The only way to change that is massive fines, there is no chance that a technical system can control human behavior...ATM at least, like Plane-crashes technically it's always human error.
EDIT: Corrected Plan-crashes and told Mozilla to pay a 1 Million $ fine, because the auto-correct software did not work correctly ;)
In regard to human error, I think we are approaching the point where it is useless to focus on individual hackers, companies, admins or users.
To pick the most famous example of something we should rethink (not that it would address the hack in this news story): users on the web mainly read text, yet our browsers enable Javascript by default.
To me it seems the ways we store and share data in IT are starting to fail. It's at the point where every interaction a regular person engages in (with banking, shopping, healthcare, social life, work, education, etc) has a real chance of becoming public. That's not sustainable.
I think we can do a lot by thinking about only storing the data that is needed and for only the time that is needed. I think GDPR has been a first step in the right direction and it also adds fines for abusers.
Massive fines sounds like an easy win but it doesn't work in practice in the sae way that massive fines don't stop corporate polluters, don't stop medical negligence and don't stop crime in general. Are they useful? Only where it is clear where the responsbility lays.
Take the VW emmissions scandal as an equivalent issue imho. Who gets a fine? VW? That isn't really fair if the decision was taken by an employee. The employees? They can't afford to pay a fine. All this would do is make it harder for disruptive startups who can't afford the potential fines.
Sadly, I think like most things, it will take a whole raft of things including educating people, punishing people and companies, regulating who is allowed to produce and sign-off systems, have mandatory MOTs for software so they can't be left to languish and even potentially creating seprate WWWs for those who follow the rules and the general public can trust vs those who believe in complete liberty to do whatever they want and who cannot be exposed to the general public who won't understand the risks they are exposing themselves to.
like Plane-crashes technically it's always human error
>Take the VW emmissions scandal as an equivalent issue imho. That isn't really fair if the decision was taken by an employee
That's a bad example, they got massive fines in the US, not so in germany (for obvious reasons), and yes it was for sure the engineer who took that decision and for sure not the management ;)
A example for responsible storage of such data would be:
If you want to store my highly private data (health records), you have to use a terminal to a government mainframe...you are not allowed to export, process or store it anywhere else.
What does MOTs mean?
To be honest, I want in the net for special people that cannot be exposed to the general public.
Presumably lbriner hopes the inspectors would fix IoT camera botnets rather than, say, demanding you install McAfee antivirus.
Nope, tho company is liable. https://en.wikipedia.org/wiki/Vicarious_liability
That's a $1M fine for misspelling "Plane". ;)
Also, it's definitely the software. There's a wonderful talk by Alan Kay regarding this, but I cannot find it. It might be referenced in Jon Blow's talk: - https://www.youtube.com/watch?v=ZSRHeXYDLko
In this case the taxpayers will bear the brunt of those fines. In other cases, the consumers.
For private companies in competitive industries I couldn't see this affecting consumers in a negative way. It may affect the bonuses of the overpaid but few would lose sleep over that.
companies need to be held accountable for the garbage they create. peddling alpha/beta software to consumers or pushing code to production while they don't have a disclosure policy and rather purchase ransomware insurance than invest in quality-control must be forced with fines too big to ignore (make it 1% of annual global turnover _not_ profits)
secondly we need to decriminalize hackers that take down vulnerable shit. instead create a business model that allows someone like brickerbot/janit0r to take dangerous devices offline if it is known to be unpatched for x-months still. similar what the feds did with patching of the recent MS exchange exploit but more bottom-up.
finally criminalize all cryptocurrency so that they can no longer be converted to FIAT in any legal sort of way. want to use bitcoin? fine your only way to turn it into value is by buying a gift card that only is accepted by a corner shop in Uzbekistan. as another alternative that is also the other extreme, make banks adopt cryptocurrency (https://twitter.com/JoeUchill/status/1393697279941431300) so it turns into a regulated white-market while outlawing the grey areas.
taking these measures further, if you're getting pwned and do not disclose it within 1 week, or info surfaces that you paid ransom without disclosing it then your CEO and CISO bonk! go straight to jail. That would immediately put pressure into solving the boring security shit, like curating and maintaining a good quality SBOM, asset catalogue etc (... come to think of it, if inventory is missing in any org that processes PII, or you get hit by an OWASP top-10 then immediately jail time as well).
it all starts and fails with holding people responsible for what they do and make it impossible to hide behind the name of a company. salaries can be adjusted to actual responsibility people carry in the company, no more blaming the intern.
^^ the reason why any of these measures will never happen is because those who would have to enforce it are themselves corrupt and totally dependent on the broken system in order to get cover and plausible deniability for their own crimes: https://www.newsweek.com/exclusive-inside-militarys-secret-u...
It is unfair to hold an app developer liable, when there is no practical way to create even a small CRUD application which doesn't have many million lines of code written by thousands of developers as dependencies (counting an OS as a dependency). And this becomes worse every year.
IMHO the only good way to create secure system is start from keeping the system simple and easy to audit. To keep it this way one would have not only invest a lot of time, but also to sacrifice non-essential features (something customers/users not used to do and will have a hard time accepting).
If we keep assuming humans are suddenly going to stop making mistakes then these things will never go away.
I almost never blame the user or human, I blame the software.
Given that, I think there's more to be gained by looking at the "low probability" side of things.
Some historic examples of attacking the "low probability" side include building codes and speeding fines - both have pretty strong evidence for their efficacy.
A comparable initiative for software might fine those found keeping data after they do not need it (like GDPR), or mandate that sensitive data is stored behind appropriate access controls (like PCI does).