If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods.

This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry.

If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment.

Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.

>If the US were to be serious about corporate IT security

What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications?

Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should??

This just sounds like externalizing costs to the public while banking record private profits.

How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.

“Too big to fail” and investors do not get hurt.

The problem does not fix itself until the investors start truly losing money, the care, unlike the Equifax case. Until the portfolio value cannot go down 90% there is not going to be a change in corporate actionism.

They are starting to lose money, it's 5M$ today, who knows what it'll be tomorrow or how often it's going to happen.

Do corporations defend their factories with their own weapons?

Biggest global companies definitely have their own mercenaries on retainer. But that’s mostly for international operations on continents like Africa.

Well, they can. Interesting thought.

Agree. The govt need not provide the teams as they must compete for talent like anyone else and don't have much to spare.

The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.

One of the functions of the government is to educate and train its population. I think using that function could resolve the shortage or high cost of talent.

Self-regulation doesn't.

The market has already solved this in the form of ransomware groups. No need to have the government do it and issue a fine, ransomware groups literally are doing what you said.

I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.

I'd rather the money and fines flow to the US government, not random hacker groups.

But the hacker groups let me pay in crypto.

They could do it indirectly, by requiring insurance against security holes.

> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury

This (almost certainly) isn't true. It may put management at risk of sanctions, but shareholders are shielded by the corporate veil.

I say "almost certainly" because in some cases prosecutors can go after shareholders, but this is limited to cases where a specific shareholder is involved in decision making.

https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#Un...

I wasn’t aware of this policy. Is it totally apolitical or does the WH need to initiate the sanctions process? Consider the optics of sanctioning the domestic company providing your own country’s critical infrastructure, right after you spend a week discovering just how critical it really is.

And yet Scripps healthcare in California is going on more than a week of all of their IT systems being down for the same reason and it’s disrupting operations enough that they’re diverting a incoming patients to other providers and a lot of their patients have no way of finding out whether their already-schedules procedures will still happen.

Since healthcare is so heavily regulated it’ll be interesting to see what repercussions come of this. The company has been mostly silent on the matter despite it being severe enough that you can’t even get to their website.

> paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury.

Treasury doesn’t indict anyone, that’s Justice’s job.

You'd damn well hope so. In civilized countries, when you leave the key in the ignition the cops will go after the thieves. The next thing that'll happen is that they'll also go after you because you just made the roads unsafe.

And this isn't a car, this is infrastructure with national security implications. Someone needs to go and do time.