Imagine a government that told Big Tech to improve resilience – then punished failures South Korea's Ministry of Science and ICT has reportedly told local web giant Naver to improve its disaster recovery capabilities after not taking adequate measures to prevent service failures. The move reportedly follows a June on-site inspection that revealed Naver's disaster management plan was lacking. The biz had a system …
When I read about governments doing infosec audits, I always wonder if they are the insurance company tick-box-style audits.
You know:
[ ] Enforces-complex-passwords and minimum password length
[ ] Admins must have "peon-level" account to do ordinary biz on, not just root/Administrator-level accounts
(Etc.)
... but can still pass the audit when passwords are sticky-note attached to monitors, bottoms of keyboards, etc.
Imagine a country that has a monster corporation that runs in parallel of the government and where a stern talking to is less of a consequence than has been dolled out to the leaders of that same monster corporation by the government in the past. If sending people to prison isn't a deterrent, a strongly worded report is going to be met with panic and horror.
... When you're a twelve-year-old company, you are no longer a startup. You won't have been a startup for at least 6 years. Just sayin'...
And good on the SK government for starting to chase companies on resilience. Oh how much fun it would be if the UK government actually tried something like this... they'd probably have to sort their own house (i.e. the government departments) out first!
Another option is to institute fines and C-level exec personal responsibility for cockups. Some things wind up affecting an entire country such as when Crowd Strike had issues. There should be a certain enhanced level of responsibility when a firms products and services are so entrenched that their failure causes significant problems for lots of people as part of the collateral damage.
Aside from critical business such as banking, which surely already has a regulatory framework. Why do they care?
One would expect the government's own essential services would check thoroughly any providers and make sure their own designs are resilient?
The rest is down to market forces. Bad businesses will go bankrupt at some point and it may be that some citizens will accept the risk for cheaper. Will they make shops have spare premises in case of flood/fire/riots?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
