Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. to give ransomware hacks similar priority as terrorism, official says

reuters.com

Post reply on HN
Print view View original

401–410 of 591 posts

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#401

Post by toomuchtodo »

fsckboy wrote: post #372
xupybd wrote: post #335

Earlier quoted context omitted.

You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.

> "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing

Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#402

Post by hnick »

fabianhjr wrote: post #383
hnick wrote: post #367

Earlier quoted context omitted.

Liable in what way? Wouldn't that just kill OSS? Or do you not count programmers who upload swiss-cheese scripts to Github as vendors? What about Linux, openSSH, etc?

OSS licenses include a very broad waiver, after all it is a gift provided as-is. Software that runs critical infrastructure (or could cause injury or death if it malfunctioned) should be required to use formal methods and that certainly would include everything to make it run also used such formal methods. (From the OS to shared libraries and even the compilers)

A lot of commercial software has similar waivers, too. See Windows 10.

"Microsoft and the device manufacturer and installer exclude all implied warranties and conditions, including those of merchantability, fitness for a particular purpose, and non-infringement."

You'd have to outlaw that or breed a more discerning consumer. One way to do that would be to blame the company using it, which would make them take more care in what they choose to use.

It just gets broad and vague after a point. Can the software that schedules trains use Linux or MySQL? People could die if it puts two trains on the same track. Note that GP never mentioned safety either. Just being hacked.

But yes I'd hope that anything bespoke should be covered under a contractual agreement with SLAs and penalties.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#403

Post by pfortuny »

blast wrote: post #188

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…

Not exactly: their behaviour is more akin to a storage facility with faulty security cameras and sleepy guards (and cheap locks). They have a duty towards their customers (contracts to be honored) and this requires security.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#404

Post by mlac »

panny wrote: post #259
mlac wrote: post #236

Earlier quoted context omitted.

The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that i…

>The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.

Pulling this thread: say the government regulates it - what do they require? Regulations that say you need to be secure enough to not be hacked? That requirement changes daily.

Baseline security standards? Sure. But what is the baseline? And how influenced by lobbyists is that baseline? You know the big security companies would love to have their product be a government requirement. Attackers do not have regulations. They know the regulations and work around them. Makes it more difficult, but eventually they develop new attacks.

So now you’ve got this government body making regulations that needs people who understand security to make the regulations, who then need some way to audit the companies to ensure compliance. The companies then have to focus on the audits and not on emerging threats, or do both, and it increases overhead.

I’m not against government regulations when it is a good fit, but there are a lot of unintended consequences. The government is made up of people, too, and they may not be as close to the work to understand the optimal allocation of resources to minimize security risk.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#405

Post by ehsankia »

zmmmmm wrote: post #288

I think this is needed because the security industry seems to be well on the way to adopting paying off these people as a routine cost of business. That is going to lead to an absolute disaster if it is allowed to continue and grow. It needs to be a double edged sword though where companies are just as afraid of facilitating ransomware attacks as they would be of the consequences of facilitating terrorists. In other…

Let's just hope it won't be the same kind of priority as "terrorist" was after 9/11, with useless wars, TSA and all the security theater.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#406

Post by [deleted] »

kube-system wrote: post #348
antonzabirko wrote: post #336

Earlier quoted context omitted.

The problem is our govt money is subsidizing private company security policies instead of more directly helping people. This money should go to healthcare, infrastructure, or even be redistributed before it's used here.

We fund the police and military with our tax dollars to prevent bad actors from doing bad things that we don’t want. Why is this different?

[deleted]

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#407

Post by hunter2_ »

mewpmewp2 wrote: post #374
hunter2_ wrote: post #334

Earlier quoted context omitted.

Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts…

Surely you mean lock files not package jsons?

Oops, that's the big one. Maybe it's fine for that to be inhumanely large, as merely an artifact? Bad example then, but the point stands.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#408

Post by freddie_mercury »

chickenpotpie wrote: post #40

I really hope this copies the principal of not negotiating with terrorists. Everytime we pay out ransomware it just encourages more ransomware.

"Not negotiating with terrorists" is mostly a myth. Everyone from the US to Israel to the UK negotiates with terrorists:

https://en.wikipedia.org/wiki/Government_negotiation_with_te...

https://foreignpolicy.com/2014/06/03/the-u-s-does-negotiate-...

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#409

Post by Ericson2314 »

meetups323 wrote: post #77
axlee wrote: post #45

Earlier quoted context omitted.

I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore cash, thank you. The industry should be magnitudes larger than it is currently, and we shouldn't encourage corporate recklessness by socializing the costs.

If other States sent proper Armies over to attack critical infrastructure the US government would surely foot the bill to aid in security. Why should cyberarmies be treated more leaniently?

Well, socialize the important assets as they are evidentally too important to be left in private hands?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#410

Post by Ericson2314 »

axlee wrote: post #251
ineedasername wrote: post #232

Earlier quoted context omitted.

We publicly subsidize every other kind of security to some degree already. A company might have security guards, but police are certainly going to be there to provide a baseline policing the neighborhood, respond to calls, etc. And security via threat of retaliation does not sound like a practical or effective solution either: we already have plenty of capabilities in that area, and it didn't stop east coast oil & ga…

Then how about nationalizing that infrastructure, if it is so crucial for national security and the private sector is unwilling to spend enough to protect itself against threats? Let's not kid ourselves: this is first and foremost a matter of incentives and consequences rather than a lack of capabilities. I don't see what the public could do better than private entities, besides absorbing their costs. The only way I…

Yes thank you for your responses. People wine but we're clearly pathetic as an industry, limping along with Unix etc. We know so much about how to build better systems, and yet it's more bandages on the status quo, all the while increasing complexity which makes things largely futile.

Unlike "real war", cyber defense also gets to design the battlefield, everytime time. There will always be social attacks, but the stupid C and Unix stuff that is the bread & butter today is completely preventable

Post reply on HN