Britain's cyber agents and industry clash over how to tackle shoddy software

Intervention is required to ensure the security market holds vendors to account for shipping insecure wares – imposing costs on those whose failures lead to cyberattacks and having to draft in cleanup crews. The security market must properly incentivize security vendors to do security better. So, we have a non-functional …

[elsergiovolador]

Grift

This is such a grift using tax payers money, isn't it?

Why are they not holding to account companies making door locks? Some can be picked with a tooth pick. How much police time does it cost to follow up all the burglaries (or reputational cost for not following up)?

[Acrimonius]

Re: Grift

Well, the lock supplier spells out the risks - no lock is safe - or should do. The IT vendors should then state what precisely the vulnerablities are. Of course, they themsleves do not know nor how well a particular measure will stand up to the test of time. So if asked to make it safe and payng for it you will then still not know whether you are safe or not and the vendor will always have a get out clause.

[elsergiovolador]

Re: Grift

Do lock makers state what vulnerabilities are?

Go get any "high security" lock from your hardware store and then go on YouTube to see how dead easy it is to pick.

[nobody who matters]

Re: Grift

UK locks that meet the required standards for security are clearly marked with the British Standards kitemark.

If kitemarked locks were that easdy to pick, the burglars would simply be picking them, not smashing windows or prising doors open to break in to properties.

The insurance industry thinks that the kitemark standard is sufficient for them to agree to insure most peoples belongings within their house (up to about £100k at any rate), and I think they would insist on something more resilient if it were as necessary as you are trying to make out.

Software (and hardware) producers appear to have a pretty cavalier attitude to the security of their customers systems (worse nowadays I think than it ever has been) and I see no reason why they should continue to get away with pocketing what most ordinary people would regard as excessive profits/salaries at the expense of providing products which meet at least basic security needs (and many are simply not secure in any way).

[SVD_NL]

Re: Grift

I've been picking locks as a hobby for about a year now, and i can assure you those Youtube videos make it look deceptively easy. You don't point at an X-Games video and shout "look how easy it is to do a 2160 triple cork on skis!"

Bolt cutters or a crowbar are going to get the job done consistently, and require significantly less skill to use. Battery-powered tools are also a real menace.

[codejunky]

Re: Grift

@elsergiovolador

"Why are they not holding to account companies making door locks? Some can be picked with a tooth pick"

I was surprised how easy it was to pick open a good number of locks when I started to play around with the hobby. If people had any idea I suspect more secure locks would start to be used, especially padlocks

[cdegroot]

Re: Grift

The best padlock lock pick is a bolt cutter. I follow the lock picking lawyer and I own some picking sets, but a good bolt cutter will get you through any padlock (or its chain) with predictable speed. That's why I think lock picking isn't too much of an actual threat.

[elsergiovolador]

Re: Grift

Not always viable if job has to be done quietly.

[nobody who matters]

Re: Grift

<......."a good bolt cutter will get you through any padlock (or its chain) with predictable speed>"....>

Actually, no it doesn't always. Padlocks are not always used in conjunction with a chain. Most traditional type padlocks with an exposed loop, yes, I would agree that bolt croppers will deal with them. However, there are plenty about these days that are made in such a way as to make the loop or pin almost entirely inaccessible to bolt cutters.

When the need has arisen to break open a padlock for which the keys have been lost, I have yet to find a conventional loop type padlock that does not succumb to a firm belt with a lump hammer and punch/chisel applied to the top of the padlock body - the latch that holds the loop in the locked position invariably gives way after not too much effort.

[Roland6]

Re: Grift

> The best padlock lock pick is a bolt cutter.

Suggest you have a word with your local fire brigade, I’ve used their technique several times when bolt cutters or an angle grinder haven’t been to hand.

Although in saying that, I’m not sure how I might gain access to a padlocked shipping container (the one’s where the lock is under a metal cover)

[See https://jenningscontainers.co.uk/wp-content/uploads/2022/02/lockboxblue.jpg for an example of the lock box. ]

[Anonymous Coward]

Re: Grift

I was surprised how easy it was to pick open a good number of locks when I started to play around with the hobby.

Beats working for a living, eh?

[elsergiovolador]

Re: Grift

If You Love What You Do, You’ll Never Work A Day In Your Life.

[Anonymous Coward]

Re: Grift

Picking locks to steal stuff is a risk/reward situation...the lock isn't there to be impenetrable, it's there to slow the burglar down and increase the risk of being caught...if a burglar really wanted to bust your lock he'd kick your door in or use an angle grinder or something...he won't give a shit about the lock...all burglars care about is what alarm system you have (so they know how long they have to get in and out) and whether you've got dogs.

Most career burglars are extremely quick, they're usually in and out of your house in 5 minutes or less. They know where your valuables are, even if you're trying to be clever about it and they know which rooms to not bother with.

[codejunky]

Re: Grift

@AC

"Picking locks to steal stuff is a risk/reward situation...the lock isn't there to be impenetrable, it's there to slow the burglar down and increase the risk of being caught...if a burglar really wanted to bust your lock he'd kick your door in or use an angle grinder or something...he won't give a shit about the lock"

As someone already pointed out, a bolt cutter will do the job nice and quick. It does mean carrying around big bolt cutters or as you say an angle grinder. For a good lock picks probably aint worth the effort but if you want to open a lock and leave it intact picking it (or maybe a shim for a padlock) works better. I have a cheap lock that sets the pins just by sliding in the pick. It is the absolute illusion of security

[ChodeMonkey]

Re: Grift

Learning a new skill or profession is laudable. Well done, Madam.

[Anonymous Coward]

Re: Grift

Still a hobby eh? Don't worry, if you work hard enough you'll go "full career" at some point. I hear the key is not wear a stripey jumper and carry a bag with "swag" written on it.

[Roland6]

Re: Grift

The locksmith we engaged to gain entry to an elderly aunts house was “reassuringly expensive”, plus they seemed to have a steady stream of business - unlocking double glazing without damaging the frame - might be a good after IT career.

[HMcG]

Re: Grift

Picking locks is ‘easy’ if you are intelligent enough to to understand the principles, and you put in some time and effect to learning the skills required, and are prepared to take instruction from some who knows more that you about a subject.

That pretty much excludes the criminal population.

[Tron]

Re: Grift

Apparently 'relay theft', cloning signals from keyless lock 'e-keys', has led to a huge rise in car thefts. The 'pivot to digital' has made it much easier to nick cars.

Perhaps instead they should have switched to a paired physical key and e-key. 2FA for cars!

[fg_swe]

"Keyless Go" Stupor

There exist perfectly safe wireless car lock systems.

Keyless go can be made secure by means of very high speed challenge-response protocol. A seasoned security/cryptographic engineer would have told the Auto Muppets about this, before Sergey from Tshelyabinsk figured it out.

[Anonymous Coward]

Re: Grift

It is, it's also hugely embarrassing for the owner because their neighbours will know they didn't opt for the more expensive package that included an immobiliser.

It used to be much harder to "out" the try hards...because you'd have to look through the window of the car to check for cloth seats, hand winders for the windows and blanking plates over the holes where the "deluxe" features like aircon would be.

[David M]

Re: Grift

The entire purpose of a door lock is security, so purchasers are likely to give at least some thought to how secure it is. If, on the other hand, I'm buying a smart lightbulb, or an audio streamer, or some other internet-connected appliance, I'm unlikely to even consider its level of cyber security unless it comes with some kind of official rating or warning label.

[Phil O'Sophical]

Re: Grift

I'm unlikely to even consider its level of cyber security unless it comes with some kind of official rating or warning label.

Most people will ignore such a label anyway, if the product is trendy or cheap.

Look at the farce of "nutrition" labels on food, or "units" on wine, do you know anyone who even reads those, let alone uses them to make a purchasing decision?

[Anonymous Coward]

Re: Grift

"do you know anyone who even reads those"

Yes, me and quite a few people around me...I keep a close eye on things like sugar, salt and saturated fat, I don't restrict myself per se, I just like to make sure I'm not being excessive...alcohol units, not so much because I don't drink a lot and if I do drink I don't drive.

[Anonymous Coward]

Re: Grift

Me, for one, I like to make sure I eat a minimum of 30g of protein per meal including breakfast (150g/day) what with 3-4 skimmed lattes. and keep the sugars to an absolute minimum and, of course, keep an eye on the overall calorie content. I really don't spend any time on it either. Glance at the label and know whether it's going to pile on the fat or the muscle just by looking at the balance of protein, carbs, sugar and fat.

[Anonymous Coward]

Re: Grift

None of the people on the same bariatric cancer ward as you clearly.

[JWLong]

Re: Grift

Because locks only keep honest people out!

[Anonymous Coward]

Re: Grift

Locks only work if the stuff you've got is sufficiently low value and makes picking them or kicking the door in too risky for the reward. Nobody is going to kick your door in or pick a lock for a shitty TV or a low end Seiko watch.

They might for a Patek Phillipe or a bag of diamonds though.

If you have super valuable stuff, no lock will keep a burglar out...they will knock the walls down or smash the windows if they have to.

The name of the game with burglary and theft is speed, not stealth.

[Anonymous Coward]

Re: Grift

Grift?

We absolutely should lean hard on software developers to secure their code...a lot more is at stake if a database gets breached...if a house gets burgled it's one household affected and the burglar can only rob one place at a time, so eventually you'll catch him and stop him by putting him away...if a database gets breached it's potentially millions of households affected and whether or not you catch the perp, the data could already be dumped online.

Even worse, that data leak could contain sensitive information about politically exposed individuals and become a national security risk.

It's a completely different scenario to a lock on your front door.

[Anonymous Coward]

Re: Grift

The clue is in the name. NCSC - National Cyber Security Centre. Unless it's a digital lock physical locks are nothing to do with them.

[LucreLout]

Holy shit. Lol.

The reality is that users cannot tell whether they have good security or bad security until their bad security lets them down.

Yes, CxOs could listen more. Absolutely. Yes they could take InfoSec seriously before they get breached. But fuck me, just because users value something doesn't mean they're going to get it or can tell that they haven't when the vendor tells them they have.

Are marketing really going to announce that yes, they have a super new feature, but they've traded that for shite security? How will the buyer know?

[Like a badger]

Organisational buyers should hold vendors to account - name, shame, and withhold business (or refuse to sign new contracts unless there's punitive re-charge arrangements in the case of a breach).

But for the hoi-polloi, information about security practice doesn't help. They don't understand enough to make sensible choices, and for many of them price will trump all else. Lets face it, Talktalk are infamous for several data breaches. They're also infamous for their poor customer service. But they offer bargain basement pricing, and they've still got 3.2 million customers. A NCSC "brown label" isn't going to make any difference, in the same way that there's a good number of low-end takeaway joints still in business with one or two star ratings for food hygiene.

It is the job of the ICO to hold companies to account on behalf of retail customers, but I think most people would agree that the system is not working. The usual chant is "fine them more, imprison the directors", but there's little evidence that works either so there needs to be further thought about how the data (and service) protection system should work.

[nematoad]

Do get it right!

It's hoi-polloi. No "the".

It's as bad as saying Lake Windermere or PIN number.

It just makes you look uneducated.

[cdegroot]

Some linguists argue that, given that hoi is a definite article, the phrase "the hoi polloi" is redundant, akin to saying "the the masses". Others argue that this is inconsistent with other English loanwords.[12] The word "alcohol", for instance, derives from the Arabic al-kuhl, al being an article, yet "the alcohol" is universally accepted as good grammar.[13]

(Wikipedia)

[nobody who matters]

Lake Windermere perhaps not a good example.. It is routinely referred to as Lake Windermere to differentiate from the town of Windermere which stands on its shore ;)

[rg287]

More importantly, Windermere town isn't really on the shore of the Lake. if you drive into Windermere and park up expecting to get an ice cream on the shoreline, you'll have a half hour walk to get there. Those looking to rent a boat on (Lake) Windermere want to go to Bowness (or Waterford), not Windermere town. Windermere railway station is at the top of the town and quite a step from the lake itself.

[collinsl]

I think the point is more that Windermere isn't a lake, it's a mere. QI said years ago that there are no lakes in the Lake District for this reason. They're either meres, waters, or something else.

[Doctor Syntax]

The usual chant is "fine them more, imprison the directors", but there's little evidence that works

How many directors have been personally brought to book for security breaches? don't recall seeing that reported here and I suspect it's none. If it isn't specifically in the list of directors' responsibilities it would be hard to make the charge stick.

[cookiecutter]

As someone whose been over riden by purchasing & finance several times, the buyers who sign the cheques have zero clue & THEY are never held to account because THEY won't be the ones in the office at 2am trying to fix this shit

[Anonymous Coward]

"Yes, CxOs could listen more. Absolutely. Yes they could take InfoSec seriously"

A lot of them do, but the insurance companies hamstring you into deploying dumb shit and ticking boxes because your C suite is more inclined to listen to the insurance companies than actual cybersecurity experts...which a lot of the time is counter productive and leads to more vulnerabilities due to users finding it necessary to work around certain measures.

I had a battle with a "cybersecurity insurance" company a couple of years back that was trying to force me to deploy stuff that I knew was stupid and hadn't been thought through. When I repeatedly demanded that they bring their cybersecurity expert into meetings with them to allow me to discuss things, they eventually caved in and admitted they didn't have one...at which point, I threw down my various industry recognised cybersecurity certs (CySA+, CISSP etc) on the table and they reluctantly signed off on my implementation...they don't even know what a CVE is...one of the recommendations they put to me involved a third party product, which they recommend a specific version of, that comes with a massive fucking 8.0 CVE.

The whole cyber insurance sector is fucked up and probably forces more bad practice than it prevents...and it definitely can't establish whether or not your setup is as good as it can be, because they don't have the experts to verify / understand things.

There was another time I was parachuted into a ransomware situation to clean things up and get things going again, I was recommended by a mutual third party (and I did the work as a favour to this third party, essentially, they pay me for ongoing services, but loaned me out for a few days essentially), because the business had been down for a week and no progress had been made and this business was quite a large customer of the third party...I got there and the team "dealing" with it was sent in by an insurance company...they moaned about how hard it was to get rid of, because by the time they'd cleaned up one machine, it popped up on another. They hadn't even disconnected any network cables. Fucking useless...I had it cleaned up and sparkling within 2 days...they had solid backups, so it was pretty straight forward.

The frustrating part of all of this is that it's not even a skills shortage problem, it's a hiring problem...none of these organisations know how to hire cybersecurity people and in the rare cases they do, they don't know how to keep hold of them.

There are plenty of skilled and experienced cybersecurity folks out there, but they come from a time where cybersecurity certifications didn't exist and most of them aren't inclined to go and get a cybersecurity cert because of the stupid requirements to achieve the full cert...like the CISSP for example, having to prove your experience (which is fucking difficult in tech because NDAs are very common) and/or knowing someone that already has the cert to vouch for you (which very few existing CISSPs will do). It's dumb as fuck.

Another problem is that a lot of cybersecurity certs lapsed over the pandemic, because some of them require CPE in order for you to keep them "active"...basically, you have to attend events, read stuff, publish stuff etc etc in order to get CPE points and you need a certain number of CPE points for your cert to stay valid. Good idea on paper, ridiculous in practice because the busier you are, the harder it is to earn CPE points...it's essentially a system that rewards you for shirking work.

I passed both the CISSP and CySA+ (002 beta exam) in late 2019...by the time we were out of lockdowns etc, both had lapsed because it was impossible to accrue the necessary CPE...so I had to resit them...I suspect a lot of people probably didn't bother...so there are likely quite a few folks out there that are former CySA+ or CISSP that just won't bother applying for Cybersecurity roles now...that is skill and experience being left on the table because of stupid certification requirements.

[nematoad]

Hmm.

A string of cockups will quickly out those who don't provide value,

It doesn't seem to have worked with Microsoft, and people still keep buying their stuff.

[Doctor Syntax]

Re: Hmm.

That's the power of lock-in.

[ecofeco]

Re: Hmm.

Perfect comment is damn near the epitome of perfection. I see what you did there.

Both sublime and elegant.

All you can drink on my tab. ----------------------------------->>>>>

[fg_swe]

BINGO

Despite a never-ending series of security failures, the business world keeps buying MSFT products. Clearly useful measures such as VBA sandboxing are not introduced.

So these NCSC apparatchiks seem to know nothing about the real world. Their "code of conduct" thing is also close to useless. Hot air without any computer science substance such as "proper scanners, proper parsers as first line of defence" or "fuzz testing".

[rg287]

Re: BINGO

So these NCSC apparatchiks seem to know nothing about the real world. Their "code of conduct" thing is also close to useless. Hot air without any computer science substance such as "proper scanners, proper parsers as first line of defence" or "fuzz testing".

Ollie Whitehouse came to NCSC after 27 years in private industry - CTO at NCC, research at Blackberry EMEA and Advanced Threat Research at Symantec.

He has literally some industry knowledge - he didn't join the Civil Service straight out of uni and spend his entire career in policy.

At the end of the day, he knows that he's fighting indifference in government and has to play a longer game. If we wanted secure government we'd move Government systems away from US cloud providers. But telling UKGov to ditch Microsoft is not going to get them very far in the short term. They're also having to deal with an environment where - Councils get told not to admit getting ransomware'd by the Home Office when they get caught out. Which is the exact opposite of what you want - post mortem that stuff. So the NCSC is fighting a sometimes-indifferent Civil Service who are sometimes more interested in saving face than anything else.

Once upon a time there were no standards for highly assured software in aerospace, etc. Now there are. There will always be a question over whether vendors apply them (*cough* Boeing) or whether the notional regulator actually checks vendors or lets them mark their own homework. But the existence of those standards is important. It's why Boeing customers have said "We want our own reps on your factory floors or you can take your shonky planes back" and Boeing has had to say "yeah, okay".

Imagine if a victim/"customer" of Cloudstrike said "we want our own QA rep embedded in your dev group to assess dev and deployment processes". They'd be laughed out the room and told "no, that's secure and proprietary". Yet Crowdstrike's epic fail last year was no less damaging than Wannacry, and whislt it's not as dramatic as a door plug falling out in-flight, massive system failures can have lethal consequences. A global outage, hundreds of thousands of boxes bricked and requiring manual intervention. Massive disruption to travel, banking and retailers. There was a national ground stop in the US. And this from a company who had previously tried to block NSS Labs from publishing a report on Cloudstrike's end-point protection in 2017, claiming that NSS had illegally accessed it's software to perform "improper security testing".

I put it that if the NHS or an affected airline said "right, we want an embedded QA rep monitoring your deploys" they have as much right to that as having reps on Boeing's factory floor.

Developing frameworks and good practice is a pre-requisite to holding organisations accountable for not following best practice. And in the process, nudge the "Overton Window" equivalent for what is expected of vendors in the right direction.

Obligatory XKCD.

[Grindslow_knoll]

Response culture

It's not just prevention, but how a company deals with the inevitable breach.

Do you have in your employment contract that, if an employee reports an issue, or even makes a mistake, they will not be fired if they come clean and learn, as well as publish a postmortem?

Those post-mortems, if done honestly and openly, are much more valuable than solely relying on checkbox certification.

Imagine a database like for CVEs, but then for post-mortems, including the human responses

[Anonymous Coward]

Software Vendors Are The Tip Of The Iceberg!

(1) "...international bodies such as NIST..." Really? This is the organisation which pushed insecure encryption protocols!! I wonder why!!

(2) Amazon databases set up WIDE OPEN......by ignorant CUSTOMERS.

So......both government bodies and companies buying services.....both are responsible in many cases for some of the insecurity!!

Blaming software vendors and talking about "software security standards" is simply the usual misdirection......."We are doing something".........

[Citizen Chauvelin]

Re: Software Vendors Are The Tip Of The Iceberg!

No it isn't. If vendors write insecure shit infested with vulns known for decades, then it's their fault. No-one else's, theirs. If they're that wilfully incompetent, they should find another way of making a living, because they're not for for purpose for that one.

[Zoopy]

Re: Software Vendors Are The Tip Of The Iceberg!

"international bodies such as NIST"

International? The first word of NIST is literally "National".

[nobody who matters]

Re: Software Vendors Are The Tip Of The Iceberg!

Indeed. NIST really only oversees things in the USA, although some of that does have repercussions elsewhere in the world. .

[HMcG]

Re: Software Vendors Are The Tip Of The Iceberg!

> some of that does have repercussions elsewhere in the world. .

Not much longer. The USA is becoming more irrelevant every day.

[Citizen Chauvelin]

Well, so flat out nonsense from the Vendor side there then.

"McKenzie's take was that customers will ultimately drive vendor change. If they start prioritizing security, that's what vendors will give them."

Utter bullshit.

As someone who is responsible for actually carrying out basic security checks on incoming systems and upgrades (and this is just he obvious database side snafus - and closely associated issues - y'know, like plaintext user and password data - for a user they wanted to give SA - in the config file, SQLi, PoLP - trivially basic stuff), my experience is that all the vast majority of suppliers give you in response to highlighting IT Sec issues is hysterics, demands to escalate (to someone who invariably says "good, that's what I pay him for") and point blank refusals to address issues "because no-one else has complained" - which apart from being irrelevant, I doubt. This is not an occasional thing, it's just about every system we deal with, and we deal with highly sensitive data that can make a massive difference to people's lives if it's lost or compromised. Not one toss given about that though.

Bluntly, the number of vendors in my area who give a flying one about IT Sec, and will look to address highlighted issues rather than have a fit of the vapours like a Victorian Maiden Aunt subjected to an obscenely biological suggestion, when they're highlighted and a fix requested, are as rare as rocking horse shit.

[cookiecutter]

Shock capitalism strikes again

We shouldn't have to lower our share price or dividends or take any responsibility for anything we do & we should be allowed to carry on lying to customers about the ability of our products to our customers.

Defender has nothing to do with "fulfilling a need", it's free. That's why people use it. It's shite too.

Since when in the entirety of human history has any publicly company done anything when not forced to buy government regulation. Volvo only prioritised safety because it wasn't an American company. We wouldn't need NCAAP if car manufacturers could be trusted. I'm old enough to remember the car industry pointing to volvo as the gold standard while at the same time refusing to implement electric windows that wouldn't strangle children.....oh but if people REALLY wanted it, they wouldn't buy cars without the safety features implemented.

[elsergiovolador]

Re: Shock capitalism strikes again

Defender has nothing to do with "fulfilling a need", it's free. That's why people use it. It's shite too.

Dunno, always had a virus when used anti virus software, that stopped when just gone with Defender.

[Like a badger]

Re: Shock capitalism strikes again

"Since when in the entirety of human history has any publicly company done anything when not forced to buy government regulation. Volvo only prioritised safety because it wasn't an American company. "

Well... seat belts were invented and offered long before regulators insisted. Indeed, the first car maker offering them that I can see (wiki) evidence for was US maker Nash, in 1949. And apparently customers didn't want them, and some had dealers remove them. Anti lock brakes, likewise offered decades before they were mandatory, first mass produced car perhaps the Chrysler Imperial...fog lights, dual circuit brakes, radial tyres, airbags etc etc.

There's a reason many cars don't have all the safety toys, and that's simply that a good proportion of the public won't pay for them. Whether it's beer, cars, clothing, chocolate and everything else, most buyers are happy to pay less and get less sophistication. What regulators don't do, but the car industry does deliver, is technology trickle down. As volume builds, prices come down, toys become cheaper, and are offered more widely. My dull lower-middle range estate has performance, comfort and safety sophistication that would have been real high end a few decades back.

[OhForF']

Re: Shock capitalism strikes again

And with all that trickle down and other things manufacturers did the state still had to step in and mandate seat belts and their usage in the end.

Customers won't be able to judge whether an application was developed with even basic security standards in mind or not. Unless you are a big company the supplier won't even give you the information you'd need to do a security audit so there is no chance IT security will be driven by customers.

[fg_swe]

As Opposed To Socialist Car Making

-No ABS

-No Airbags

-No seat belts

In general, the most powerful socialist country(the USSR) was an economic basket case and struggled to feed their peoples. It was a deeply rotten system that valued loyalty over everything else. They never had the resources to design+produce ABS brakes for citizen's cars. They might be able to do ABS brakes for jet aircraft, but only barely.

Marxist rhetoric does very little to improve things.

[fg_swe]

Re: As Opposed To Socialist Car Making

Airbags came about when capitalist DAIMLER worked with military(read: semi-state) missile motor producers out of Aschau to design+build the "rocket motor" to blow up the air bag in a matter of milliseconds.

https://www.auto-motor-und-sport.de/verkehr/70-jahre-patentanmeldung-airbag-passive-sicherheit/

https://www.innsalzach24.de/service/azubi-offensive/zf-lifetec-in-aschau-am-inn-die-zukunft-der-fahrzeugsicherheit-kann-in-deinen-haenden-liegen-6083613.html

[collinsl]

Re: Shock capitalism strikes again

Defender has nothing to do with "fulfilling a need", it's free. That's why people use it. It's shite too.

It's really not - it's Gartner top-right and is among the best AVs for finding and defeating threats. Microsoft have actually done pretty well with it considering it was one of the worst AVs in the windows 7 era.

[heyrick]

Whitehouse put forth the idea of perhaps punishing vendors that fall short of expectations

How about we start with Oracle and their numerous well-paying local council contracts that swell in size but don't deliver?

Then cast an eye over Fujitsu. Is everything else they've done as bad as Horizon was?

If the big guns aren't seen to be held to account for their failures, one shouldn't be surprised if others don't give a crap.

[Tron]

You should only enforce honesty, security and quality on the tech sector...

...after buying up all the A4 pads, biros and calculators that you will need to stay in business. Because you won't be using any software any more.

The UK had skin in the game as part of the EU, but no global software vendor is going to make major changes to a product for it now. It's possible that some will walk from the EU or call on Trump to intervene if the EU get stroppy.

[Anonymous Coward]

Re: You should only enforce honesty, security and quality on the tech sector...

"but no global software vendor is going to make major changes to a product for it now"

That's such utter garbage I can't even be bothered to argue how wrong it is. Do you have a "Brexit ruined my life forever" sticker for your car?

[rg287]

Re: You should only enforce honesty, security and quality on the tech sector...

It's possible that some will walk from the EU

Well I hope they don't let the door hit them on the way out.

We have plenty of EU/EEA/European alternatives.

Two major OS houses in Canonical and SUSE, no shortage of productivity options between LibreOffice/Collabora Office and OnlyOffice. JetBrains, NextCloud, Proxmox, Acronis, etc. Jolla can even do us a mobile OS in SailFish.

DC/Cloud? I think we can get by with OVH, Scaleway, Hetzner, Exoscale, UpCloud, et al.

Encryption? Ah yes, Norwegian Buypass have their own root and offer an ACME SSL service.

But how do we network? Well, Nokia, Ericsson and Microtik have a lot covered off. There may be things that Cisco/Juniper/Extreme do better. But nothing irreplaceable. Andrews & Arnold dogfood their own Firebrick routers on their network (all software & hardware design, development and manufacture is in UK. A genuinely "sovereign" product).

Actual compute hardware is harder, leaning heavily on x64 IP. But let's face it, we're not going to lose access to US compute any more than the US could stand being cut off from ARM (or ASML!). Relying on PRC and Taiwan (Lenovo/Acer/Asus) in the absence of Dell/HPE/Supermicro would be a bit iffy. There's Fujitsu and Vaio of course, and Medion in Germany (owned by Lenovo, but that's a matter of finance - the HQ & engineering is in Essen). And system builders like Framework or Stone Group.

Seriously. We're fine.

[martinusher]

Its not just security

Its really an issue with quality. Security flaws are just a type of quality issue, We've built a culture that thrives on "pile it high, do it fast and rely on reacting quickly when users find issues". Security is just another way of letting users find bugs but in this case the users exploit them to cause harm to people actually trying to use the code. Its not a standalone issue -- the fact that my system locks up or somehow loses track of interfaces that have been working fine for years is as much of an issue than someone exploiting a flaw to get my credentials and so invade our network.

I was reading an article just yesterday about the problems car manufacturers were having making 'Software Defined Cars" -- cars that receive constant updates over the air to add features, fix problems and so on -- and how their users were pushing back against this. Its partly because being in a tin box hurtling along at 70mph is not a good time for users to find a problem with its systems but also because users are getting fed up with the constant churn of features, including the rather negative one of deliberately disabling functionality as part of a marketing plan. All this is just nonsensical makework; we may have to put up with it if we don't have a choice but the moment a proper choice is offered then no amount of bells and whistles can detract from the very real drawback of a fundamental lack of quality.

[fg_swe]

BS

1.) the OTA update is done at 3AM in the night, when the car has been at rest for hours. All critical software is digitally signed and verified, in case the funny telecom networks are hacked.

2.) There exist reliable processes for creation of safety-critical automotive software, such as ASPICE+ASIL.

3.) Even more demanding software applications exist in aerospace and train signalling. They can work nicely (Airbus) if done correctly. They can fail, if/when beancounters run the show (Boeing).

3.2) Modern fighter jets such as Jäger 90 cannot fly without realtime control software, as they are designed to be aerodynammically unstable. This enables them to turn as tightly as possible in a dogfight or other combat situations. Airbus knows how to do this safely, with extreme quality assurance measures in place. No loss of airframe with Jäger 90 due to software up to now. Hundreds of airframes in daily service.

[Roland6]

Re: Its not just security

We’ve also built and largely instutionalised a culture of poor education of programmers. Perhaps a big improvement could be achieved by elevating programmer/developer to a similar level to engineer ie. Make programming/developer more professional. A side effect of this is it would kill the idea of using AI to do software development.

[David_J]

Legalise cracking

The law currently reduces the incentives to provide secure systems: crackers who show how they crack systems to both target and regulator should be rewarded according to the severity of the breach they achieve at the target company's expense - effectively a fining the company (at a regulator set level) for inadequate security. Extortion, blackmail, damage to remain illegal - in case that wasn't clear.

[fg_swe]

Bingo

There must be serious financial incentives to publicize exploits for the common good. Then software engineers have an incentive to be white hats.

Make the reward pool a percentage of revenue.

[ecofeco]

Not until the pain is high enough

Will companies change.

That means a LOT more theft. Which of course means, us peons will end up paying for their mistakes.

[Anonymous Coward]

TBH I skimmed this, I've worked in Infosec for over 20yr and these discussions haven't changed, the suggestions haven't changed and really no business has changed. In fact I'd argue that thing might even be considerably worse than they were 20yr ago do to the proliferation of devices, apps etc.

There is no point in having a panel made of of security people (and tbh I often wonder if these guys are more professional panel member than the dead eyed security people that really do the job), who sit and regugitate the same stuff, yes development should build ore securely, yes products should be secure and be maintained, yes users should know to avoid email links they don't trusts. But no one does, 20yr+ of the same rhetopric and still no one gives a shit.

Why don;'t they have a panel with senior managment and MBA types and ask them why they don't invest in secure development, why don't you test properly, why don't you listen to the secuirty people you employ, what will it take to make you spend a little to improve the situation.

I suspect we know the answers anyway, unless the board's balls are in the fire for the impacts related to security failings then security is another form of greenwashing. Just enough to tick the boxes but without actually spending any money, and ideally cutting budgets and passing responsibility to end users.

CE/+ isn't a very good standard, even ISO27001 isn't the gold star people like to think it is. They're just paper exercises.

[fg_swe]

MBAs+Security

What can they contribute ? Very little : nice talk and little substance.

Security must come from engineers with years and years of experience as developers. From engineers who have analyzed exploits. From computer scientists, who can provide solid theories such as scanner and parser design, proper grammars (as opposed to hairballs such as serialization or ad hoc parsers).

[OhForF']

MBAs contribution to security

>What can they contribute ?<

They could provide the necessary resources and insist on security audits before something is released. As long as time to market is considered more important than a reliable safe product that is not going to happen.

"Ship it - if a problem turns up we can just patch it"

[Anonymous Coward]

Re: MBAs+Security

What can they contribute?

We know what the issues are, we know how to fix them but the security guys do not have the authority or budget to fix it.

The board and the MBA types do but they are actively choosing not to. It might be useful to find out why.

We do know about budget cuts and profit margins but why do they seem to actively ignore their own security people, ignore regulators, ignore best practice that is published everywhere?

IMHO Infosec is 90% psychology and only 10% technology. The tech is the easy bit. The hard bit is getting the snr meatbags to pay for it, allow downtime, do the training, remember the training when they are busy, effectively do some things that don't directly contribute to the task at hand.

[Roland6]

Re: MBAs+Security

> What can they contribute ?

If IT security and business continuity were to subjects on the MBA programme, they would firstly have better awareness of such matters, and secondly the tools to better assess and cost the risks, creating a C suite demand and budget for security etc.

[Anonymous Coward]

If end users need to stop buying shit software then IBM won’t be in business for much longer!

[JohnHMorris]

No business case for infrastructure ...

Incentives are great. Consider though that "there's no business case for infrastructure". And security and software is infrastructure. But this seems odd. How does anything ever get built? Everybody is always talking about a business case.

A business case though only applies to operations. Where investments in capital and systems etc. are already in place. When you want to build something new like an office tower or to acquire a new machine for the factory floor or to construct a new rail line between London and Birmingham, these are all investment cases. Otherwise there's no budget for any of this out of operations.

And an investment case means board of directors accountability. And investor accountability. And in government, ministerial accountability. There's no sense blaming the IT department where the metrics are typically cost control. Or ginned up alignment with corporate goals.

Shouting louder about cyber security is just performance without better governance. And skin in the game.