Power plants, utilities 'just hanging right off the internet's tubes'

Trump?

MAKE AMERICA GREAT AGAIN!

There is only one way to fix this - replace the MBAs that are impersonating engineers with real engineers

You really think that true engineers are all security experts, or sufficiently security conscious as to know who to consult? Rose tinted spectacles, mate.

I'll wager just as many security and SCADA disasters are caused by engineers without PHB assistance as those with. I know of a product being developed at the moment in my company, and it's engineers playing god who are the root of the inevitable security problem. The commercial guys want a product that works, our engineers (all fully qualified chartered engineers) simply don't have the expertise in security and in software to know the right questions to ask.

Re: Accountants are the issue

Toothless tiger laws are equally responsible.

Make it that C level executives and Board members are financially responsible in the event of a hack or utility outage and see how quickly things change.

It's no point just fining a company, all they will do is pay the fine and continue doing nothing, fine the people at the top, they get paid the big bucks, they should take the responsibility.

Re: Accountants are the issue

I wouldn't say the accountants per se. Accountants are a predictable bunch and will do whatever the numbers tell them to do. What is necessary is to an input into their system that monetizes the risk of compromise. Once you do that the accountants will line up neatly behind or possibly even in front of the engineers insisting the appropriate measures be taken.

I will grant this is the one place where it will be necessary for governments to act to create the financial incentive. It is actually fairly simple:

1) The corporation will be responsible for all damages that result from a compromise of their systems. This will include not only the cost of repair but the total cost of down time for any and all of their customers who are affected by the compromise.

2) While the corporation may engage in risk pooling, it may never completely transfer the risk to another corporation.

3) In the event the corporation does not have sufficient means to fulfill its responsibilities under item #1, the officers of the corporation and its board of directors will be held personally liable for the uncovered damages.

Even with the typical lead times for infrastructure improvements in these industries, I expect that were laws specifying this enacted, 85% of the problems would be fixed within a year, and in excess of 95% would be fixed in two. By year three we'd be approaching several sigmas of assurance.

Re: Die Hard 4.0

I'm sorry, but are you saying that something about Live Free or Die Hard is even vaguely accurate?

Pretty much any idea from that film beyond "some things are controlled using computers that have Internet connections" is a wild fantasy.

Also, the "super hacker controls all the infrastructure" theme is a long-standing and extremely tired Hollywood cliche. There were elements of it in 1995's waste-of-Sandra-Bullock The Net and painfully-dumb Hackers. It was featured in the overrated '92 Sneakers.

TV Tropes refers to this as Everything Is Online, and they have film references going back as far as 1983's awful Superman III. (TV Tropes says this last example comes from "before the Internet as we know it"; the TCP/IP Internet had been around for several months when the film was released, but not when it was being written, of course. On the other hand, there was the NCP Internet and various other large networks, such as IBM's HONE network, which was bigger than the Internet for some years. At any rate, the point stands - this theme is so obvious that pop culture anticipated it before it was technically feasible.)

Re: Die Hard 4.0 - generator and borehole

"Thinking of getting a generator and a borehole installed at home"...

What, you're not married?