U.S. Cities Strain to Fight Hackers

https://www.wsj.com/articles/u-s-cities-strain-to-fight-hackers-11559899800

by Bostonian • 7 years ago

128 113 7 years ago

Don't put extremely sensitive information on the internet.

njyx• 7 years ago

On the other hand, we want digital public services, to be able to pay taxes electronically, to be able to vote electronically etc.

I don't think the "don't put sensitive information on the Internet" idea really holds any water unless we expect our public services to be done with pen and paper for evermore, while everything else goes digital. (Yes, machines could be disconnected from the network and so on... but that's arguably just saying "an airgap is all you need")

testvox• 7 years ago

But those things can be done without putting sensitive information on the internet. Crypto currency transactions can keep everything sensitive off the network. A one way airgap is indeed all you need (your device should be able to push data to the network but never receive any data from the network). The same scheme works for voting.

mtgx• 7 years ago

to be able to vote electronically

That's one thing we definitely shouldn't want. This case is just the latest proving what a bad idea that is.

microcolonel3• 7 years ago

Well, I would prefer it, but at least at the scale of towns and small cities, I simply don't trust them.

Furthermore, if they do so many things that they need a public-facing website to manage all of the sensitive information they keep on me, I probably don't want to live there.

It's all well and good wanting to access a municipal government's private records through the internet, but try to think of how likely they are to get that right, and adjust your desires accordingly.

darkpuma2• 7 years ago

"we want [...] to be able to vote electronically etc."

Speak for yourself. I see no upsides.

dandersh• 7 years ago

Unfortunately this information was expected to be divulged and collected before the internet was widely used. Policies and infrastructures were not put in place (or ignored, as I've personally witnessed) to protect this information once it was digitized.

At the same time, there should be a real discussion over why so much information is being demanded, why SSN's are being overused as they are, etc.

pixelrevision• 7 years ago

This is more of a "don't let various government agencies neglect their infrastructure while hosting extremely sensitive information about you" sort of situation. Really the bigger concern is that a ton of infrastructure is at risk of getting held hostage.

microcolonel3• 7 years ago

Stop building the infrastructure, it is worse than nothing. They clearly don't have any interest in taking responsibility for securing these systems, which is why the friendly headline is "U.S. Cities Strain to Fight Hackers" and not "U.S. Cities divulge sensitive information to criminals through a pattern of routine incompetence.".

Bakary• 7 years ago

This is like abstinence for STD prevention. Simultaneously true and irrelevant to the problem at hand.

newswriter994• 7 years ago

AP style should really push journalists to use the term "cybercriminals" over "hackers".

I'm not the first to say it but the issue is growing, and it's only going to make the public more leery of any tech-minded but innocent kid or professional pentesting adult who uses the term "hacker".

surge• 7 years ago

Journalists aren't that bright, they get confused at the difference.

duxup• 7 years ago

Even in tech circles the terminology is pretty mixed usage wise.

stochastic_monk• 7 years ago

Some are brilliant (e.g., Ronan Farrow), but the real point is that they’re speaking to an audience which they’re essentially trying to coddle because the audience isn’t comprised of experts.

newswriter994• 7 years ago

Probably worth noting I've been in journalism going on a decade now.

It's a bit too easy to simply write off ALL journalists (no pun intended) as "not that bright".

You may as well say most people aren't that bright. Which would be equally unfair.

Likewise, how can you stick a small-town reporter who covers highschool basketball in the same list as a New York Times reporter with an Ivy League background in economics? Make no mistake, I'm not implying the latter is somehow superior to the former, but there is a huge range between the people who make up the journalism industry.

dang3• 7 years ago

"Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something."

https://news.ycombinator.com/newsguidelines.html

Avery3R• 7 years ago

Everyone in the industry thinks that anything with "cyber" in the word is either a joke, or is made up by government types that don't really understand computers.

newswriter994• 7 years ago

I wonder how William Gibson feels about coining "cyberspace" only to live in a world where "cyber" has been reduced to chat room banter and low-brow humor.

axaxs• 7 years ago

I'm not sure I agree. I think 'hacked' is widely enough known with its negative connotation. If Google posted a blog titled 'We got hacked', everyone would immediately click on it and their heart probably skip a beat. And in English it only makes sense that who hacks, but a hacker.

Regardless of original meaning, as happens with language, words definitions change based on usage and common understanding. I think the 'hacker' battle has been lost, and those examples you listed should use a different term that would be more easily adopted.

wutbrodo2• 7 years ago

Fwiw, I started reading Hacker News ~8 years ago, fresh out of a CS degree and working in tech, and it was my first exposure to a word sense of hacking other than illegal access. I've used the term pretty differently in the years since, but I think the battle for the mainstream meaning of the word was lost long ago.

DyslexicAtheist• 7 years ago

any non paywalled links?

oldjokes• 7 years ago

Replace "cities" with "any organization that is not tech first" and you'll still find hundreds of win 7/vista/xp machines that have never been patched, and ad-hoc network closet/cloud hybrid rigged solutions for everything.

There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so. You need thousands of smart people going through every machine, all the software, all the systems. These people are never going to work for Baltimore or for Maersk, not in a million years.

Instead let's create a new government agency or pivot the NSA from it's dumb paranoid reactionary posture to more of a proactive NIST-style advisory role on best practices, have them hack everything domestically and start fixing things as their core mission. Make sure nobody at state or DHS or justice can subvert this new agency, they need to stand on equal footing with any company or agency.

Then hopefully pillage all the miserable smart people who are currently working at mega corps and agencies who actually want to do positive, meaningful work for a change.

Problem solved someone hire me to advise on their political campaign.

qaq• 7 years ago

"any organization that is not tech first" - thats pretty optimistic looking at a number of the tech first companies that have being breached.

peterwwillis3• 7 years ago

I don't know why you got downvoted. I know plenty of companies with modern tech that absolutely suck at security. Security is just hard, and it's not easier just because you're a tech company.

By comparison, if you spend billions of dollars on a modern building, I can still probably break into it with just a can of compressed air. I doubt the design plans for the building included "mitigate compressed air attacks", and it's the same with every other kind of organization.

at-fates-hands• 7 years ago

Instead let's create a new government agency or pivot the NSA from it's dumb paranoid reactionary posture to more of a proactive NIST-style advisory role on best practices

It's similar to working in infosec though. You do the pen tests, you find and identify the vulnerabilities and write up your report.

Then its up to the municipal entity to put whatever your recommendations are in place to fix what they found. I have a large number of friends in the community who say they can do the work and identify issues, but often times, they come back six months or a year later and stuff they highlighted as critical fixes were still not taken care of.

It's the old, "You can lead a horse to water. . " saying, right?

The real issue is how you implement these fixes on a continuous basis to keep the network safe?

Kalium3• 7 years ago

Advising companies that they can and should fix things is actually the easy part. Getting things fixed in a way that makes companies happy is actually incredibly difficult. You're proposing a government agency get its hands dirty fixining thousands upon thousands of bizarro line-of-business applications and mission-critical excel macros. Convincing companies to update what they see as systems that "work just fine" tends to be a Herculean task even when you can make a business case for taking on the expense and risk.

Telling a company "The government says you have to patch and is offering to do it for you" seems like it might not go over quite as well as you might hope. I can already see the first thought - "Do they actually care if all my systems work the way I need them to afterwards?". Having worked in Information Security and offered to fix things for people, my experience is that entities going for this is extremely rare, even when it's just the next department over.

As for the NSA, well, getting them into a proactive posture is a wonderful idea! It's such a good idea that the US government decided you were right decades ago. And acted accordingly. This tends not to make the news, so many people are understandably ignorant. For example, the NSA publishes information assurance best practices: https://apps.nsa.gov/iaarchive/library/ia-guidance/ia-standa...

helen___keller• 7 years ago

Convincing companies to update what they see as systems that "work just fine" tends to be a Herculean task even when you can make a business case for taking on the expense and risk.
Telling a company "The government says you have to patch and is offering to do it for you" seems like it might not go over quite as well as you might hope.

I think a better idea is to have the new agency play an advisory / supplemental role but otherwise place the burden of fix on the company itself. It just needs teeth for entities unwilling to adequately resolve their IT failures.

The EPA will bring suit to companies polluting illegally. Why shouldn't a government agency bring suit to companies or cities risking a leak of hundreds of millions of social security numbers, for example?

__jal• 7 years ago

It's such a good idea that the US government decided you were right decades ago.

Perhaps, but it is hardly a universal belief that they have the balance right.

It is hard to pick a starting point to get in to this discussion, because it has been going on for a long time and is really complicated, not to mention largely classified. Perhaps one that dovetails into the encryption debate will be as good as any:

https://www.lawfareblog.com/good-defense-good-offense-nsa-my...

solotronics• 7 years ago

Hack things apply crypto locker and unlock after the user does a a free cyber security training course.

ethbro• 7 years ago

This will only be a solution if it addresses the "business critical application, vendor has gone out of business, no source code available" case.

Which ultimately comes down to "Who's going to pay for a more secure replacement?" & "Who's going to assess heavy-enough fines to force the replacement risk scales in favor of doing something?"

enraged_camel• 7 years ago

No need for a new government agency or program.

We just need to start holding all organizations, and specifically their leaders, personally liable for security incidents.

Once people's freedoms are at stake, everyone fall in line so quickly that we will all be amazed.

cabaalis• 7 years ago

Why am I not surprised that the comment saying no need for government intervention is the one comment that's downvoted?

While I typically believe smaller government is the answer, I would personally welcome a regulatory framework that gives me confidence in both my own organization and every other one as well.

It wouldn't ruin my business, it'd just be another line item in my budget.

DataWorker• 7 years ago

“Make sure nobody at state or DHS or justice can subvert this new agency, they need to stand on equal footing with any company or agency.”

That’s going to be a problem. It’s a zero sum with power in dc and if you can solve that you will be fixing more problems than domestic info sec weakness.

Spooky232• 7 years ago

That just perpetuates the problem.

Smaller cities don't have the financial wherewithal to competently run internet-facing services. Usually the best administered parts of a city are in police departments where sworn officers are filling IT roles, aided by injections of grant-driven projects done by consultants. That's not a good situation for anyone. The winning move is not to play.

I regularly hire people from cities and school districts due to some unique aspects of my workplace and benefits that makes it a smart move for them. We routinely take folks in senior tech or director roles and drop them into entry level titles -- and they are very happy to get significant raises.

End of the day, the "fix" is to dump money into rolling out modern solutions. Every user-facing city IT function should be delivered on an iPad or Chromebook.

knightofmars• 7 years ago

"...dump money into rolling out modern solutions."

Yep. Ongoing maintenance and pro-active replacement is a cost. A cost that needs to be solidified as an ongoing expense. A lot of the people in leadership positions see technology as a one-time cost. ("I still have the computer I bought 10 years ago at home! It works just fine. Why do we need to buy new computers?")

stcredzero3• 7 years ago

Usually the best administered parts of a city are in police departments where sworn officers are filling IT roles, aided by injections of grant-driven projects done by consultants. That's not a good situation for anyone. The winning move is not to play.

How about turnkey police department SaaS, delivered over a separate network over low orbit satellite connections? That will be separate from the public-facing police SaaS apps.

trimski• 7 years ago

Make sure nobody at state or DHS or justice can subvert this new agency, they need to stand on equal footing with any company or agency.

Interestingly, a service similar to what you described is already offered through DHS:

https://www.us-cert.gov/resources/ncats https://www.dhs.gov/cisa/cybersecurity-assessments

nickpsecurity2• 7 years ago

"There is literally no way to fix all this dumb fragile infrastructure without a massive government program that accepts responsibility for doing so."

Regulation and/or software liability. So far, they can ignore security with it rarely costing them anything. In a few industries, ignoring safety will cost a lot. So, they spend a fraction of that cost on preventing the overall cost. It might also be a requirement of even selling the product. Basic stuff like memory safety, login practices, updates, and so on being a requirement could get the bar way up. It was done before under TCSEC with DO-178C doing it now for safety. A whole market of safe products formed.

Alternatively, people do a strong push in courts to hold companies liable for any time their computers are used to attack a 3rd party. The folks suing and experts testifying focus on the core practices that prevent most problems. The argument is professional negligence. We stay on them until the risk-reward analysis for information security has executives making sure it gets done with specific stuff in the lawsuits addressed. Since that stuff is 80/20, then it solves about 80% of the problems. The new incentives might also make it easier to convince them to partly or wholly use systems like OpenBSD, QubesOS, and Genode.

Although I favor regulation, I think the lawsuit strategy should get a lot of experimentation first. It doesn't require a change in government. Just good lawyers. :)

codemac• 7 years ago

"any organization that is not tech first"

Then why do all the tech first companies keep getting hacked too?

stcredzero3• 7 years ago

They're not that much harder to hack, and they have more tech to hack. It's just that your dusty old city desk is even more hopeless.

rudolph9• 7 years ago

Have the NSA attack domestic systems and make the ransom fixes for the the vulnerabilities they just exploited! haha, might just be crazy enough to work

nickpsecurity2• 7 years ago

(Forgot to respond to part about a government organization to get secure products out. Here's response to that.)

It's been done before. It was the Walker Security Initiative. It resulted in some of the most secure products the market ever produced. A combination of lobbying for insecure products to be bought and NSA's actions destroyed what little there was to the market. Bell describes it:

http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...

Just found a link with examples of what they were doing. I haven't read this one fully, though. Linking it mainly because it talks about CSI and how market was responding.

https://csrc.nist.gov/csrc/media/publications/conference-pap...

Here's some of the designs that came out of commercial sector of high-assurance security:

http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf

http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A...

https://cryptosmith.com/mls/lock/

https://www.researchgate.net/publication/3504794_The_Army_Se...

http://cap-lore.com/CapTheory/upenn/

Note: I don't think KeyKOS itself came from that community. It was from capability-security field. KeySAFE extension was driven by TCSEC requirements, though.

http://webapp1.dlib.indiana.edu/virtual_disk_library/index.c...

Note: Although not first attempt, Trusted Xenix was first attempt at securing UNIX that made it to market. Available from 1990-1994 I think. Coincidentally, OpenBSD starts in 1994 to go even further.

stcredzero3• 7 years ago

Why not? Just 80 years ago, people would have laughed at you if you told them that computer techs would have stores everywhere, every 1st world household would have more than one, and that most office jobs would require some form of basic computer literacy. Just 150 years ago, cars everywhere, owned by most everybody, with everybody capable of taking a 100 mile trip on a whim, would have sounded like Utopian pie in the sky fiction. I'm sure someone said there's no way the everyday Joe and Suzy would be able to maintain a car. In the Ford Model A days, some people would hang a bulb of garlic under the hood to "cure" their car.

A few things could happen, analogous to the progress made by cars and also analogous to what's happened so far with computers: 1) The "packaging" will change, so that higher levels of security maintenance will be greatly simplified and more accessible. (Which might mean that everything is administered centrally to an even greater extent. i.e. Stadia and O365. Maybe O365 over something like Stadia?) 2) Security tools will advance. (SSH vs. Telnet, HTTPS vs. HTTP, and TFA have raised the bar for an exploit.) 3) The culture will become more computer savvy.

It's understandable that you're frustrated, because this sort of progress is going to have a generational component, which is orders of magnitude slower than technological progress.

bluedino3• 7 years ago

Can we partially blame IBM?

Every municpality I've worked for runs a majority of their systems on the IBM System i (iSeries, AS/400)

IBM is very slow to update any of the tools for Windows that are included with these systems. Ditch the green screens, use the IBM EasyAccess or whatever they call it on Windows, you just saved some $.

Now, there are database tools and admin utilities that are also included in this. Most of them don't work with anything after Windows XP, so you're in a position where you can't upgrade to securable versions of Windows, because you'll lose IBM access.

freehunter• 7 years ago

We can partially blame every software vendor that’s ever existed. In 10 years we will be blaming Google for applications that only run on outdated versions of Chrome because the API the developer used only existed in Chrome and wasn’t accepted into the standard and then was removed a few years later.

Everyone does it and everyone will do it.

Shivetya• 7 years ago

Oh let me rush to defend my favorite platform, the iSeries.

The platform, regardless of which, is not to blame. It is the laziness of most IT shops which either don't have any process in place or only pay it lip service.

iSeries machines (AS/400) serve many different client interaction methods, from green screen, web services, ODBC, NodeJS via Qshell, and more. If employed properly the iSeries has some of the best security in the industry, reason why many are used by banks all over the world, hospitals, the gambling industry, and more. Failure occurs for the same reason it does anywhere else, not having a process in place and following it.

As for currency with what is available today, iSeries access is facilitated through a JAVA based client which works on Windows, OS X, and Linux. It is the same java application throughout and even provides ODBC access through java drivers and for windows you can opt into a subset of windows exe/dlls. There is a full blown web service hooked to it as well that runs on the server as needed. It is up and down fully SSL too.

wutbrodo2• 7 years ago

Then hopefully pillage all the miserable smart people who are currently working at mega corps and agencies who actually want to do positive, meaningful work for a change.

Oof, if you think being a smart technical person working at a megacorp is worse than being a smart technical person working for a government agency... I have no idea what your model of the world and labor market is.

cheez• 7 years ago

The one where he is from the government and is here to help.

noir_lord• 7 years ago

You just described where I work (small manufacturing company) when I started.

It's taken me 18mths to significantly improve our security posture and I still have a bunch of stuff I need to do (I was hired as a programmer but I couldn't in good conscience leave it as it was).

nwallin• 7 years ago

government program that accepts responsibility for doing so.

We already have that.[0] But it doesn't do any good, because it's purely advisory, but they need regulatory and enforcement power. We need an SEC for cybersecurity. Obama put Rod Beckstrom in charge of the National Cybersecurity Center, and that was great, but he resigned after a year because there was no funding behind it. It had been limping along since, but Trump deleted the position about a year ago.

The point is, if we want to fix this problem, we need the political will to hold people accountable instead of just telling people to not do stupid things. IT and Legal are cost centers in 99% of organizations, the difference is that if Legal and IT tell the C-suite "We need to do X or else bad things will happen" Legal gets listened to but IT doesn't. This is because if Legal's "do X" fails, the outcome is an expensive lawsuit, but the outcome of IT's "do X" is a blog post about their continuing commitment to the safety and security of their customer's privacy.

[0] https://en.wikipedia.org/wiki/National_Cybersecurity_Center_...

tsss• 7 years ago

I'll happily work for Baltimore if I can implement something that will finally put all their corrupt cops and judges on the gallows.

Some distributed logs that can't be deleted would surely help with accountability.

But we all know that will never happen.

gist• 7 years ago

You need thousands of smart people going through every machine, all the software, all the systems. These people are never going to work for Baltimore or for Maersk, not in a million years.

I love this assumption that anyone smart or anyone good would automatically be working for another company or at another job. Not only is that just screwy off the top (assumes that smart people automatically can move and relocate to the most desirable job - even geographically) but it also assumes that anyone with any skills would never ever work in that type of situation to begin with. [1] Maybe there are good people that are working there but a government situation like the city of Baltimore is not chock full of the type of money required to actually fix a problem like that or ever Maersk management does not view it as a priority in any way. You know not every job is in a startup that has been VC funded and can afford to lose money ditto for a traditional company such as Maersk. Noting of course that the 'best and the brightest' that work for some of the 'top companies' are kind of screwing up frequently. Not to mention MSFT 'top' designed much of this hackable code at one point.

[1] Attorneys are often like this as well the halo of a top firm means if you are operating out of a storefront you must be stupid in some way otherwise you'd be working at one of the top shiny law firms.

mycall• 7 years ago

Most enterprise hacking come in through emails. Should NSA deliver SPAM to make this happen? idk

javagram• 7 years ago

These type of organizations probably need to be running all chromebooks with a G Suite enterprise account (configured to require all employees to use 2FA). Something that has way less attack surface than what they have now.

bytematic• 7 years ago

Imagine getting/teaching them to use G Suite accounts, something I've attempted once. I thought it would be the easiest possible transition

Kurtz792• 7 years ago

Could someone suggest recognized and useful certifications, for those interesting getting into cybersecurity?

The article has a link to another mentioning CompTIA and CISSP, are they any good?

dsr_• 7 years ago

CISSP is good for getting hired. I'm not sure it proves much about your skills, so much as your vocabulary.

neuralzen• 7 years ago

CompTIA certs are a mixed bag, some are decent, but many are very surface level. CISSP is broad, and more managerial level, but certainly worthwhile. But if you'd like some in the trenches stuff, I'd suggest the OSCP.

driverdan• 7 years ago

Study to learn skills, not to get certs.

Kurtz792• 7 years ago

Any suggestion on good study material, then?

A lot of resources seems to be more like games than something applicable to the real world.

true_tuna• 7 years ago

Stop posting WSJ paywall articles. This isn’t a paywall advertisement service.

dang3• 7 years ago

If there's a workaround, it's ok. Users usually post workarounds in the thread.

This is in the FAQ at https://news.ycombinator.com/newsfaq.html and there's more explanation here:

https://news.ycombinator.com/item?id=10178989

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

craftyguy2• 7 years ago

If there's a workaround and it's not hard for people to find it and paste it into the comments, then it's not hard for people submitting articles to post the non-paywall version in the first place.

neonate• 7 years ago

http://archive.is/AXk1l

parliament32• 7 years ago

Paywalled, non-paywall link:

https://www.wsj.com/articles/u-s-cities-strain-to-fight-hack...

https://archive.fo/AXk1l

bluedino3• 7 years ago

I'm painting with a broad brush here, but a lot of government employees do as little as possible. They are union protected, so they can stay in their jobs for a very long time. So you get a lot of the thing in IT where someone has 20 years of 1 year experience. I'm sure the budgets aren't great and the rest of the government isn't pushing tech, but you end up with a lot of 'it works fine just leave it as is'

moosey• 7 years ago

I'm painting with a broad brush here, but a lot of government employees do as little as possible.

Welcome to humanity. How many people actually devote their lives to the improvement of the human condition, or have a devotion to even the jobs that they are working for? I fear that treating your job with the devotion necessary to do it truly effectively means that you limit yourself and future opportunities, because you must devote time to your own growth.

And how many people are interested in devotion to any cause or personal growth? Personal growth is hard, and devotion to a cause, a serious one especially, is equally painful. Understanding climate change, for instance, is so painful that people reject it in its entirety; it could be because it is a direct refutation to their world view, or because the idea is just so uncomfortable on its face.

I feel as if Ada Palmer had it right when she suggests that the first rule of Utopians must be "I hereby renounce the right to complacency, and vow lifelong to take only what minimum of leisure is necessary to my productivity, viewing health, happiness, rest, and play as means, not ends".

I think that's too much weight for the vast majority of humanity, and understandably so. In America it feels as if the way society is structured is designed to sap willpower (for example: the Atomic Family). I can think of a number of reasons why this might actually be the planned outcome of its current design.

nwalker85• 7 years ago

There is a big industry starting to spring up around this, data insurance. Go to any big insurance conference and all they are talking about right now is cyber insurance. Construction companies are asking for it for example; they've always had to insure their employees, but now they are seeing things like their offices being hit by cryptolockers and being extorted for bitcoin by Russians. They can't afford to lose productivity over something like that so they are getting insured. Those insurance agencies are working with security consultants to help harden the networks too. So yes, this is definitely a big problem, but the wheels are already moving to start addressing this issue, because there is money to be made.

thephyber• 7 years ago

It's not clear how valuable cybersecurity insurance will be if there is no coverage for "acts of war" or if the insurer claims the insured didn't do enough to protect/defend against it. [1]

[1] https://www.lawfareblog.com/moment-truth-cyber-insurance

4ntonius8lock2• 7 years ago

I'm surprised no one has mentioned it here on hacker news.

But when CFAA makes all hacking criminal, the only hackers left are criminals.

Ethically motivated hackers should have the same protections as whistle blowers - The day that happens, the world becomes more safe and transparent.

But transparency is not what everyone wants, obviously.

I wish I was more surprised that mainstream media fails to mention this important part of the state of cyber security in the US.

AgentME2• 7 years ago

In the process of using a town's court website to try to pay a parking ticket, I practically-accidentally found a security vulnerability in it. The vulnerability immediately showed me many people's personal information. I closed the page when I realized what had happened. I didn't report the issue because I was worried that the people running a small town's buggy court website might be more interested in figuring out what laws I broke than understanding the issue. I'd rather have nothing to do with it. It's the only time I haven't reported a security vulnerability I've found. I'm probably over-thinking it, but when there's other groups that invite vulnerability reports and even give bug bounties, it just feels like an unnecessary risk reaching out to ones that don't.

4ntonius8lock2• 7 years ago

Over thinking it? I don't think so.

35 years of jail time has a powerful chilling effect.

How this article could talk about the 'surprising' lack of ethical hackers without covering this law and it's abuse is beyond me.

It's like talking about the 'surprising lack of research into clinical MDMA studies' and not talk about the war on drugs. It's like they are intentionally ignoring the HUGE elephant in the room.

elipsey3• 7 years ago

How many $40K ransoms would an org have to pay before it was cheaper to have a security team? The demands might be small to make it cheaper in the short term to pay instead of try to fix the problem. Obviously there are large costs external to the ransom payment, but you don't have to get those funded via political process.

Also, in my experience working for state government, engineers were considered a waste of money. Hiring was difficult because they wouldn't pay anywhere close to the market rate, and techies weren't allowed to earn more then managers. There was a parade of sales people pitching the director to lay off the devs and outsource everything, and then pat each other on the back for "slashing government waste." It seems like most of their apps should in principal should not need to have been completely reinvented from scratch, but having people who don't work here responsible for security causes an agent-principle problem; from the point of view of the contractors who don't care about your security and the bureaucrats who don't understand it, everything except management is just a cost center.

If you do manage to fix anything, the new director will throw it away and start over with a new vendor contract next election. Also, if you are paid by the gvt and are not a cop or a politician, you will be despised as a "useless feeder" and face the risk or furlough, de-funding, re-org, hiring freezes, etc, that make it hard to reliably get anything done.

If the public doesn't want a public sector, why fight them by trying to work there?

I think Schneier was right to point out that security is an economic externality, and that a high level political solution is likely necessary.

https://www.schneier.com/essays/archives/2007/01/information...

EDIT: A couple of people here have pointed out that a "cyber" insurance industry is emerging. I find this encouraging because it at least seems possible for that to be a politically acceptable mechanism for pricing security; your premiums could be contingent on compliance as determined by the insurer, who has skin in the game to understand security and hire real professionals as auditors. I'm not sure how that translates to actually fixing security, but it seems like a start.

meesles• 7 years ago

100% agreed. I've always found it very ironic that governments want the best and brightest when they never pay market rates. Not only do they want the best and brightest, they want them to selflessly serve their country at the cost of financial advancement. Is it surprising that they end up getting the lower end of the crop?

https://18f.gsa.gov/ was a fantastic move and exactly what we need. Unfortunately, it took a group of extremely successful private sector individuals to give up their careers temporarily in pursuit of fixing something.

elipsey3• 7 years ago

Thanks, that's an interesting story, and a cool idea. My experience was before I got to SF, so there was really not a lot of local talent around.

I was an intern back then, and I liked my boss and my team, and what we were working on. I got an offer for a mid-level position, but I went elsewhere partly because of the apparent instability.

tedunangst2• 7 years ago

Just as there's no time to do it right, only time to do it over, there's never money to do it now, only later.

elipsey3• 7 years ago

You have obviously worked for that state. :)

U.S. Cities Strain to Fight Hackers

Related Stories