Re: not enough talent
So....security is JUST ABOUT companies...
Nope, it's about concentration of risk, and how to mitigate those...
What about actual citizens? You know, people who need secure credit cards, secure bank accounts, secure medical records....
... because the impacts can be huge. So Optus had a bad day a short while ago and it's network went down as well. All the stuff dependent on Optus and Kyivstar had a bad day. In Ukraine, that may have lead to people being targetted, or just denied alerts from their air defence network. Because people know there's value in attacking some companies, they'll do it for extortion, lolz, or because there's a war on. Where there's a concentration of risk, governments may decide it's critical infrastructure and impose requirements, like vetting staff in key roles. But that doesn't always work, eg Snowden, Manning etc.
Those are the hardest to defend against, ie staff need access to systems, so there has to be a level of trust. Both Snowden and Manning had high levels of trust, but abused it. That's hard to predict, although there is stuff like MICE (Money, Ideology, Conscience or Ego). That may have played a part in Kyivstar, ie an insider disagreeing with Kiev, or sympathetic to Russia and decided (or was persuaded) to help, as well as all the external threats from hackers.
So then it's about taking a holistic approach to security. A lot of companies don't do that very well, ie lack of internall firewalls or security devices. But that gets expensive, ie designing a system that can monitor critical systems for tampering. Or having strong change control processes to check and approve changes, or just let neteng's alter BGP configs on core devices and the inevitable happens. The attack on Kyivstar looks like it happened over quite a while, so how internal audit processes and systems may have prevented that. Which is an expensive, and often people-heavy process, ie accessing subscriber info is necessary for X staff, copying a million subscribers info to a USB device is something to be concerned about.
So how do you mitigate those risks? Especially when there may be conflicting legislation. So workplace surveillance is a complex subject, failure to secure personal data is perhaps less complex and the consequences expensive in financial and reputational concerns. Vetting staff might be compulsory, if aspects of the business are classified, but can be imperfect, or conflict with legislation. Kyivstar could have dismissed 'Russian' or 'pro-Russian' staff. but that's discriminatory, even if it may improve security. Sometimes it may not be possible to properly vet staff anyway. In the US, Orgeon passed gun control legislation that required an FBI background check. FBI pointed out that that's probably illegal.
So it's a wicked problem to solve, but it doesn't mean that businesses shouldn't be doing a lot better.
Biting the hand that feeds IT
