British govt agents step in as Harrods becomes third mega retailer under cyberattack

Harrods, a globally recognized purveyor of all things luxury, is the third major UK retailer to confirm an attempted cyberattack on its systems in under two weeks. It confirmed the incident in a statement, hinting that, like Co-op's case earlier in the week, the attack may not have been successful. "We recently experienced …

[abend0c4]

We can't continue to regard these simply as "IT Problems"

The failure of the electricity grids in Spain and Portugal has amply demonstrated our dependence on a whole variety of technologies and our lack of preparedness for their inevitable failures. Although failures are relatively rare, their effects can be very pervasive and prolonged.

Although there are technology weaknesses that need to be fixed, it seems like much more work needs to be done to ensure business processes can continue when things go wrong. That might come at some cost and inconvenience by deliberately introducing barriers between system components that have previously been integrated for operational efficiency to reduce contagion and offer more points of human intervention for remediation. However, considering the increasing number of incidents and the increasing dependence on a relatively small number of platforms, there's a growing risk of sudden economic damage equivalent to that of a major natural disaster.

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

That's the problem: Management don't fund any preparitory/defensive work before any attack as they feel it's scare mongering by the techies so money down the drain. It's only once they've been hit does management really understand the consequencies.

My place was hit a while ago and money was suddenly flowing on IT security initatives,

There's an arguement to be had that every organisation should endure at least one painful cyber incident.

[ffRewind]

Re: We can't continue to regard these simply as "IT Problems"

I totally agree, coming at it from the position of selling equipment that performs a critical function in national and international telecoms networks, we always provide options that include greater resilience and with enhanced monitoring and management to find issues early and fix them when they do. The network designers and engineers nearly always understand and will agree on a well engineered solution and when it comes to sign off by the accountants the questions gets asked "what is the ROI?" (there isn't any), "this extra stuff is only costing more to run", etc. etc. and of course they are right, and of course we want to sell as much as we can, but the state things get pared down to because it's classed as an overhead to be reduced is frankly scary sometimes - the issue of what it will cost if there is a problem doesn't seem to feature.

[I am the liquor]

Re: We can't continue to regard these simply as "IT Problems"

It's possible - though not necessarily easy - to quantify this sort of thing in a way that the bean counters can understand.

First, how likely are we to be on the receiving end of a successful cyber attack? Let's say 5% of companies like us have been hit by cyber attacks in the last year. That means there's a 5% probability that we will be a victim in the next year.

What's the impact if we are? Let's say, for the sake of argument, we expect the loss of business, loss of reputation and recovery costs will total $100m.

Thus in an average year, we lose $5m to cyber attacks. That immediately sets a ballpark for the kind of money it would be reasonable to spend on defence.

Suppose the "enhanced monitoring" option reduces the likelihood of a successful attack in any given year from 5% to 4.9%. That's saving you $100k/year. Does the enhanced monitoring option cost less than $100k/year?

Of course coming up with the numbers to put into this calculation is a challenge. Though it becomes easier if you treat them probabilistically rather than trying to nail down a specific number.

The above is very much a broad-strokes illustration of the principle. If you're interested in this sort of thing, I recommend this book:

https://www.amazon.co.uk/How-Measure-Anything-Cybersecurity-Risk/dp/1119892309

[Excused Boots]

Re: We can't continue to regard these simply as "IT Problems"

"It's possible - though not necessarily easy - to quantify this sort of thing in a way that the bean counters can understand."

Yes, but I do think it is far, far harder than you imagine. The very instant you talk about statistics, ie the probability of ...., their eyes glaze over and you have lost them! Sorry, you aren't wrong but it is simply them way they think.

"Thus in an average year, we lose $5m to cyber attacks. That immediately sets a ballpark for the kind of money it would be reasonable to spend on defence."

OK now the problem here is a lack of understanding of statistics and risk, so, for example you present this and the bean counters say "but last year was an average year and we didn't lose $5m ao you obviously done't know what you are talking about", moving on....

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

"The very instant you talk about statistics, ie the probability of ...., their eyes glaze over and you have lost them! Sorry, you aren't wrong but it is simply them way they think."

What an odd statement. It's literally the way beancounters think - statistics probabilities and risks. That's what they do. They analyse, interpret, draw conclusions and make budgetary decisions based on these conclusions.

[JulieM]

Re: We can't continue to regard these simply as "IT Problems"

No. That's the way you'd like to imagine beancounters think.

In the real world, beancounters are looking at products and thinking "We sell a lot of these. If we could make each one of them just a penny cheaper, I could be that many pence richer!"

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

And how do you think they figure out whether they can make them cheaper, and how much richer they could be? Exactly.

[JulieM]

Re: We can't continue to regard these simply as "IT Problems"

By taking away one piece at a time until it no longer works?

By asking the engineers if a circuit really needs that resistor there, or if this part could be made from plastic instead of metal, and could we do away with this LED (which alerts the user to a problem with external equipment, and in conjunction with a paragraph in the user manual, helps avoid unnecessary service calls) and save a hole (which gets punched anyway when the front panel is stamped out; it's not a separate operation)?

The engineers who designed a product in the first place almost certainly already tried to avoid unnecessary expense wherever possible, by sheer force of habit on account of what they get paid.

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

"The engineers who designed a product in the first place almost certainly already tried to avoid unnecessary expense wherever possible, by sheer force of habit on account of what they get paid."

No. That's the way you'd like to imagine engineers think.

[Roland6]

Re: We can't continue to regard these simply as "IT Problems"

Trouble is those bean counters have grown comfortable about risk:

What’s the risk and impact of the electricity going off? Not sufficiently high to warrant paying out for UPS etc.

What’s the risk of the Internet connection failing? Not sufficiently high to warrant paying for dual routed connections etc.

What’s the risk of a server failing? Not sufficient to warrant paying for standby systems…

The trouble is much in IT is too reliable, leading to people to consider investing in prevention as being an unnecessary expense. I expect such companies only buy insurance because it is a legal requirement.

In some respects Covid was over too quickly, as I suspect the issues it created with respect to business continuity were over too quickly and didn’t impact enough businesses to register, thus have been forgotten about. (Aside: Remember it was practically impossible to buy basic things like SIM cards, so if your business continuity plan involved someone nipping out to the shops to pick up a SIM card or getting a replacement piece of kit shipped for next day delivery…)

Thus for cyber security it is going to need some very high profile business failures and eye watering recovery costs for business leaders (and “investors”) to take matters seriously.

Aside: I wonder if cybersecurity and business continuity are covered by modern MBA courses…

[Doctor Syntax]

Re: We can't continue to regard these simply as "IT Problems"

Thus for cyber security it is going to need some very high profile business failures and eye watering recovery costs for business leaders (and “investors”) to take matters seriously.

Preferably followed by directors being prosecuted for not discharging their fiduciary duty.

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

It would be good if they did that from a perspective of prevention, not from an angle of how much cutting they can get away with without taking the blame when the inevitable happens.

Banks have been doing this for ages too, that's why there is now such a painic about DORA. Actually, it's worse, not only do they have to correctkly fund protection, in some countries we're taling about personal liability if things go wrong. That's IMHO the main cause of tha panic: the ability to hide behind company or committee has been significantly reduced.

[Alan Brown]

Re: We can't continue to regard these simply as "IT Problems"

Personal liability has consistently proven to be the ONLY way to achieve widespread compliance.

I still recall a company-wide communique which begane "As I have no desire whatsoever to find myself spending time at Her Majesty's pleasure for actions of my employees, the following actions are expressly prohibited and will result in summary dismissal if discovered" - proceeding to list 2 dozen things which were common practice amongst sales & marketing departments

[nonpc]

Re: We can't continue to regard these simply as "IT Problems"

"What an odd statement. It's literally the way beancounters think - statistics probabilities and risks. That's what they do. They analyse, interpret, draw conclusions and make budgetary decisions based on these conclusions."

No - actuaries (certainly for forecasting and assessing pension fund liabilities) do that. Oddly actuaries deal in in theoreticals and bean counters deal in actuals... Bean counters apply the 'you didn't spend it last year so you didn't need it and won't therefore need it next year' in budget forecasting.

[Emir Al Weeq]

Re: We can't continue to regard these simply as "IT Problems"

Boots and Liquor, you are both right of course. I would follow the "moving on..." with a request to make sure that's minuted.

Also ensure that the design document's second draft's history includes "hardening/resilience removed at the request of A. Countant" and be sure that A. Countant is in the final design's sign-off list.

Keep all design drafts and the emails circulating them.

CYA.

[JulieM]

Re: We can't continue to regard these simply as "IT Problems"

The problem is that these things always happen to other people.

And men who are in the habit of deliberately cutting off the supply of oxygen to their brain with a stupid strip of polyester tied round their necks and dangling down their fronts seem to be fundamentally incapable of understanding that, at least as far as the rest of the universe beyond the ends of their own noses is concerned, they fall under the heading of "other people".

Mind, as long as the product (severity of punishment) times (probability of detection) for pointing out publicly that a brand of locks being widely touted as secure is in fact anything but secure remains greater than the product (severity of punishment) times (probability of detection) for making dishonest use of that insecurity, this is going to continue.

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

"And men who are in the habit of deliberately cutting off the supply of oxygen to their brain with a stupid strip of polyester tied round their necks"

Nice bit of misandry there. Sure you're not just a bit bitter because the pretty salesgirl gets more attention than you?

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

Come on, you have to admit that ties are about the least functional aspect of business attire.

Also, he's clearly taking about middle management. Higher ups use silk ties :)

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

Come on, you have to admit that ties are about the least functional aspect of business attire.

Well, they stop you spilling soup on your shirt....

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

Not if you're wearing a pristine white shirt and it's tomato soup, those two elements appear to build a quantum bond when in each other's proximity that suspends normal gravitic forces.

Any soup you spill is certain to end up on that shirt.

:)

[Doctor Syntax]

Re: We can't continue to regard these simply as "IT Problems"

Avoid soup. For good measure, avoid ketchup.

[Doctor Syntax]

Re: We can't continue to regard these simply as "IT Problems"

"he's"

Maybe I'm jumping to a conclusion here but the poster's handle was JulieM.

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

Exactly. And making it about men is misandrist and sexist. Write it the other way round and see how it sounds:

"And women who are in the habit of deliberately cutting off the supply of oxygen to their brain with their trowelled-on makeup and heels they can't walk on seem to be fundamentally incapable of understanding...

[Doctor Syntax]

Re: We can't continue to regard these simply as "IT Problems"

It was your second sentence which was the problem. Following up a reasonable complaint about misandry with monogeny isn't good, even if it was an attempt at irony.

[Doctor Syntax]

Re: We can't continue to regard these simply as "IT Problems"

Damn autocorrect - misogyny.

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

Eye for an eye. Reap what you sow. Get what you give. Etc etc. No apologies.

I notice you didn't reply to JulieM yourself saying her comment was out of order. When you've done that, you might have some credence in telling me what's a 'problem' and what's not. Until then, behold the fucks I don't give.

[Mrs Spartacus]

Re: We can't continue to regard these simply as "IT Problems"

Ties? Rather plebian, old chap. We VERY senior managers wear a cravat, of course.

[YetAnotherLocksmith]

Re: We can't continue to regard these simply as "IT Problems"

I'm not sure if you mentioned locks as an analogy or not, but I can assure you that every lock on the market plays up their security, and 99% of them have fatal flaws. Some are really subtle and nearly impossible to fix, but the vast majority are broken beyond belief, and worse, many have flaws that should've been designed out *literally hundreds of years ago* rolling off the line to this day, to save 0.02p per lock.

Look for your lock on YouTube, there's probably a bypass video, and almost certainly a picking video. If you can't find a picking video, let me know, and I'll do one for you.

[ecofeco]

Re: We can't continue to regard these simply as "IT Problems"

Only one quibble with your post: management NEVER learns nor suffers real consequences,

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

Senior management possibly. There are plenty of low-level managers who've been caught up in mass layoffs over the past couple of years; in fact they're arguably one of the hardest hit in terms of percentage reductions because that's where big cost savings can be made. Salaries are higher than the rank and file, they're often located in higher cost countries, and the managers themselves often struggle to articulate what exactly would come crashing to a halt if they weren't there. Frontline management is a brutal place to be.

[Alan Brown]

Re: We can't continue to regard these simply as "IT Problems"

The former is inextricably linked to the latter. As soon as personal liability crops up they begind learning proactively

[cyberdemon]

Re: We can't continue to regard these simply as "IT Problems"

> The failure of the electricity grids in Spain and Portugal has amply demonstrated our dependence on a whole variety of technologies and our lack of preparedness for their inevitable failures. Although failures are relatively rare, their effects can be very pervasive and prolonged.

Speaking of which: There was also a fire at one of the most critical 400kV substations which barely made the news a few days ago...

https://www.bbc.co.uk/news/articles/cx2wvz4pjryo

Fortunately it didn't cause a major outage, but this sort of thing is becoming startlingly common

I bet the spooks are, well, spooked.

Once is happenstance, twice is coincidence, three times is enemy action.

[plunet]

Re: We can't continue to regard these simply as "IT Problems"

On the substation fire, I think you're mistaken that it was a 400kV National Grid grid transformer, although it is very close to the St John's Wood 400kV substation.

Aberdeen Place A is actually one of three colocated 132kV distribution network substations operated by UKPN. In this instance there was no disruption to electricity supply. It was an impressive fire and cause some collateral damage to adjacent property and oil pollution into the canal underneath it was seemingly well handled.

[YetAnotherLocksmith]

Re: We can't continue to regard these simply as "IT Problems"

Yes, but why did it burst into flames? They generally don't.

[Lord Elpuss]

Re: We can't continue to regard these simply as "IT Problems"

A few months ago I had the pleasure of seeing a lecture by Baroness Manningham-Fuller, former head of MI5, which ended with a Q&A. There was a ton of stuff she wouldn't be drawn on discussing, but one of the questions from the audience was "What's your view on media conspiracy theories; when something goes wrong or breaks, it inevitably get called out as the work of "some foreign actor"?

Her answer was "Pass. But there are many reasons for calling something a 'conspiracy theory'. Oftentimes it is, but occasionally it's a convenient label. For example because we don't want to rock a geopolitical boat by discussing it or giving it credence."

I found that quite telling.

[Alan Brown]

Re: We can't continue to regard these simply as "IT Problems"

"this sort of thing is becoming startlingly common"

Yes and there are good reasons for it - old age and poor maintenance. It doesn't help that this stuff ISN'T National Grid, but UKPN or other local network responsibility and those have been firmly under beancounter control for decades

"Brazil" was set in a distopian future where this kind of thing was happening regularly and the authorities would blame it on terrorists as a way of maintaining ever-tighter control of the population

BTW: It's worth noting that the 5000 gallons of oil in each one of these ancient transformers is usually heavily laden with polycarbonated biphenols (PCBs) and you DO NOT want to be downwind of them if they're burning

[Anonymous Coward]

Re: We can't continue to regard these simply as "IT Problems"

Four times is incompetence AND enemy action.

[Pirate Peter]

I.T. and business continuity as seen as costs with little benefit (until the shit hits the fan)

the problem is DR / BC is seen as providing little cost benefit by many companies, its a "necessary evil"

DR/BC don't generate income or value for share holders

I.T. systems are also seen as a cost, with little benefit, but when they break or become unavailable everyone screams "we didn't realise they were so critical"

boards and managers need to get on board with cyber security, staff need to do the training about malware, spyware, phishing and ransomware as many attack start with an email or infected file sent to ordinary staff

until the attitude of staff / boards change companies will be vulnerable

[TimMaher]

Fortnum & Mason

At least they are still OK.

[Andy Non]

Re: Fortnum & Mason

Thank goodness, my cat Tiddles III would be most displeased if her caviar didn't arrive on time.

[Excused Boots]

Re: Fortnum & Mason

You haven't mitigated against this by having a stock of F&M caviar?

Just what sort of cat owner are you?

[BinkyTheMagicPaperclip]

Re: Fortnum & Mason

The problem is Tiddles III has developed a taste for fresh caviar and the thought of well, anything tinned rather turns the stomach, next you'll be expect his pussykins to eat dry food!

[Ken Shabby]

Re: Fortnum & Mason

Has Tiddles tried the Pate de mous(s)e

[Anonymous Coward]

Re: Fortnum & Mason

Stupid Americanized (sic) Sensationalized (sic) Story.

Other than normal interest of the security services - and Police - things not being reported as ‘British Govt Agents’ step in’ locally for retail security issues of late

James Bond is not rooting out Scattered Spider so Charlie can swing by for a Royal Curbside (sic) collection.

It’s also a Bank Holiday today. Yay !

[cookiecutter]

Mangement don't care

However sysadmins, I'd just check your domain admin groups this afternoon. See if anything has popped up that shouldn't be there. 3 day weekends & a 4 day week where staff will be on holiday is the prefect time to be encrypting away.

Who knows what one of your Devops morons might have installed from a random github library

[Anonymous Coward]

Re: Mangement don't care

I had a weird external logon attempt from a completely out of bounds country of an external UID that had only been set up for access of a Teams channel two weeks ago.

I'm sure there are plenty of benign explanations for this, but I've seen this too often so I'm going to have a chat with the outfit we're having cvonnections with to see if we can get some truly clever people in to dig this out - I'm afraid I don't have a deep enough skillset to be certain I have covered all the bases.

[andy gibson]

M&S Store shopping - no stock at the best of times

Not sure if any other UK reg commentators can say the same, but my local branch of M&S (Southport) have now stopped selling men's suits of any kind.

The assistants say "go to Liverpool, there's more range there". But there really isn't. I'm not some obscure size - just a regular 6 foot 4 bloke.

The only option to buy a simple black suit from M&S is online. Which I now can't

[abend0c4]

Re: M&S Store shopping - no stock at the best of times

The principle of having a range of stock in store seems to have been abandoned. I've had trouble for years buying items of clothing in specific sizes for elderly relatives. The message seems always be to go online. This presumably must generate a lot of unnecessary returns as a result of not being able to see or try garments in store. There seems to be space - there are even stores where the floor space has been actively reduced - but perhaps there is less wastage overall if the majority of stock is kept centrally.

Having done some work with a clothing retailer there is a genuine problem in matching the size variations in manufacturing orders to the eventual demand. In the old days, when most of the manufacturing was done in the UK, they could place an initial order and top it up depending on how the season went. Now, you're stuck with what came on the boat.

[Peter2]

Re: M&S Store shopping - no stock at the best of times

Then stop buying suits from M&S.

Their quality has crashed over the last couple of decades anyway, the woolblend stuff they used to sell was of decent quality. There's no particular point in paying a premium price for some polyester blend made in China stuff that's so bad that you wouldn't buy it if you could feel it before handing the money over. It's not like they are particularly short on competition.

[wolfetone]

Re: M&S Store shopping - no stock at the best of times

I'd recommend John Lewis for a suit. I'm 6ft 3 and I find the clothes are better at JL than M&S anyway.

Also, as a tall bloke - do you too get fucked off that all the 33 long jeans are always at the bottom of the rack, while the 29" leg trousers are on the top rack?

Surely it should be the other way round!?

[Anonymous Coward]

Re: M&S Store shopping - no stock at the best of times

As a tall person I'm surprised you can find a suit (or shirt) at M&S that fits you. They seem to design for the typical short fat UK guy, if I get anything with long enough sleeves & legs, and broad enough shoulders, to fit me I can usually wrap it round my chest almost twice, and I'm not really that skinny.

[Dave Pickles]

Re: M&S Store shopping - no stock at the best of times

As a 29" leg person I share your pain...

[Screwed]

Re: M&S Store shopping - no stock at the best of times

As a 30" leg person I am in more pain! Always the slightly too short 29" or the slightly too long 31". And I am crap at adjusting them.

If only they'd produce half their trousers in even leg lengths, and the other half in odds.

[David 132]

Re: M&S Store shopping - no stock at the best of times

> If only they'd produce half their trousers in even leg lengths, and the other half in odds.

So... the right leg 29" and the left leg 30"?

<Kryten>

An excellent suggestion, sir, with just two minor drawbacks...

</Kryten>

[YetAnotherLocksmith]

Re: M&S Store shopping - no stock at the best of times

Guys. Seriously. Just find a seamstress* nearby. You're talking about £30 to get your trousers altered.

*not the Pterry kind!

[Doctor Syntax]

Re: M&S Store shopping - no stock at the best of times

Shortened, if need be. These days there's probably not enough hem left to lengthen them.

[FirstTangoInParis]

Re: M&S Store shopping - no stock at the best of times

About as sensible as stocking tablets used to treat backache on the bottom shelf … yes this is a real thing!

[Roland6]

Re: M&S Store shopping - no stock at the best of times

> do you too get fucked off that all the 33 long

I found it irritating that some ranges the leg length was: 30, 32, 34, 36

And others it was: 29, 31, 33, 35…

Similar with waist sizes…

[Ian Johnston]

Re: M&S Store shopping - no stock at the best of times

Last time I checked - years ago - M&S only went up to 33" inside leg, which is 3" less than I need

[Doctor Syntax]

Re: M&S Store shopping - no stock at the best of times

"I'd recommend John Lewis for a suit."

The nearest John Lewis store must be even further away from me than the nearest M&S that sells clothing. It's just as well I don't need a suit.

[Anonymous Coward]

Re: M&S Store shopping - no stock at the best of times

I've still got mine from school, and my first job some 30 years ago. Mostly still fitting, but the 30" waist is out at 33" now!

I know that's no help, I'm just bragging.

[Doctor Syntax]

Re: M&S Store shopping - no stock at the best of times

"my first job some 30 years ago"

So you're still young.

[Mrs Spartacus]

Re: M&S Store shopping - no stock at the best of times

Spot on. Although, being 6ft 4, with longer legs than a normal human being, the standard 'long' legs of 33 inches is no good to me. 'Long' used to mean 34 inches back in the day. An extra inch makes all the difference, so I'm told.

[JollyJohn54]

Re: M&S Store shopping - no stock at the best of times

Andy, try 2tall.com. At 6ft 4in you are a bit short (bet you've always wanted to hear that!) and follow the measuring guidelines precisely. Clothes fit nicely and returns are simple. Mail order as it should be.

I'm a happy customer, John (6ft 8in)

[ChoHag]

Re: M&S Store shopping - no stock at the best of times

> regular 6 foot 4 bloke

Nobody ever has my perfectly average size 13 slippers.

[Roland6]

Re: M&S Store shopping - no stock at the best of times

My daughter shares your pain: no one stocks size 3 adult shoes and as for petite adult sized fashionable adult clothes…

[Richard 12]

Re: M&S Store shopping - no stock at the best of times

Just buy the kids clothes.

No VAT, and the styles are mostly the same now.

[Roland6]

Re: M&S Store shopping - no stock at the best of times

Unfortunately, she doesn’t have a 11~12 yo figure… and she actually wants to be seen as being an adult, like job interviews, standing up in front of a class of children, getting served in pubs and restaurants…

The laugh is when it comes to sports kit, whilst hard to find, it does turn up in the sales: she has a collection of top end Lycra and wetsuits, purchased for peanuts. My son has a few treasured pieces purchased at significantly higher prices as his sizes are rarely in the sales…

[YetAnotherLocksmith]

Re: M&S Store shopping - no stock at the best of times

There's problems at the top end too. Womens shoes rarely go to an 8, despite most women* in the UK having size 6.5 feet. A 7 is as big as they go in many ranges. You don't need a deep understanding of normal distributions to see that's leaving millions of women without shoes that fit. I guess loads of them wear mens trainers and crocks, but there's got to be a lot of people who would go to your shop *specifically* if only you had their shoe size!

And men? Well, there's people on this very thread mentioning size 13+ feet.

*google says average is 6 to 6.5.

[BinkyTheMagicPaperclip]

Re: M&S Store shopping - no stock at the best of times

I've noticed the quality of M&S sandwiches - which until recently used to be excellent - has recently dived (specifically for vegan options). Reduced selection, fewer of them. I've given up and moved to Sainsburys.

They do do some rather nice animal monogrammed socks though, worth seeking out.

[Lord Elpuss]

Re: M&S Store shopping - no stock at the best of times

"(specifically for vegan options). Reduced selection, fewer of them."

Don't be (or buy) vegan then. It's pointless, monstrously difficult to cater for and bad for the environment.

Q: How do you know if there's a vegan in the room? A: Don't worry; they'll tell you.

[BinkyTheMagicPaperclip]

Re: M&S Store shopping - no stock at the best of times

That's barely a 1/10 troll. Try harder.

It's not pointlessly difficult to cater for. In many cases plant based food is better for the environment (it does depend : almond milk is possibly worse than cow's milk, some plants largely come from areas where people are exploited).

However as to 'pointless'. Whilst there are moral reasons to be vegan, sometimes either a plant based or a meat diet are forced upon you. It can be much easier to go for a plant based diet instead of 'non plant based but without this long list of ingredients I can't tolerate'. Likewise, when some of the more preachy vegan activists claim that 'everyone can eat vegan' this is simply untrue; it's not especially common but some people's gut only works with a meat based diet.

[JulieM]

Re: M&S Store shopping - no stock at the best of times

That's the problem -- you obviously are not seeing the same words the original poster actually wrote.

[Lord Elpuss]

Re: M&S Store shopping - no stock at the best of times

"I've noticed the quality of M&S sandwiches - which until recently used to be excellent - has recently dived (specifically for vegan options). Reduced selection, fewer of them. I've given up and moved to Sainsburys."

Read it. Understood it. Nothing else to it.

That said, I've taken down my second post because it was unnecessarily mean. I still think vegans should find another planet to live on though.

[Anonymous Coward]

Re: M&S Store shopping - no stock at the best of times

I enjoy plant-based food, especially the type based on grass that has been processed by a cow into sirloin.

[Anonymous Coward]

Re: M&S Store shopping - no stock at the best of times

Yep, I'm nearly a vegetarian, I only eat herbivores.

[Doctor Syntax]

Re: M&S Store shopping - no stock at the best of times

"better for the environment"

Looking at the fields behind me - this is the time of year for lambs. If the local farmer wasn't raising sheep and beef cattle (the regulations for milk production made dairying infeasible for a farm that size years ago) what would he do with it? Historically the area produced oats almost exclusively, so much so that fields supporting other crops were given names such as Ryeclose of Wheatcroft. I don't see cereals being a thing. In any case ploughing up grassland is going to release stored carbon over a few years. Without rearranging, or more likely removing, all the walls, ploughing would likely lead to soil erosion. It's a south-facing slope so maybe a vineyard....

It's also worth realising that grazed chalk grassland is one of the UK's most significant environments in terms of both botanical and invertebrate diversity. Ploughing so much of it up to plant crops was an environmental disaster.

[JT_3K]

Re: M&S Store shopping - no stock at the best of times

Noting I'm not vegan, having been at the coal-face for a (relatively) short lived meat-alternative firm, I can offer the other side of this coin.

The original purpose was a meat-alternative that was both environmentally friendly and didn't need to be endured. We ran a proof-of-concept that was initially global, and would have been regionalised in growth. Note that we: grew a crop locally in Canada; locally harvested and trucked to a near-ish big city; reprocessed the crop; air-freighted it to the European mainland; ground shipped it to a facility in that country; processed it in to various meals; ground shipped it to a storage facility in that country; ground-freighted it to a UK storage facility; sea-freighted it to New York; ground shipped it to test market in Seattle; and sold it there. With all that, it was still demonstrably lower carbon footprint than rearing an animal locally in Seattle and selling it through "normal" approach.

Shame about the company and internal issues. Some of the products you genuinely would struggle to tell the difference. (Some were a dumpster fire mind).

[John Brown (no body)]

Re: M&S Store shopping - no stock at the best of times

And what about the poor vegetarians? You never hear of them being catered for these days! It's Vegan or "everyone else" nowadays. A minority who have rights and being ignored!!

[Lord Elpuss]

Re: M&S Store shopping - no stock at the best of times

That's generally the one good thing about vegans existing; their fucknuttery has ended up making vegetarianism being seen as normal.

[logicalextreme]

Re: M&S Store shopping - no stock at the best of times

It's a "bring your own cheese" world these days.

[Anonymous Coward]

Re: M&S Store shopping - no stock at the best of times

As a result of an event which necessitated the insertion of quite a bit ot titanium to keep me together I found that no off the rack suit now fits me.

As I'm very often in Germany I now occasionally go to an outfit who do a sort of made to measure, I assume someone must have set this up in the UK too. The idea is that you visit one of their many shops, and someone competent measures the delta between you and one of their template suits. That delta + your choice of fabrics gets sent to wherever they make the suits, and in a few weeks you have a final fitting where they will adjust anything that wasn't 100%.

The result is a well fitted suit, despite my now somewhat non-standard dimensions. It's definitely more expensive than off the rack but it's not quite at Saville Row second mortgage levels either, and I have been told it looks good (I'm a bad judge of that, I just enjoy it sitting comfortably where it belongs). If you must wear a suit, this can be quite a good investment.

[Doctor Syntax]

Re: M&S Store shopping - no stock at the best of times

Those of us with long memories remember a Burton's and/or John Colliers on every High Street, not far from the M&S. The "wherever they make the suits" was Leeds.

[UnknownUnknown]

Re: M&S Store shopping - no stock at the best of times

A bigger problem is size consistency across the same item.

38 29 Blue jeans fit. 38 29 Black don’t <shrug>

It’s consistently inconsistent across different types of jeans/trousers/chinos etc

[YetAnotherLocksmith]

Re: M&S Store shopping - no stock at the best of times

No idea why you got a downvote for your salient observation!

I've got 5 pairs of identical trousers. They are not identical. They weren't even identical when bought new. The differences are wild, actually.

The worst is that I found, finally, the perfect boot for my feet. I bought another pair. Very different! Made in an entirely different country, too! And they don't really fit well.

And don't get me started about locks and door hardware being changed to have holes or parts that are slightly different! Inside the lock, fine. But the interfaces should be the same, not "nearly" and half a hole diameter out!

[JugheadJones]

security , no it's in the way

been working in this area for years and for a number of online services. The last thing considered is security - the first thing is the api working - no - give it admin rights - it's working yes. right now we go live with it but I said it's not secure take away the priviliedge. Don't be stupid , it's working man, the last thing that will happen is we get attacked online, it's very rare. - agile for you

my previous company got hacked through a redis vunerability and managed to startup bitcoin server's in EC2 and my current place got a ransomware attack.

When I started at my current workplace their opionion (even the CEO) said all their websites should be online, even though they had explicit customers for specific api's , I said whitelist thier IP's. The answer, "No, don't be silly that's too inflexible and restrictive"

I got asked to enable WAF rules, some of these rules broke the API but just needed exclusions, they said too complicated, leave some of the rules out.

Almost all of them do yearly pentests, these are total bollocks, they get given a fixed environment with little exposed and don't do internal pen testing, i.e. all the middleware services/load balancers on the internet which don't need to be and s3 buckets - this is usually number 1 of the list. What they should get is every endpoint exposed externally and tests these for all types of attacks. Also internally they should check security patches are either auto or manually patched regularly as they come out to be thorough but how to maintain this , dunno, some companies won't pay for full time security engineers when I guess they need to spend more money on functionaility. It's a question of "what happens if we do get hacked"

I still remember my first job in a large investment bank in 1997, there was an audit by a large well known auditer and I was asked to install some sophos software on some Unix servers. When the audit finished , I was asked to remove the software.

Maybe the government should have legislation to any commercial businesses that online presence means security first and the prviledge of least acess to do whats required and regular patching , exposing only the required services and nothing else should be part of the mandate and they should get a thrid party to do end-to-end testing.

[Anonymous Coward]

Re: security , no it's in the way

We've had problems with permissions in Microsoft world: We give accounts the correct limited permissions but when we log support calls saying it doesn't work MS just say "Oh just give the account Admistrator rights: That'll fix it" and want to close the ticket.

[Anonymous Coward]

Re: security , no it's in the way

We just went through a 4 year refit where we cleaned up a lot of that crap. I now have agents running on any endpoint and server that pick up vulnerabilities (part of standard build), and my aim for this year is to automate most of it.

The agents give me two remaining categories of issues:

1 - legacy. There's old stuff that cannot be patched without involving a herd of developers because backward compatibility wasn't a thing then. As we're moving off those platforms at some vague point in the future we weren't going to prioritise fixing that. I have at least managed to start discussions about giving that lot their own playground with a fat moat around it so I have one access point to check instead of a monthly 30 page problem report. With a pipe to an NDS so I can keep an eye on it.

2 - dev. Always dev. I've managed to get to a stage where security is at least paid attention to in design, but I catch them regularly abusing admin right privileges to install unapproved and (worse) untested software. Now I don't want to be a Nazi about this, but we test for a reason. Once we ended admin permission because we had a trojaned install (which thankfully was picked up immediately, but if that had been a zero day we would have had quite a lot of recovery work) we all of a sudden got attention, and I now have their managers running an approval process I can keep an eye on. I'm not sure what they teach people in programminmg courses, but does it really always have to start with 'gain admin level'?

Anyway, they're now listening. Until we get new people, of course..

[Richard 12]

Re: security , no it's in the way

The trouble is that almost all development tools require local admin.

Some because things like "attach a debugger to a process" fundamentally require privileged access, but most because the teams making development tools have local admin and don't test at lower privileges.

The majority of commercial SDKs can only be installed by running a privileged installer - for no technical reason whatsoever, as they're just some precompiled binaries and the header files.

And don't get me started on the weird build systems that insist on downloading all kinds of stuff from random places. Some of them can be redirected to an internally-auditable location, but many cannot.

Docker is of course the cause of (and occasionally solution to) many of these problems.

[Doctor Syntax]

Re: security , no it's in the way

It's a question of "what happens if we do get hacked"

Make that "when" and ask it of manglement. "If" gives wriggle room.

[Vikingforties]

"Harrods, a globally recognized purveyor of all things luxury,"

I'll bet it's more globally recognised for other things these days.

[JimmyPage]

Did anyone see the story about Co-Op ?

*Now* they suddenly decide it's a good idea that all participants in a meeting* have their cameras on to prevent unauthorised access.

What fucking idiot signed off on a policy to the contrary.

*Meeting. Not a sermon or broadcast to the masses.

[Richard 12]

Re: Did anyone see the story about Co-Op ?

I've found that Teams overloads the office network pretty quickly if everyone has their camera on.

So it doesn't work as a policy unless you've got a lot of per-user bandwidth at every office location.

[Roland6]

Re: Did anyone see the story about Co-Op ?

That’s one of the benefits of working from home

[JimmyPage]

Re: Did anyone see the story about Co-Op ?

As I said - a *meeting*. That is where a group of individuals all share the same space with equal input.

One thing the past week has done is uncover management practices that have fooled (some) employees into thinking that the Gods addressing the Pleds is somehow a "meeting".

If you can't say "I'll pick that up at the next meeting" then it's not a meeting. It's a rally.

[YetAnotherLocksmith]

Re: Did anyone see the story about Co-Op ?

Pointless having the camera on. One thing I've noticed is that the men often love to have the camera on, and the women won't unless they're presenting.

Watch for it, you'll notice it too now.

Anyway, it takes a few minutes to set up a virtual camera and then you can have backgrounds, animations, or even entirely cloned people on your camera. Turning it on makes no difference now, that ship sailed about 6 months ago.

[Graham Cobb]

Re: Did anyone see the story about Co-Op ?

It doesn't prove they are real people by itself, but if you know the people you are expecting, even by sight, it can help verify a large call hasn't been infiltrated.

[Richard 12]

Re: Did anyone see the story about Co-Op ?

Not at all. It might help in a small call, if you're lucky, but in a large call the pictures are so small rhat they could be anyone.

[Graham Cobb]

Re: Did anyone see the story about Co-Op ?

My local co-op now has almost no fresh vegetables on the shelves (although still a reasonable amount of meat - I presume because that is expensive and moves more slowly) and certainly only one sort of anything (one sort of mushrooms, etc). Milk looks quite low as well, unless they are keeping some in the back to reduce panic buying.

And signs saying it is due to the reported problems. Looks like its logistics systems are badly affected.

[sitta_europea]

"...Richard Horne ... said the ongoing saga should serve as a wake-up call to all ..."

If they still need waking up after all these years there's really no fucking hope for them at all.

[Anonymous Coward]

I also don't expect much agility after an 11 year sleep. That's more a coma, really.

:)

[sitta_europea]

"I know, let's have a system where everyone on the planet can connect whatever they like to everything else on the planet, and use it to move money about and stuff like that.

We can bolt some security on later if it turns out that we need to."

How far would I get with that pitch at your average financial organization?

But it's seems to be what most of us have done.

It's insane.

[graemep]

> How far would I get with that pitch at your average financial organization

You need to add “you can make massive staff and cost cuts and it will probably not go wrong until after you get your bonus/sell your options”

[Derezed]

AI will fix all of this…probably. Or blockchain.

On a serious note, I remember a company I was consulting at firing their entire knowledgable IT department and offshoring it because “we’re not a tech company”.

M&S appear to have done the same in 2018.

How’s that all working out for them? Doesn’t matter for the senior management obviously…cost saving made, onto wrecking the next company.

Meh.

[Ossi]

Anyone remember the old Foyles on Tottenham Court Road? You know, the one you had to pass over your book, get a paper chitty, pay for the book, get a stamp from the cashier, then go back to pick up your book (or something like that - my memory of it is fading). I reckon that business was completely impervious to ransomware.

[TimMaher]

Foyles

That was the dream bookshop.

Everything dotted about in no particular order. Students working there who were confused about everything.

Girlfriend of the days father once launched a publication there. Great lunch.

Absolutely fabulous.

[Phil O'Sophical]

Re: Foyles

Everything dotted about in no particular order.

It was all shelved in publisher order, rather than the more usual alphabetical author order. It was always impressive how you could ask a member of staff for a title, and after brief pause & vacant stare while they dredged up the info, they would direct you to the exact aisle & shelf. A bit like a cabbie's "knowledge", but for book locations.

[Korev]

There used to be (is?) a suit hire in Godalming who used a pair of Rolodexes for everything and it was probably as fast as mucking about with a poor interface to a database. The owner there could also instantly size you without measuring even accounting for the different suits.

[HMcG]

Did the proprietor wear a Fez, and was there a magic door at the back of the changing room?

[Phil O'Sophical]

I think Festive Road was in London, not Godalming...

[Anonymous Coward]

There's a shop in Maastricht with smart casual clothes where the manager has that same skill. It's uncanny, this guy is so good that his shop is now my first point of call when I go to Maastricht - people that good are rare and I'm certain that 80% of people who shop there return precisely because of the quality of his advice. When it comes to shirts for work I tend to stock up when I'm in London. Theoretically I could order that via the web, but every so often I go in there to have someone measure me again who actually knows what they're doing. To give you an idea of my fashion sense (not much :) ), I had no idea there was such a thing as different sleeve lengths and it turned out I needed a bit longer than the standard 33cm. Not a problem: these people have that in stock too as it's apparently becoming more common.

That said, the company I work most for at present is OK with smart casual, or "as long as it doesn't have too large holes in it" for the tech people - they're refreshingly practical. It's the snobby lot I have suits for, and even then it'll take someone special to make me wear a tie :).

[Doctor Syntax]

Foyles

Charing Cross Road. That was the road for books. TCR was the road for electronics, mostly branches of Stern-Clyne.

There was a poster on the bus shelter outside with the slogan "Foyled again? Got to Dillons."

[Graham Cobb]

Re: Foyles

And Edgware Road for components.

[tip pc]

Interesting that COOP client remote access vpn has been taken offline

pure speculation here but if they have taken their remote access vpn offline, I wonder if that indicates an issue with the vpn vendor they have / use or that they have blocked incoming vpn traffic from unknown IP's.

more details should be socialised so that others using similar kit can take appropriate safeguards.

I know that those running critical infrastructure by know have a steer as what to watch out for, if they know it'll take 5 mins till the hackers know, so why has it not been disseminated wider so those smaller players can get in on the mitigations too.

[tip pc]

DragonForce Claiming responsibility

https://www.bbc.com/news/articles/crkx3vy54nzo.amp

Below is from the telegraph.

A criminal hacking gang known as DragonForce took responsibility for the attack as well as similar attacks on Marks & Spencer and Harrods.

The hackers reportedly showed the BBC screenshots of emails they sent to the retailer’s cyber security director on April 25.

Hackers ‘accessed and extracted data’

A spokesman for the Co-op said on Friday it was “continuing to experience sustained malicious attempts by hackers to access our systems” as it works with government cyber security experts to try and limit the damage of the attack”.

They added: “As a result of ongoing forensic investigations, we now know that the hackers were able to access and extract data from one of our systems. The accessed data included information relating to a significant number of our current and past members.

“This data includes Co-op Group members’ personal data such as names and contact details, and did not include members’ passwords, bank or credit card details, transactions or information relating to any members’ or customers’ products or services with the Co-op Group.”

It has called in both the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) as it battles the cyber attack, which followed a similar hack on Marks & Spencer, which has thrown the upmarket grocer into chaos. A third attack on Harrods followed on Thursday.

[Phil O'Sophical]

Re: DragonForce Claiming responsibility

"Matt" called it well, as usual: Matt cartoon

[VoiceOfTruth]

Glad to see the NCSC is keeping up to day

A sample of the advice on its website, as of now:

Security guidance for Android (last tested on Android 10)

Security guidance for iOS (last tested on iOS 13.1)

Security guidance for macOS (last tested on macOS 10.15)

Yaarrrrp.

[Anonymous Coward]

It's OK, they are taking proactive steps

All three, M&S, Coop and Harrods have all been reported as 'We are taking proactive steps to blah...'

No you're not, you are reacting.

If they had taken proactive steps there would probably be no hack.

I do wish the media would call companies out for this semantic nonsense.

[John Brown (no body)]

Re: It's OK, they are taking proactive steps

Also interesting the both Co-Op and Harrods said exactly the same, almost word for word, to their customers "We are not asking our members or customers to do anything differently at this point."

[Doctor Syntax]

Re: It's OK, they are taking proactive steps

Copy and paste.

If Greggs gets hit it will be copy and pastie.

[Roland6]

Re: It's OK, they are taking proactive steps

Surely: coffee and pastie..

[John_Ericsson]

The register final catching up on the news.

[Anonymous Coward]

Protection & patching

Read on one site that someone at either m&s or co-op said they are patching like hell. Feels to me their patching is some what lacking and needs a real good looking at.

Also, what av are they all using ? Or mail filtering ?

Undoubtedly harder when on the cloud/virtual as you want a VM to be running at near 100% or the os to report that, but good old lumps of tin, if you knew it's normal levels you would see a spike and if on top, be suspicious

I know my company look like they were running an old Forti VPN as our clients were well out of date Vs the safe versions mention I. The recent vulnerabilielties, but as the update canme via a software centre I am now not sure if the client would auto update from the server (as some articles implied it would)

[YetAnotherLocksmith]

Re: Protection & patching

M&S got rid of their IT department about 6 years ago, so I'm going to guess that it is they who are "patching like fury".

[HAL-9000]

The threashold has been crossed

Government agencies only recognise the trend when a luxury goods retailer with a large international customer base is affected. More confirmation that handing over financial details to any online business is folly.

[Doctor Syntax]

Re: The threashold has been crossed

Government agencies only recognise the trend when a luxury goods retailer with a large international customer base ministers and/or their wives as customers is affected.

FTFY

[Mike 125]

screw M&S

Screw them. They've become fast food and fast fabric- amongst the worst. Read the ingredients on their so called premium food products- it's utter garbage.

Sadly, they deserve everything they get.

And now despite them selling us 'actual product' in the traditional sense, it seems we (our data) are also 'product'. They've tried to have it all. And fucked up.

(And btw, I'm sure this applies to most other retailers too. But M&S used to be ok.)

(The page below is 'protected'- had to 'view source' to copy this. That says it all.)

-----------------

https://www.marksandspencer.com/c/what-is-our-privacy-policy

"Social Media Platforms and Search Engines: Facebook, Instagram, TikTok and Google

If you have an account with a Meta platform (such as Facebook or Instagram) or TikTok, or use Google, and accept cookies on our website, your personal data, including purchasing and browsing activity, will be shared with them. ‘Meta’ includes Meta Platforms, Inc (a US company) and other Meta Group companies. ‘TikTok’ includes TikTok Information Technologies UK Limited, in the UK, and TikTok Technology Limited, in Ireland. Google includes Google LLC (a US company) and Google Ireland Limited. This data is shared so the social media companies or search engines can serve tailored and personalised advertisements to you (including relevant M&amp;S products and services) when you are using their platforms and apps.

For certain data processing activities, Meta, TikTok or Google will be acting as a data controller using data solely for their own purposes. In some circumstances, Meta and/or TikTok will be acting as joint data controller with M&S."

[Doctor Syntax]

Re: screw M&S

This weaselling should not be allowed. If you have to give any data to any business for the purposes of a transaction it should not be used beyond those purposes and the business should be solely responsible to you for the actions of any of its agents as well as its own actions. And let's have criminal liability for directors.

[Graham Cobb]

Re: screw M&S

(The page below is 'protected'- had to 'view source' to copy this. That says it all.)

I suspect that (in this case) it isn't deliberate. Certainly, in my browser, I could do Select All and I could also start a selection drag by clicking in the fixed portion of the text (near the top) and dragging further down. Once selected, I could Copy with no problem.

It looks like careless capturing of clicks for the opening of sections. So FU rather than conspiracy. Still piss-poor programming.

[Doctor Syntax]

Re: screw M&S

No doubt it worked with the developer's browser & that was good enough.

[Anonymous Coward]

Buy my Detectohack box

Meanwhile all the staff work from home. Boss will know its a risk and attack vector,but they they dont want to close that jolly off for themselves.

Do those guys that used to sit in the silo to turn the missile key work from home now as well?

Meanwile every supplier will try to sell them a magic product to detect and neutrelize the threats.

I myself have someting in the works. A Detectohack box. Lots of flashing lights when its on to reassure.

[tip pc]

Re: Buy my Detectohack box

Do those guys that used to sit in the silo to turn the missile key work from home now as well?

notwithstanding the above, zero trust architecture is a thing designed to prevent hacks from within the business.

https://en.wikipedia.org/wiki/Zero_trust_architecture

There was a time when hackers modified Sega Dreamcasts and had them installed in businesses beneath the floor tiles or above ceiling tiles and remotely connected into corporate networks.

Zero trust architecture mitigates exploits like that and those concepts make it safe for people to be working from home.

obviously if its super sensitive work then it should be done from controlled environments like a company secured office, but lower level activities like admin or HR can be done relatively safely from home with obvious caveats.

[YetAnotherLocksmith]

Re: Buy my Detectohack box

Don't worry, microsoft are taking screenshots of the display every few seconds then ocring it for their own ends, so... Yeah.

[Ian Johnston]

The shelves at M&S Simply Food in (Edinburgh) Haymarket station are half empty. I presume that's an SSP franchise, in which case it suggests that the problems are not just at the consumer degree of things.

[Anonymous Coward]

Yes there would seem to be problems in the distribution to stores; on Friday my local M&S received the soft fruit delivery for all three stores in my area. This I understand is just one example of the problems.

Now M&S are releasing food again, the local food banks are benefitting from the mistakes…

[MatthewSt]

MFA/2FA

Solves a lot of these cases... Especially ones where you needed to be verifying Teams attendees are who they say they are!

[Anonymous Coward]

Wait until the only money is CBDC and id is central too, that chaos will be beyond Spain's blackout. This shows the value of distributed systems and the ultimate distributed systems of banknotes and remote office IT. I don't think it's beyond the possibilities that extreme centralisation is an existential event. At least in terms of civilsation. So why are all our critical systems becoming more centralised? Power & control I would venture.

[0laf]

We all know why it keeps happening

Why, because other than a temporary hit on shareprice there is no sanction for the failings.

There is nothing new here and nothing that hasn't been happening for 20yr. To be a company that does information security takes time, effort and some money.

Because the impact on not getting your infosec right is small to the business and negligable to the decision makers it is an easy call to avoid, cut or outsource it altogether.

The ICO might still scare soem people but the fines are rarely handed out and when theya re you can probably argue them down to nothing anyway.

Infosec is still immature, I've always thought health and safety is a good analogy. It took a long time before that was taken seriously, a lot of people died or were injured. Eventually health and safety was taken seriously, if you fail at that you can go to jail and it does happen.

When infosec failures are seen in the same way with the same consequences then it will get the same level of attention and resourcing.

But I'm not sure it will ever happen. The boardroom understands the impact of a worker falling off an insecure structure, even more they understand the impact that it might have on them. They don't understand why refusing downtime on critical system might lead to those systems failing, they don't understand why secure development is important and further they don't want to know. That's all tech and it's boring and done by the geeks that cost too much money and you want to replace with the nice AI the salesman talked to you about at that nice lunch.

And if you work in infosec you probably stopped saying "I told you so" 10yr ago, and now just roll your eyes and double check that your black file of emails recording when your recommendations were ignored and by whom is up to date.

[Doctor Syntax]

Re: We all know why it keeps happening

We need two things. One is a directors' responsibility added in company law. The other is an arrangement similar to aircraft reporting where the incident is analysed: what happened, how it was recovered, how the system could have been better arranged to minimise the attackers' access and what could have been done to prevent access in the first place with the results circulated to CISOs so that the lessons could be applied widely.

[0laf]

Re: We all know why it keeps happening

I've seen some people try to apply the methods of air accident investigation onto cyber incidents and I'd say the results are impressive. But it's intensive and therefore probably expensive. So until the equivalent impact of an air accident finding is applied to cyber incidents it won't be done.

Many incient are still covered up, insurance is a legal way to pay blackmail for now and I've not heard anything for a while about making paying cyber extortion unlawful.

Not getting any feeling that there is a will to sort this at the moment.

[WizzerWotsit]

Now that Harrods have been hit got agents step in....

Does that mean the other two didn't matter???

Are Harrods getting special treatment

Is this the reason for the cover ups over the sexual exploitation in the past?