Aside from the obvious wrongness of that mind-boggling assertion, it raises the question for even the uninformed as to why there would be a multi-billion dollar infosec industry--that includes your company--if security is as trivial as you suggest here.
Of course, the answer is that it is not and that you should understand better than most the complexity inherent to infosec, else you wouldn't have a business. Perhaps that's why, of the people I know who work in infosec, not a single one is as cavalier as you appear to be here.
But, here you're again underscoring my point by focusing solely on the victim's "culpability" and now even claiming that they are not actual victims.
Victim-blaming is a standard propaganda technique propagated by the criminals and their sponsors. Why are you working so hard to oblige them with these odd false narratives?
Yes, you can be safe against the vast majority of threats with just a few trivial measures.
> it raises the question for even the uninformed as to why there would be a multi-billion dollar infosec industry--that includes your company--if security is as trivial as you suggest here
There are a number of reasons. While you can eliminate phishing and malware pretty trivially, and secure your organization against the vast majority of threats, there sometimes holes you'll need to poke. Things like giving HR the ability to open word docs with macros enabled, or running multiple clouds, or providing RCE as a service, etc.
But the vast majority of attacks can be stopped pretty easily. Over 95% of malware samples execute out of a single directory - blocking execution in that directory therefor breaks 95% of malware samples. Obviously there's a ton of malware left in that last 5%, but 95% isn't nothing. Why don't companies block that 95%?
> But, here you're again underscoring my point by focusing solely on the victim's "culpability" and now even claiming that they are not actual victims.
Again, individuals can be victims, corporations take on the additional responsibility when they are formed. A corporation that takes data from its users and then loses it is not the victim, the end users are.
This is legally and morally the case. When you form a corporation you literally, legally sign up for a number of responsibilities that a normal person does not have. When you take data from users you are morally (and, again, legally) signing up to protect that data.
These are unserious, self-contradicting arguments, intended to muddle the issue. You're making inane statements that suggest infosec is trivial, then slowly ceding that it's not, while pivoting back to redirecting blame to the targeted companies.
The fact that corporations sign up to take on responsibility doesn't make them any less victims when they're attacked.
In sum, you're going to ridiculous lengths to absolve the actual criminals here by moving blame to the victims. We should all be angry at the companies, not the actual criminals.
This is a preferred misdirection technique, promulgated by Russian propagandists and the useful idiots who regurgitate them.
Not really? Literally 95% of Windows malware executes from one directory - the AppData directory. By enabling Applocker, built into Windows, you can block 95% of observed samples. There's no contradiction there and I'm giving very explicit, practical advice.
> The fact that corporations sign up to take on responsibility doesn't make them any less victims when they're attacked.
Well it kind of does. When corporations don't actually suffer due to the attacks but their end users do, it's the end users who are victims, and it's the corporation who is often at fault. Again, this is legally the case, it's why we have ISO 27001, GDPR, etc.
> In sum, you're going to ridiculous lengths to absolve the actual criminals here by moving blame to the victims. We should all be angry at the companies, not the actual criminals.
I don't think my lengths are ridiculous. I've mentioned two very simple policies that any corporation can start rolling out today.
I'm perfectly fine blaming criminals, it's just a really silly place to start. If you want to solve geopolitical issues, power to you. But, again, we should (and do, legally) hold companies accountable to secure the data they hold.
Your argument is incredibly black and white and advocates for a completely impractical response. Most corporations are not in a position to impact geopolitical incentives ie: companies can not easily budget for "make certain countries not hack us". For massive companies that can absolutely be part of their approach.
But just because the hackers are at fault doesn't mean the companies hold no responsibility.
As I said, individuals should never be blamed for a breach. They take on no responsibility, ethically or legally. But companies do.
If you want to pretend otherwise, ok? It's denying some pretty obvious moral issues, as well as some well defined legal ones, but everyone is welcome to their own system of ethics.
The point is that we should defend our companies and economies by responding vigorously against the criminals and their national sponsors with law enforcement and aggressive offensive cyber capabilities. They need a smack in the mouth every time they touch any of our citizens or the companies for which they work.
These are costly direct attacks on our national security, economic prosperity, and infrastructure that are followed up with classic Russian-style propaganda, intended to minimize and redirect blame to the victims. That propaganda is then propagated by trolls and useful idiots.
And, here you are with your victim-blaming and minimizing strawman claims about teenagers and boogeymen.
Well, I don't really think so, obviously. And where you made an affirmative assertion ie: "it is extraordinarily hard" I just made a negative assertion "it isn't". I didn't qualify how hard it is.
But regardless, > You're not accounting for
I am. Been in infosec my whole career and well before it. Been a CEO of an infosec company for two years now.
> number of attack surfaces, the number of attack vectors
The major threats are the same for virtually every organization. Phishing and malware. Both have extremely effective measures that any organization can roll out:
1. U2F (unphishable credential)
2. Default-deny execution (99% of malware is dead, and you now control more of your attack surface)
> such as zero days in software from third party vendors.
You can defend against this in a number of ways as well. I do feel that vendors are often the weak link.
> Many firms also deploy tons of legacy code that they depend on to operate their businesses, some of which may have been developed by vendors long gone and cannot be easily replaced.
That was a mistake on their part. Even still, you don't have to replace it to make it safer. You can isolate it, build around it, etc.
Not to mention, very little software is truly irreplaceable.
> he real point is that the blame is not with the victims, but with the criminals and the nations who sponsor them
OK but that's a different point than what you originally made. You stated that it is extremely difficult to defend against these attacks, I'm saying it isn't. Whether one should have to defend against them or not really wasn't your point, even if now you say it is.
> wo of them are small businesses that sustained devastating losses and lost time.
It's an awful thing. They have my sympathy.
> What's so hard about holding these criminials and their sponsors accountable?
Right, so, here's the deal.
1. Many of the breached companies are not really 'victims'. Instead it is their users who are victims. So we hold them accountable because it is their responsibility to not let their users' data get owned. That's on them.
2. We can't hold attackers accountable for a number of reasons. Maybe in a moral sense we can, but in a practical sense we have to take precautions.
I would never blame an end user, a singular person, for getting owned. It's not their job to protect themselves from the world.
I'll absolutely blame companies (ones with user data) who get owned because when you sign up for a company you're taking on a number of additional obligations and responsibilities.