Should IT Professionals Be Liable for Ransomware Attacks? (acm.org) 250
Denmark-based Poul-Henning Kamp describes himself as the "author of a lot of FreeBSD, most of Varnish and tons of other Open Source Software." And he shares this message in June's Communications of the ACM.
"The software industry is still the problem." If any science fiction author, famous or obscure, had submitted a story where the plot was "modern IT is a bunch of crap that organized crime exploits for extortion," it would have gotten nowhere, because (A) that is just not credible, and (B) yawn!
And yet, here we are.... As I write this, 200-plus corporations, including many retail chains, have inoperative IT because extortionists found a hole in some niche, third-party software product most of us have never heard of.
But he's also proposing a solution. In Denmark, 129 jobs are regulated by law. There are good and obvious reasons why it is illegal for any random Ken, Brian, or Dennis to install toilets or natural-gas furnaces, perform brain surgery, or certify a building is strong enough to be left outside during winter. It may be less obvious why the state cares who runs pet shops, inseminates cattle, or performs zoological taxidermy, but if you read the applicable laws, you will learn that animal welfare and protection of endangered species have many and obscure corner cases.
Notably absent, as in totally absent, on that list are any and all jobs related to IT; IT architecture, computers, computer networks, computer security, or protection of privacy in computer systems. People who have been legally barred and delicensed from every other possible trade — be it for incompetence, fraud, or both — are entirely free to enter the IT profession and become responsible for the IT architecture or cybersecurity of the IT system that controls nearly half the hydrocarbons to the Eastern Seaboard of the U.S....
With respect to gas, water, electricity, sewers, or building stability, the regulations do not care if a company is hundreds of years old or just started this morning, the rules are always the same: Stuff should just work, and only people who are licensed — because they know how to — are allowed to make it work, and they can be sued if they fail to do so.
The time is way overdue for IT engineers to be subject to professional liability, like almost every other engineering profession. Before you tell me that is impossible, please study how the very same thing happened with electricity, planes, cranes, trains, ships, automobiles, lifts, food processing, buildings, and, for that matter, driving a car.
As with software product liability, the astute reader is apt to exclaim, "This will be the end of IT as we know it!" Again, my considered response is, "Yes, please, that is precisely my point!"
"The software industry is still the problem." If any science fiction author, famous or obscure, had submitted a story where the plot was "modern IT is a bunch of crap that organized crime exploits for extortion," it would have gotten nowhere, because (A) that is just not credible, and (B) yawn!
And yet, here we are.... As I write this, 200-plus corporations, including many retail chains, have inoperative IT because extortionists found a hole in some niche, third-party software product most of us have never heard of.
But he's also proposing a solution. In Denmark, 129 jobs are regulated by law. There are good and obvious reasons why it is illegal for any random Ken, Brian, or Dennis to install toilets or natural-gas furnaces, perform brain surgery, or certify a building is strong enough to be left outside during winter. It may be less obvious why the state cares who runs pet shops, inseminates cattle, or performs zoological taxidermy, but if you read the applicable laws, you will learn that animal welfare and protection of endangered species have many and obscure corner cases.
Notably absent, as in totally absent, on that list are any and all jobs related to IT; IT architecture, computers, computer networks, computer security, or protection of privacy in computer systems. People who have been legally barred and delicensed from every other possible trade — be it for incompetence, fraud, or both — are entirely free to enter the IT profession and become responsible for the IT architecture or cybersecurity of the IT system that controls nearly half the hydrocarbons to the Eastern Seaboard of the U.S....
With respect to gas, water, electricity, sewers, or building stability, the regulations do not care if a company is hundreds of years old or just started this morning, the rules are always the same: Stuff should just work, and only people who are licensed — because they know how to — are allowed to make it work, and they can be sued if they fail to do so.
The time is way overdue for IT engineers to be subject to professional liability, like almost every other engineering profession. Before you tell me that is impossible, please study how the very same thing happened with electricity, planes, cranes, trains, ships, automobiles, lifts, food processing, buildings, and, for that matter, driving a car.
As with software product liability, the astute reader is apt to exclaim, "This will be the end of IT as we know it!" Again, my considered response is, "Yes, please, that is precisely my point!"
No, my compiler is mine. (Score:3, Insightful)
No my compiler is mine and I do not have to yield it to you. I will continue writing code you may not like or agree with. Politely fuck off.
Re:No, my compiler is mine. (Score:5, Insightful)
I don't think anyone is preventing you from writing code. What the idea is that you be -responsible- if your code is broken.
What other industry can people fuck up as badly as software, with no consequences?
Re: No, my compiler is mine. (Score:4, Insightful)
Extreme liability is in itself a form of prevention. Please reread the above once more.
Re: No, my compiler is mine. (Score:3)
Open source software tends to stagnate without commercial backing though. If we reached a point where open source had so much liability that you simply can't risk using it in commercial settings, then it could eventually turn into a shadow of its former self.
The alternative is that basically every open source project requires some kind of contract with the developer that they have to meet an SLO. That could mean that corporate entities start being bigger sponsors of open source code, or it could also mean t
Re: No, my compiler is mine. (Score:5, Insightful)
Open source software tends to stagnate without commercial backing though.
First, this isn't true by any stretch of the imagination. Commercial backing wasn't a thing until Free Software was well along its way. Yes, now most of the software is commercially backed, but it's by no means a necessity.
Free Software is about "scratch an itch", so the software stops being developed once there's no icht anymore. It may go into a very long "slow burn / maintenance mode", for example like fetchmail or mutt, this becoming the new "itch". But please don't confuse this with " stagnation", it's not. Just as much as changing everything every 2 years just because one "has to" in order to justify new money for new licenses isn't progressing, either.
And now we're full circle to the commercial backing: that's an itch being scratched by commercial actors, namely that of seeing a particular feature implemented rapidly, or of leveraging political influence over a product by participanting (significantly, in part) to its development. Yes, that's cool. Win-win. The way things are, for now. But don't for one second make the mistake to believe that Free Software would come to a grinding halt (or even a significant slowdown) once that stops. Itches will be there, and knowledgeable people will be there to scratch their own, in the process producing software for everyone else.
Re:No, my compiler is mine. (Score:5)
Warranty and liability would be something you'd negotiate in the software license. Not something to apply to the industry as a whole.
Re: (Score:3)
The thing is, a lot of people from particular countries don't see that as an issue - indeed, they see it as a right to mess with that stuff themselves. I will let you figure out which country in particular Im talking about, but below is my experience from New Zealand...
I was looking into disconnecting my old gas stove last year, and discovered that in my current jurisdiction that, if the outlet was of a particular type, I could disconnect it myself without issue.
I come from the UK where there is very much
Re:No, my compiler is mine. (Score:5, Insightful)
I suspect some of that has to do with both population density and bureaucratic age.
When people live piled on top of each other as they have for centuries in so many UK cities, so that a botched install can take out several neighboring houses, then whether you get the job done properly is very much your neighbor's business.
Similarly, the British empire was still ascendant when both gas and electricity were in their infancy, with the result that you'd get old gas installs with hand-made pipes in the same house as high-tech new uninsulated electrical wiring, to occasionally devastating effect. I suspect a whole lot of the cultural attitude towards (and bureaucracy around) both gas and electricity stem from the fact that both were widely distributed among the upper classes long before anything remotely resembling common modern safety practices were in place. Electricity in particular changed things, as routine sparking could violently expose gas plumbing problems.
Over time, fear (and the accompanying regulation) settled into the culture to an extent not seen in cultures that didn't really embrace the technologies until they were more mature, and much more difficult to screw up an install.
I suspect we're approaching a similar state with computers now - we've had decades of lackadaisical software security that wasn't really a serious problem - and then someone though up the idea of hooking all these computers to the internet, so that any of them can be easily targeted by any troublemaker anywhere in the world. And that that situation stewing long enough for exploits to become big business in the criminal world, while the legal businesses keep plowing ahead mostly ignoring the problem, hoping it doesn't happen to them.
Re:No, my compiler is mine. (Score:5, Insightful)
Now if the managers could go fuck right off with their unrealistic timelines, and companies actually pay QA a decent wage, and people would actually learn to code properly, and and and.
Yeah. Liability is fine, but the problem is rarely just the programmer.
Re: (Score:2)
Now if the managers could go fuck right off with their unrealistic timelines, and companies actually pay QA a decent wage, and people would actually learn to code properly, and and and.
Yeah. Liability is fine, but the problem is rarely just the programmer.
All you have to do is point out and know all the unforseen problems! 8^p
Re:No, my compiler is mine. (Score:5, Insightful)
The problem is almost never the programmer:
1. The employers choose to hire inexperienced greenies right out of college, instead of seasoned veterans who know how to write secure software, to lower costs. These entry-level engineers simply don't know any better, since they haven't put in the time working under someone who does!
2. The employers pick the unrealistic timelines you mentioned, thus forcing the IT Pros to do things they know will produce bad software despite their protests.
3. The employers change the requirements every day, multiple times a day, without moving the deadlines, thus forcing the code to be brimming with technical debt due to all the re-writing, scrambling, and confusion over what it should even do.
4. The employers choose not to hire a sufficient QA team, again to save costs, thus ensuring there will be plenty of bugs (including security bugs).
5. The customers buy this garbage because the price is significantly lower than the price charged by any competitor who has much higher costs of production due to taking proper care in making sure the software is secure and reliable.
The programmer may be the sword, but the employer is the hand that wields it. And ultimately they bend to the customer's demand for low-cost-quick-to-market crap, because if they don't, the customer just buys from someone who will. The programmer is just the tip of the iceberg of blame.
Re:No, my compiler is mine. (Score:4)
1. The employers choose to hire inexperienced greenies right out of college, instead of seasoned veterans who know how to write secure software, to lower costs. These entry-level engineers simply don't know any better, since they haven't put in the time working under someone who does!
But they are cheaper!
2. The employers pick the unrealistic timelines you mentioned, thus forcing the IT Pros to do things they know will produce bad software despite their protests.
But we need to ship it to make sales!
3. The employers change the requirements every day, multiple times a day, without moving the deadlines, thus forcing the code to be brimming with technical debt due to all the re-writing, scrambling, and confusion over what it should even do.
Planning it out properly from the start is too expensive! Also, didn't you guys invent this Egale or Agile or Agely or whatever it's called so that we don't need to think about what we actually want until you've started writing it?
4. The employers choose not to hire a sufficient QA team, again to save costs, thus ensuring there will be plenty of bugs (including security bugs).
I see you're starting to get it. Yes, only saved costs are good costs!
5. The customers buy this garbage because the price is significantly lower than the price charged by any competitor who has much higher costs of production due to taking proper care in making sure the software is secure and reliable.
You see, NOW you get it. Nobody actually understands any of the magic you do, but people understand $$$ and our sales team hypes up our crap the same as the competition hypes up their crap, so the only thing that people have to decide on what to buy is price.
"reliable". Pfft. By the time the whole shit comes crashing down, the person who bought it has done their two quarters, taken their golden handshake and moved on to the next company. What do they care?
Re: (Score:3)
I'm pretty skeptical that licensing for software professionals can work.
However: Your argument about bad, overweening managers is actually an argument _in favor_ of doing so. More heavily licensed engineering fields do in fact invest the engineer with both responsibility and powers that cannot be short-circuited by domineering managers, with force of law. And also they're much higher paid to take on this responsibility.
For example, here's an interesting case from Stack Exchange: Workplace a few years ago in
Re: (Score:3)
Yeah, I think liability needs to start with the managers. Or better yet with with the shareholders ultimately calling the shots, but one of the few things pretty much every nation on Earth agrees on is that the 1% must be protected from liability for their actions. (I think we can all agree that the 1% of stock owned by the rest of the population combined wields no meaningful power)
I think there's merit in considering an IT situation similar to engineers or doctors - generally speaking it's their employer
Re: (Score:2)
It would be a pretty perverse outcome if the employing companies were able to disclaim liability (Read the EULA!) but the employees were held accountable. Maybe start with making software companies liable first?
Re: No, my compiler is mine. (Score:3)
Re:No, my compiler is mine. (Score:5, Insightful)
Re:No, my compiler is mine. (Score:4)
Let's see:
* Banks
* Pharmaceutical corporations
* Politicians
* Social media
* News "Entertainment"
The difference is, those are largely motivated by greed, where as poor software is usually the result of incompetence. Or outsourced programming-- the intersection of "greed" and "incompetence".
Re: No, my compiler is mine. (Score:4, Insightful)
Re: (Score:2)
That and anyone who connects critical infrastructure to the Internet in the first place is a fucking moron.
One thing I particularly appreciated about the remake of Battlestar Galactica was Admiral Adama's steadfast insistence that the computers on the Galactica would never be networked together.
Some of that caution would serve us well today. Everything does not have to be reachable over the Internet. Really - it doesn't!
Re:No, my compiler is mine. (Score:4)
I don't think anyone is preventing you from writing code. What the idea is that you be -responsible- if your code is broken.
What other industry can people fuck up as badly as software, with no consequences?
So why would I write anything if I were to be held criminally liable for anything that ever happens to that code?
And tell me - do you have examples of perfect always secure code that will protect their writers in perpetuity from any and all liability?
The idea that a company that will force their IT department into a cost center, then hold their cost center employees criminally liable for their products is making criminals out of the wrong people.
Hobow the suits who demand to use "Password1", and want all the inconveniences of security bypassed? The breaches have tended to be really low hanging fruit that is obvious. Not incompetence, but often intentional breaches made for a select group's convenience.
You might as well fire the custodians - it will have just as effective a result.
Re: No, my compiler is mine. (Score:3)
Re: (Score:2)
What other industry can people fuck up as badly as software, with no consequences?
Banking.
Re: (Score:3)
What other industry can people fuck up as badly as software, with no consequences?
Literally every single one which requires workers who are smarter than politicians and other would-be-regulators. The fastest way to yield a labor shortage in an industry a slim minority of the population is even capable of working in productively would be to add extreme liability risks. Risk is taken on by the corps selling code already, and yes, they SHOULD BE reviewing every line of every external library/dependency they include instead of adopted the "it's industry standard, everyone uses ___, there's
Re: (Score:2)
Nope! It's written strictly in the EULA you must agree to buy my software that you agree to be 100% liable for any condition arising from your use of the software if it doesn't do what we hoped it would do
No promises, and No warranties..
Don't like it, then go hire someone else's. Oh wait.. My software is not a Commodity like Plumbing or Electrical, therefore I make the only one, and it's even Patented with proprietary encrrypted file formats, so Nobody else can write this, even if they wanted. Gues
Re: (Score:2)
Politicians ...
Bankers
Management
Re: (Score:3)
Ok but first we will ask you to:
Re: (Score:2)
are we gonna see CEO jailed? (Score:2, Insightful)
No. Dimwitt deciders however should be. Double. (Score:3, Insightful)
As long as some IT decider can't tell the difference from a client or a server, or Git upstream from a working copy, we are living - IT wise - living in a society that has no culture. Sort of like the Arabs in that old movie "Laurence of Arabia" that come to town and leave it 2 days later, in a state of dismay and chaos, because they have no effing clue how such a thing as a "town" or "city" actually works. Looking at Dubai today one could say they perhaps still haven't learned. Anyway, I digress.
IT wise, too many cultureless dimwitts are still calling the shots and generally are utterly incapable of building an IT culture and an IT security culture around that or making decisions that would facilitate such a development.
Until that happens, no amount of liability will fix anything. That would be like blaming the spreading of germs on the only guy that uses soap. The suggestion however, pretty much fits (and illustrates) the dire state of culture, when it comes to IT.
No, obviously not. (Score:3, Insightful)
It's a very dynamic area and even major corporations haven't figured out a reliable way to stop it yet. New exploits are discovered *every* day.
I would *never* have never worked in a field like that for any amount of money if I was constantly risking financial ruin.
It would be like holding doctors financially accountable for deaths to new or rare diseases while also saying malpractice insurance couldn't be used to protect them in those cases.
No, because IT isn't always the decider (Score:5, Insightful)
On more than one occasion I have been overridden by non-IT higher-ups regarding security policies I've wanted to put in place.
It's not a regular occurrence, but there have been a few times when some faculty research group's convenience (I work at a university) forced me or one of my coworkers to implement changes (or prevent us from making new changes). And by "forced" I mean the Chair said "quit arguing and just do what they want".
Re: (Score:2)
The point is to make IT the decider. When doing the wrong thing risks a higher insurance premium, or losing your license for professional misconduct, or a lawsuit against you personally, it gives you more power to say no.
Do you want this power or not?
Re: (Score:3)
Do you want this power or not?
Based on my personal experience, I don't believe what you describe is what would actually happen. The blame might get shifted to IT even more than it already is; but the power to actually make final decisions on implementation most probably would still be out of our hands.
Re: (Score:3)
If IT was the decider and also liable for any security breaches, then the systems being administered would become essentially unusable. Unreasonable security precautions would make it so difficult to use the systems that hardly anyone would actually be able to get anything done. This isn't because IT people are evil or lazy, but simply because the system of rewards and punishments is shifted so that CYA would become most important.
So, yeah, that's not really a world I want to live in.
Re: (Score:2)
It's not a regular occurrence
You lucky bastard. I've seen people forsake basic security requirements in IT to the point of forcing the IT guys to adopt less secure policies in everything from healthcare to finance to government to defense to manufacturing.
Re: (Score:2)
On more than one occasion I have been overridden by non-IT higher-ups regarding security policies I've wanted to put in place.
And you should be, because security is not the only thing that matters. But there should also be a process where the person who overrides you accepts the risk. That's why having an ISMS is a good idea - it ropes in the managers and documents their decisions. It's actually the primary reason why I think having an ISMS is a good thing - making management accountable.
Re: (Score:2)
And you should be, because security is not the only thing that matters.
I actually agree with you - but then, when you can get security with very little inconvenience I think security should win. Such as when I've been told "open this research computer's ports to the world because we don't want to have to remember to use the university's VPN".
Re: (Score:2)
If you make up the policies, do you also do the risk assessment for them?
Just remember to advise them where appropriate, please ask a written confirmation from anyone requiring a deviation from policy, so you can mention it to the auditors.
It's not just IT staff (Score:5, Insightful)
When you tell management that you need to implement changes for security purposes, and the response is "I'm the *beep* director of this *beep* organization, and you'll *beep* run things the *beep* way I tell you to", I don't want to be held responsible for a breach when a two-bit middle management jackass decides that they're smarter than their IT department because "hell, my son can install Linux!!".
And sadly, none of that was made up-- Was a real conversation, that happened less than a year after a wave of desktops were compromised by an outfit out of eastern Europe.
There is an existing culture within most businesses, hospitals, universities, etc., that says "what I have to do is more important than security", right up until a major breach happens, and then it's all about "we need to be more secure"-- and the manager who gave the order that resulted in the breach, is never held accountable.
PS: Slashdot- Your ASCII art "filter" is still a crock of unfiltered trash. Three repeating vowels in one word is not a 50 line swastika.
Re: (Score:2)
Say goodbye to open source software if this happens though. Since all software would have to be certified to meet various standards (just like pipes, wires and circuit breakers etc are certified), nobody is going to write software for free if this makes them liable for any bugs. At the same time nobody is going to use uncertified software.
Who's going to pay for the certification of the Linux kernel or, say, Debian?
You think ... (Score:2)
You think software development is expensive now ? Wait to see how expensive it will be if this comes true. Also, what about Free Software ? This will probably kill it.
Wonder why US medical care is expensive, look at the insurance companies and all the bureaucracy surrounding the medical field. My primary care physician needs to employ 4 to 5 people to deal with the paper work. When I was a child, it was usually 1 Doctor plus 1 nurse/admin. Plus the Dr made house calls.
How about management first? (Score:3)
In many places, management will even say, "security has no ROI", and at best give lip service to security. All laws making the IT grunts take the fall for ransomware will not get the budgets needed for actual security, or management to allow processes/policies to be changed. It just means that when ransomware happens, some IT people get fined or go to jail, some lip service happens, and nothing is done.
I'm sure companies will love this, if it is passed. Just means IT is even more squeezed. Especially in companies where the C-levels want a security breach to happen so they can short their stock before announcing it.
Insurance (Score:2)
Re: (Score:2)
Software would have to be certified, the same way stuff like circuit breakers are certified to meet some standards. Nobody would pay for the certification of open source software or if one version got certified, that version would be used for decades.
The same reason that some airplanes use floppy disks - certification costs so much, it's cheaper to just use old hardware and software.
IT covers what exactly? (Score:2)
Internet connected/connectable network administration and associated hardware? Sure, I'd agree that probably does need some enforced rules. Beyond that, probably best not.
Hell no (Score:3)
Re: (Score:2)
Re: (Score:2)
If it is because the mechanic fucked up the brakes, then very much yes.
With IT the people deciding what happened and who to blame come from two categories:
This is the dumbest idea since the government tried to auction off the GPS spectrum to a satellite phone provider.
THIS is why SaaS and Cloud are a thing (Score:3)
For so many businesses, IT is a utility and not a business that they want to dabble in. We're seeing the the beginning of the end of the roll-your-own IT architecture as a desirable state for places where IT does not drive their core money-making activities. A lot of these people have gotten bitten by bad software, bad IT and bad end-user activity and are learning that going to places like GSuite, O365, SAP, etc. etc. reduces their risks of IT-related loss. Yes, these kinds of businesses are IT lightweights but many, many places are like this. Just look at the numbers of subscribers that MS and Alphabet tout.
For those places where IT is integral to production I think we're getting close to the point of licensing and/or guild-style demonstrations of aptitude. IT folks who do process control, factory-floor automation and other physical-systems control (i.e. utilities) tend to work at the direction of a "real" engineer and maybe even one who holds a license. In other places, like where the IT part is just programming for a product, the company holds the product performance liability and they are usually diligent about functionality. These are more likely to have an internal "guild system" where mastery of the craft is built and demonstrated over time. You don't just hand the job of writing embedded code for a front-loading washing machine over to some freshly-minted EE or CS kid, for example.
Before we get to licensing though, we need to really wake up folks in the C-suites about what's going on. The Colonial incident was not a failure of the pipeline control system, but a failure of security scoping by the operators. They forgot that until that gallon of fuel is delivered into the customer's hands AND IS ACCOUNTED FOR, it is under control of the pipeline. Since they didn't keep the accounting system for fuel delivery in the same scope as their core pipeline operation they fumbled the security football.
Alternative idea.... (Score:4, Insightful)
Label ransomware attacks as "terrorism", and devote half the effort spent on tracking down terrorists to tracking down ransomware gangs. Treat them, and the scam call centers in India (and other countries) as serious criminals, and make their lives a living hell.
After the first few doors are kicked in by heavily armed law enforcement officers, the frequency and severity of both plagues will dry up.
The physical infrastructure of most countries isn't terribly secure-- but attacks against communication, utilities and other infrastructure is considered "terrorism" or "threat to national security", and dealt with appropriately. There's very little threat to these gangs, especially when many of the ransomware operations appear to be at least partly state-funded.
Re: (Score:2)
No need, just ban "anonymous" currencies. Ransomware wasn't a problem until recently, guess what is facilitating it.
Re: (Score:2)
Management will fight tooth and nail (Score:2)
With the ultimate responsibility comes the ultimate power to refuse sign-off until all outstanding issues are addressed, even if it does make the release late. No more ship now, fix later.
Also, software engineers who are bonded and able to sign off will be a LOT more expensive.
Re: (Score:2)
Re: (Score:3)
bad bosses and timelines (Score:3)
why would you hold the it professionals liable when the ones who caused the issues are almost always upper management? you can blame the dev for a bug... but chances are that bug are in there due to stressful environment, lack of testing because the company thinks testing is a waste of money, or ridiculously short time lines for products.
If they want liability coverage, (Score:2)
Let's say a good example might be the idea that Mister C. E. O. and his Severance are because he puts his head out to roll, so let's adjust the engineer pay to match that.
What's that? They don't want to pay someone to hold that kind of liability?
Why would they go so far as to expect it? Don't give them ideas, software engineer.
There is a reason that literally every piece of code you download has that disclaimer right on it.
This (free to
Need an UNION to stand up to the PHB (Score:2)
Need an UNION to stand up to the PHB who cut's costs costs, QA, dead lines, etc.
Wrong problem, apples and oranges (Score:2)
Short answer no. No engineer is responsible for that sort of thing. Building engineers aren't held responsible if (for example) someone sets off a van load of ANFO in the basement parking level. Bank vaults may be warranted for a length of time that they will resist various reasonably anticipated attempts to crack them (if installed according to specifications and maintained properly by the owner), but they are not sold as impossible to crack (at least not in the fine print). If they do get cracked, the eng
This comparison seems to be missing something... (Score:2)
Re: (Score:2)
Well, yes and no. The standard here is "negligence". Of course, if the IT person followed the state-of-the art then they do not become liable for the break-in. That already follows from fundamental legal principles. But if they messed up or did significantly substandard work, things look quite a bit different. Also, businesses that hire unqualified people would become liable for the work those people did. Sure, accidents and mistakes still happen. That is normal. But somebody doing shoddy work that does not
Re: (Score:2)
Of course, if the IT person followed the state-of-the art then they do not become liable for the break-in
This is normally done with certification. You use certified pipes, circuit breakers and you use certified software in airplanes.
Of course this would mean that any updates have to be certified as well. So, it will be like with airplanes - one very expensive version that works, no updates for years. No FOSS, since certifying it would be much more expensive than just using closed source software that is certified.
Comment removed (Score:3)
Most IT engineers don't hold engineering quals (Score:2)
I'd say the bigger problem is with representation in the industry. If the majority of engineers are misrepresenting their qualifications, you are going to get incredibly varied outcomes. And that should make sense, as you wouldn't ask a person off the street who has only ever casually watched some civi
Re: (Score:2)
I don't understand why IT businesses and individuals are allowed to misrepresent engineer qualifications in the first place.
I think at this time it is "managers" too stupid to understand that hiring unqualified people is exceptionally expensive in the longer run. Hence they try to keep the hiring "cheap" by hiring at the lower end. But I think that time is slowly coming to an end.
How can you ask the IT personel (Score:2)
to give you a better guarantee than the corporations that sell you the software. There is not one software on the market today that assumes any liability. Microsoft would be out of business and nobody would be able to afford a desktop licence.
In order for me to offer such a guarantee the only OS that I would recommend is OpenBSD with no GUI and no third party apps.
What does a certified plumber even offer? In most jurisdictions certification is a rubber stamp that you have a general understanding. Then years
If so, the cost of your cable bill will rise... (Score:2)
through the roof.
Indeed all goods bought and sold via IT will be very expensive as everyone seeks to insure themselves. IE. The cost to the economy might be catastrophic.
Should IT Professionals Be Liable for Ransomware (Score:2)
Should IT Professionals Be Liable for Ransomware Attacks? No, not any sooner than Stupid People are held liable for clicking on phishing links in their email. All the IT credentials, degrees, and training that IT professionals get in order to be "professionals" doesn't do anything for the weakest link in the chain. The user who clicks on that malware link. The problem then is coming up with a legal definition for that user that does not get you fired or sued for slander. People do stupid things and no amou
They should not (Score:3)
Re: They should not (Score:3)
Good MBAs teach you about a lot more than blaance sheets, just as good IT degrees tech you a lot more than installing Windows. But you can find plenty of idiots in both professions. Maybe look for a better class of person to work with?
Easy solutions to hard problems (Score:2)
The best way to handle ransomware is to make paying ransoms a federal crime punishable by a minimum 20 years hard labor.
As TFA points out critical infrastructure / safety critical domains already have process requirements in place. There are numerous qualifications and certifications personally and organizationally available for the purpose of summary judgment of prospective employees and vendors if that's what you want or need. Sucking at HR is your problem nobody else's.
Personally I think society has al
Insurance (Score:2)
OK, sure, insure the company against attack, insure the provider against E&O.
Pay what both want to charge.
The insurance company will say that your infrastructure is shit and that you need to pay 10x to be insurable. The provider will agree. You will go with somebody cheaper because you don't want security, you just want somebody to blame.
I bet both of your hair points are roasting right about now (not many people on this site, tho). This was supposed to be easy and you were looking for an underling
Those other industries didn't, and still don't (Score:5, Insightful)
First, we don't hold plumbers liable when winter cracks a pipe. We expect the [homeowner] to follow certain practices, and we expect shit to happen anyway. So the plumber isn't liable for the pipe breaking -- the plumber is only liable for not installing it correctly, given what it was and where it was at the time of installation.
Second, we don't hold the roofer liable when birds eat through it, or when wind tears it apart. We call that "wear-and-tear".
Third, we don't hold the locksmith liable when a criminal picks the lock, nor the window installer/manufacturer when a criminal smashes the glass. We generally never hold anyone liable when a criminal actively breaks anything.
Fourth, all of those industries are (currently) stable. Sure, they all change from decade to decade, and the code changes too, but very very slowly. If you were to have a building-code style code for IT solutions, it would be the same age as every other code -- enacted 3 years ago with then-3-year-old information. So today's IT code would be 6 years old. IT is [currently] evolving way too fast for any regulation to keep up. 6-year old regulation would be utterly meaningless today.
Fifth, if you put a lawn chair at the end of your driveway, we're not surprised when someone steals it -- because you put it out in the open.
So, let's review:
First: homeowner-maintenance expected translates into compatibility with other software/OS/equipment.
Second: wear-and-tear translates into patches, updates, and memory/storage cleanup/monitoring.
Third: crime isn't on anyone. that translates into all hacking.
Fourth: 6-year old regulations translate into 2015-era technology. does 2015's encryption even count as encryption these days?
Fifth: left out in the open translates into, well, absolutely any internet-connected anything. It's all exposed to the entire world.
I'll say again what I've said for decades. The FBI ended the wild wild west because it didn't matter how big the train robbery was, if you couldn't ever spend the gold, and you had to live in the woods, there was no point in being an outlaw. IT needs law enforcement for every criminal hack, breach, et cetera. Until there's law enforcement, you can't ever have security (especially documented security) by day-job workers that will ever repel the undocumented creativity of the infinite criminals.
And we have oh-so-many parts of IT that really could be locked down at a federal level. Explain to me why packets originating from out-of-country aren't instantly flagged with their origin, so I can at least say that root-access to the server can't be accessed from outer mongolia? Can my country not flag the packet that they received from across the atlantic?
That is a lucid, intelligent... (Score:2)
...well thought-out objection. Overruled!
Seriously though, good points. Frankly, they would need the equivalent of "building codes" anyway, if they intend to wrap it in legal consequences. And that is simply a non-starter. No such codified set of standards could possibly be maintained or absorbed quickly enough to be followed at all before it changed.
Re: (Score:2)
Sorry to restate your own point (regarding building codes). I added nothing of value and would like a "retract" button available to me for 60 seconds after posting...
Sadly... YES! (Score:2)
Today it is a unrealistic for an IT company to provide that level of assurance, but you cannot be a professional without assuming liability for your actions. Hopefully that will create enough pressure on upstream vendors to create a proper chain of responsibility where the market for cybercrime is eliminated (rather than insured as today).
Absolutely! (Score:2)
Absolutely, as long as IT has 100% control of the budget, policy, procedure, and implementation. Elsewise, not as long as they've followed policy and procedure. Responsibility with no authority is immoral.
Set better expectations, maybe? (Score:2)
Look ... we had bugs in things as simple as early 1980's coin-op arcade games. Centipede had a bug that crashed the score counter if you got over a certain score. Modern software is massively larger. (A modern game title for Windows typically has 1.5 to 5 million lines of source code!)
But we're talking about business-critical applications here ... not just games for entertainment. And not only are we worried about bugs in the software itself that prevents it from working as intended, but ALSO demanding all
Ok, but at what level? (Score:2)
If I'm an IT professional for a company and I install Windows Server, apply all the patches and this is the box holding all the corporate data including customer information and it gets compromised which IT professional is being held responsible?
Me? Because I installed and maintained the system? Even though I have applied every patch and update Microsoft has provided?
Someone at Microsoft that programmed the particular piece of the OS that was exploited?
The person that programmed the library that the prog
Completely unrealistic... (Score:2)
Code is not a physical construct that obeys physical laws. You can't develop things like building codes and standards. If you review a design of a bridge, review the actual building of it and test it, you can get a reasonable idea of how it can perform. And even then, things can go wrong.
Software is a bridge that if a green car with three people used the middle lane for 32 seconds at 2:23PM then switched to the right lane for at least 56 seconds while going 3 to 5 miles an hour less than they were going a m
Painful transition (Score:2)
IT isn't stable (Score:2)
One of the reasons licensing for a lot of professions work is that the rules are stable. In construction and civil engineering, the laws of physics don't get completely rewritten overnight. New materials and techniques aren't introduced every month. You can write up rules for determining whether something will be safe and they won't become invalid next week. That allows professions to create standards for correctness and safety that professionals can count on to work and keep working over time. They have to
This is too socialist even for Denmark (Score:2)
No (Score:2)
If you want to fix the problems of ransomware then make the businesses liable for not having backups or proper security processes. Thoses are systemic and can be dealt with as business processes.
Hell no. (Score:3)
The problem is, if this is ever implemented, that won't be the way it's implemented. It'll just be a way for liability to be forced further down the chain so that nobody "important" can be charged. Management had unrealistic deadlines, no QA/auditing, and verbally directed you to do things to undermine the security of your product or service? Doesn't matter; you did it, so you're at fault. That's how it'll be done, and I think anyone with a lick of sense should say "hell no" to this nonsense.
Re: (Score:3)
Many engineers aren't PEs. Some things don't require a PE sign-off at all. In others, only the lead engineer is a PE.
Re:Engineers? (Score:5, Interesting)
There is no PE equivalent for anything that falls under IT. Mostly a PE is useless for IT work (not entirely). And if there was a lot of folks with 'no formal education' could pass it.
If you want me to get a certification, fine, my rate will go up too. If you are going to push for a certification then it better be a good one - there are tons of certifications for different IT things already and they are mostly worthless garbage. I'll take someone with direct experience over someone with only a certification any day.
What you really want is a different and more provable way to build software. The aim should be to improve the development process in a way where security is baked in, rather than require anyone that touches it to be a well rounded expert with a big insurance policy. Legal requirements won't make me do my job better they'll make me more expensive and make the insurance industry more money - I'll have a shiny plaque and bug insurance policy and everything else will be the same.
Re: (Score:2)
there are tons of certifications for different IT things already and they are mostly worthless garbage.
Every organization has different systems, so the "Certificate" would need to be regarding different systems and software to make any sense.
Furthermore... Ransomware is not caused by incompetent IT or shoddy work by IT. Ransomware is caused by criminal acts and software bugs mainly allowing exploitation of systems and insufficient
Management and Mainteinance of systems and Network managemen
Re: (Score:2)
If we require IT pros to have licenses, there will be fewer of them in the market. The industry is not ready to abide that. The employers of the IT world already feel like supply is far too low and prices are far too high, and their ability to abuse and overwork IT pros far too limited. Requiring licensing will make every single one of those problems significantly worse, and the people most impacted are the richest people in the world.
So, I don't see that changing. Not, at least, until the steady stream
Re: (Score:2)
If we require IT pros to have licenses, there will be fewer of them in the market.
Doesn't seem to affect the number of lawyers out there.
The employers of the IT world already feel like supply is far too low
Employers whined they couldn't find enough people during the Bush recession (both of them). This is standard fare.
and prices are far too high
Then perhaps salary should be based on quality of work. Considering the shit code we have to deal with every day, the industry is clearly not getting its money's
Re: (Score:2)
Doesn't seem to affect the number of lawyers out there.
How do you know this? What is your basis of comparison? If we removed the requirement for a license, do you think the number of lawyers would not go up? Why wouldn't it go up?
Then perhaps salary should be based on quality of work.
They can't. They must pay what it costs to convince people to do the work. If they pay less, they get no IT pros working for them.
Huh, imagine that. We're supposed to care about the 1%.
How could you possibly have come away
Re: (Score:3)
In Canada, a Software Engineer is a restricted profession.
You cannot work as a Software Engineer without being licensed by the province as a P.Eng.
One also needs a formal Software Engineer Undergrad Degree -- whose content is regulated. And whose programmes are subject to accreditation. Content wise: a Engineering Bachelors is (40 req'd classes + 4 options) compared to a normal 4 year bachelors which is 20 req'd courses 20 options.
Working as a Software Engineer, does impart liability for your code, and t
Re: (Score:3, Funny)
The problem is many IT folks call themselves engineers but arenâ(TM)t engineers. They have no formal education nor PE certification. They like the title but so not want the legal requirements that accompany the title.
Not once in my career have I met a CS grad who could output even a tenth of the work of a self-educated individual. Similarly, not once have a met a person with experience who had certs that were more than gimmes their prior employers asked them to get and paid for while they did it on the company time.
All that shit is a scam: certifications, degrees, and other papers exist because rich people don't want to have to get to know you before hiring you, you filthy peasant.
Funny thing is: when you get to the bo
Re:Engineers? (Score:4, Interesting)
Interesting, because I have found the complete opposite. I tend to find that those that are self taught have no capability to switch away from the language they taught themselves to something else.
"You program in PHP? Ok, but we need you to do this in C++". *Blank stare*
I find CS graduates are more language agnostic than those that taught themselves how to program because a really good CS program of study isn't just about learning a language. It's about learning how everything works behind the language.
Re: (Score:2)
If you asked me to write a web page in C++ I'd give you a blank stare too, wondering what you had been smoking that morning.
If you hired a PHP programmer to write code for your performance critical process and then expected him to switch to C++ i'd be giving the hiring manager a blank stare.
I can program in both these and a dozen other languages, and it only takes me a few minutes or hours to learn the syntax and tool pipeline of a new language to write hello world, but what takes months and years of exper
Re: (Score:2)
Re: (Score:2)
The reality - like it or not - is that software will never be secure unless there is very substantial liability for vulnerabilities.
The last I checked well north of 90% of successful attacks exploit people not systems. What do you think is a fair price for 10% better security?
Re: (Score:2)
Much of the problem is as you state, but there is also the complication of protecting against chained attacks; is the backup independent in every way practical of the primary, and if not, how is the tertiary backup performed? Right now, a MSP can just chain a bunch of crap together and not really focus on a security strategy and the client has no way to validate it. Hopefully, this would create a re-insurance type of arrangement between MSP, software vendors, and the end user that restores functionality to
Re: (Score:2)
This is the first comment actually worth replying to.
And the real question should center about this question:
Are IT professionals, professionals?
Do we have professional standards? Do we have professional ethics? Do we have professional licensing?
What good is liability if there are no standards to adhere to? What good is saying yes or no if there are no ethics that are to be upheld? What can be done to stop me from continuing to practice?
If there are minimum standards that should be in place (no naked RDP ho