6 ms·

National Security has always been a federal government responsibility yes. But what does that fundamentally mean for boots on the ground? NSA doesn’t do IT for

National Security has always been a federal government responsibility yes. But what does that fundamentally mean for boots on the ground? NSA doesn’t do IT for the DoD/W, DHS doesn’t do IT for the government, CISA only gives guidance where they can. And IT does not equal OT. The issue comes down to actual skilled people hours to do the work and resource constraints to do so. I agree that in theory this would not be a stretch if the stars aligned, but these are for the most part, not federal government funded entities nor government controlled even at a state level. They are usually clooged together by 100 years of paper maché. And that’s just water. What about Energy? Data Centers? Pharma? Regulation is way too far behind to just instantly drop a silver bullet. And 100% agree that we are witnessing repercussions of leadership that did not have much forethought but that ain’t new and goes back quite a ways especially in CI.

ImPostingOnHN 2mo ago
> IT does not equal OT I'll say, you should see the hours I have to work sometimes. Honestly I've rarely seen IT jobs pay OT.
throwaway894345 2mo ago
> The issue comes down to actual skilled people hours to do the work and resource constraints to do so. It comes down to incentives. If you want broad security you have to do more than hope that every water utility will both hire good people and also allow them to do their jobs properly. > But what does that fundamentally mean for boots on the ground? How does any regulation look on the ground? How does the federal government regulate banks and airports? > these are for the most part, not federal government funded entities nor government controlled even at a state level Neither are banks or airports > What about Energy? Data Centers? Pharma? Energy and pharma are already regulated. Maybe data centers will be eventually if they are deemed sufficiently critical. > Regulation is way too far behind to just instantly drop a silver bullet. I don’t know what this even means in the context of securing our water system. Do you mean to say that regulation can’t ensure that these software systems don’t use default passwords and so on? > And 100% agree that we are witnessing repercussions of leadership that did not have much forethought but that ain’t new and goes back quite a ways especially in CI What is new is that we started a war with a country with a respectable technology competency without doing anything to shore up our defenses.
- fathermarz 2mo ago
  Yes there are pieces of what you are saying that make sense theoretically. But what I mean by a silver bullet, is it is a systemic change that needs to happen in a bigger swing than just “regulate”. It is a top down initiative that needs to happen in a more meaningful way. It’s adjacent in a similar way to the issue of air traffic controllers. Talent shortage, old equipment, old hats, burn out and the like. It needs some real backing and effort to make it happen.
  - throwaway894345 2mo ago
    > Yes there are pieces of what you are saying that make sense theoretically. But what I mean by a silver bullet, is it is a systemic change that needs to happen in a bigger swing than just “regulate”. Top down regulation drives the systematic change, just like it did with the banking sector. > It is a top down initiative that needs to happen in a more meaningful way. It’s adjacent in a similar way to the issue of air traffic controllers. Talent shortage, old equipment, old hats, burn out and the like. I'm not sure how this analogy works. What's the ATC equivalent to leaving default passwords on critical infrastructure?
    - fathermarz 1mo ago
      > Top down regulation drives the systematic change, just like it did with the banking sector. Banking is resourced well enough to absorb that regulation and stand up a compliance team. I bring up ATC because of the consequence. Default passwords are a symptom, not the failure mode. ATC is already federal, with the FAA running that. 20 years of regulation has not fixed the problems that still plague that industry: outdated equipment, short-staffed, a small niche talent and training pipeline, and people dying as a consequence of those systemic problems. That's even closer to my point. Making something regulated doesn't change the inherent problems inside the industry.

ImPostingOnHN 2mo ago

> IT does not equal OT I'll say, you should see the hours I have to work sometimes. Honestly I've rarely seen IT jobs pay OT.

throwaway894345 2mo ago

> The issue comes down to actual skilled people hours to do the work and resource constraints to do so. It comes down to incentives. If you want broad security you have to do more than hope that every water utility will both hire good people and also allow them to do their jobs properly. > But what does that fundamentally mean for boots on the ground? How does any regulation look on the ground? How does the federal government regulate banks and airports? > these are for the most part, not federal government funded entities nor government controlled even at a state level Neither are banks or airports > What about Energy? Data Centers? Pharma? Energy and pharma are already regulated. Maybe data centers will be eventually if they are deemed sufficiently critical. > Regulation is way too far behind to just instantly drop a silver bullet. I don’t know what this even means in the context of securing our water system. Do you mean to say that regulation can’t ensure that these software systems don’t use default passwords and so on? > And 100% agree that we are witnessing repercussions of leadership that did not have much forethought but that ain’t new and goes back quite a ways especially in CI What is new is that we started a war with a country with a respectable technology competency without doing anything to shore up our defenses.

fathermarz 2mo ago
Yes there are pieces of what you are saying that make sense theoretically. But what I mean by a silver bullet, is it is a systemic change that needs to happen in a bigger swing than just “regulate”. It is a top down initiative that needs to happen in a more meaningful way. It’s adjacent in a similar way to the issue of air traffic controllers. Talent shortage, old equipment, old hats, burn out and the like. It needs some real backing and effort to make it happen.
- throwaway894345 2mo ago
  > Yes there are pieces of what you are saying that make sense theoretically. But what I mean by a silver bullet, is it is a systemic change that needs to happen in a bigger swing than just “regulate”. Top down regulation drives the systematic change, just like it did with the banking sector. > It is a top down initiative that needs to happen in a more meaningful way. It’s adjacent in a similar way to the issue of air traffic controllers. Talent shortage, old equipment, old hats, burn out and the like. I'm not sure how this analogy works. What's the ATC equivalent to leaving default passwords on critical infrastructure?
  - fathermarz 1mo ago
    > Top down regulation drives the systematic change, just like it did with the banking sector. Banking is resourced well enough to absorb that regulation and stand up a compliance team. I bring up ATC because of the consequence. Default passwords are a symptom, not the failure mode. ATC is already federal, with the FAA running that. 20 years of regulation has not fixed the problems that still plague that industry: outdated equipment, short-staffed, a small niche talent and training pipeline, and people dying as a consequence of those systemic problems. That's even closer to my point. Making something regulated doesn't change the inherent problems inside the industry.