[acdha]

I like seeing these guidelines but I definitely have been thinking about this essay from a couple months back which I think accurately calls the current situation untenable. These are all good advice, but even most government agencies have nowhere near the budget to fully implement them.

https://doublepulsar.com/the-hard-truth-about-ransomware-we-...

> The truth is, while governments are pushing frameworks such as Zero Trust, the amount of orgs who successfully implement these are… not many. Many companies can barely afford to patch SharePoint, let alone patch the the tens of thousands of application vulnerabilities shown in a vulnerability management program, and really struggle with accurate asset lists. … > My concern, for years, has been that ransomware gangs have not only closed the loop on monetization, they are also acquiring so much income they are becoming a bigger operational threat than some states. > > To give an example, one ransomware group receiving a $40m payment for attacking a cybersecurity insurance company gives the attackers more budget to launch cyberattack than most medium to large organizations have to defend against attacks in total. And that’s just one attack, from one group, that barely made the news radar of most people. > > The payment amounts are increasing, the frequency is increasing, the sophistication is increasing.

[waz0wski]

Goes hand-in-hand with the recent scathing message from Nicolas Chaillan regarding DoD development modernization efforts

https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...

[acdha]

I know the HN discussion had some debate over that (https://news.ycombinator.com/item?id=28408399) but I definitely think there's a lot of good discussion about how to make these problems more tractable. Even in the .gov space, which does tend to treat security as something you can't just brush away, there's generally limited money and resources for actually shipping improvements and especially challenging are the issues of legacy apps (which probably require Congress to allocate money for replacements) and adequately staffing for O&M (contractors are usually a bad fit with lower continuity and restrictions on flexibility). Most of the breaches you hear about trace back to something which someone has been complaining about for ages but been unable to get support for actually fixing.