>I don't I've quite articulated why I'm so critical of the tech industry. Tech isn't just software anymore. They're coming for ag, food, & manufacturing- & they're bringing a negligent attitudes towards risk & safety that they learned in the cushy world of apps.
And this malware is affecting industries with a strong incentive for safety, think about what that might imply about every other industry.
She is picking the wrong target. Tech would do security if directed to do security. Business management doesn't care about security.
Until someone has to pay big money or do jail time for lack of security, this will not change.
Heavy industry cares a lot for safety. An exploding refinery is not in any company's best interest. But the systems they rely on have absolutely no notion of security. They have no way to distinguishing between true and spoofed input values that are fed into a control system.
There is some, but not a lot of awareness in the industry that the implicit trust between components in these systems is insecure and ultimately jeopardizes their safety. It is too easy to spoof process values that are sane, but do not reflect the true state of the system. The systems fundamentally miss any mutual authentication between their components.
Process measurement devices typically even offer a simulation mode in their firmware to do just that. At worst, all you have to do is to crack a simple password to gain access to this feature remotely.