Empty shelves, empty coffers: Co-op pegs cyber hit at £80m The Co-operative Group has revealed the cyberattack that knocked its systems offline earlier this year will leave it nursing an £80 million hangover. The registered society - owned by members not shareholders - includes a food retail biz and provides legal, funeral and insurance services. Today it said the breach, which …
Any views on why Plod are so effing slow, then? I'd have thought copying logs and images doesn't take that long, and then they can go and navel gazed (or whatever they do) in peace, leaving the business to try and get back on its feet?
At this rate, more commercial damage will have been caused by the delays imposed by the investigators than by the original hack.
Only view I have is that this is at a forensic level so they're going through it with a fine toothed comb.
Or, the Police are equally as inept as JLR/TCS and have no real good way of knowing what evidence they're looking for or what they're looking for in general.
I think they're learning as they go personally.
This post has been deleted by its author
Any views on why Plod are so effing slow, then?
* Attacks aren't done in a few seconds. Often they take weeks or months to slowly get a foot hold.
* Attacks are rarely just one system. Lots of lateral movement. Lots of systems to examine.
* Systems aren't small. Lots of data & logs to examine.
About a week after the Co-Op had got "back to normal" I went in to my local one and was asked if I was a member. I said no. The lady asked if I liked to join. I looked at her and said "I'd rather not given you couldn't look after the current membership details" and was told that was a different Co-Op.
Either way, the more of this nonsense comes out the more inclined I am to just shop at Aldi or local producers to get the same prices other supermarkets give you in return for a membership.
Its very "told you so", but C suites have wilfully underinvested in IT for a decade or more, while the risk was very clear. The costs are becoming clear - but for every C-Suite person, its a risk profile of "so long as it doesn't happen on my watch". And they are a bunch of risk-takers, as they can always golden-parachute out when things do go wrong. Given that system, how companies learn? Perhaps the smaller ones can. Fingers crossed.
Worse than that. After years of outsourcing the companies core IT systems and cloudifying everything; good security (and a whole load of other NFR's) is now impossible to achieve. The corporate obsession for lower costs (at a balance sheet level) at any cost (no moral values here) will always result in products and processes that only just work with 'work' defined very loosely. The corporate way out of this is to insure against the introduced risks, which like outsourcing, seems to make it someone else's problem; at a cost. The result of all of this is that the products and services are shit, yet cost the consumers more, but hey all of the companies in the gravy chain are indemnified.
Welcome to the machine...
