:56PM (#21285258)
Stop these positions from being political hires. The IT head had a political consultant, and was the highest paid person in the city government. He was hired by the former mayor who is now under FBI investigation.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by tracker1 on Thursday October 17, 2019 @05:32PM (#21286546)
Increase pay and reduce hiring friction. Most people with good skills aren't willing to do the long waiting game or take the pay cut to work in the public sector directly.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by AnIdiotOnTheNet on Thursday October 17, 2019 @01:38PM (#21284433)
First you'd have to solve politics. Good luck with that.
Re:Baltimore Blew Off Ransomware Demand Only to Find Data Ha... by sseveran on Thursday October 17, 2019 @02:13PM (#21284853)
I am not sure it's just IT competence. If this was the worst thing going on in Baltimore it would be doing much better as a city, but its not.