The EPA should hire pentesters to go through each utility and expose problems with this. Seems like it would do well in exposing the problem
What if there are 100 attacks per year, with a 99% success rate?
I don't get what you are asking.
Any large adversary would compile a huge number of ways to disable infrastructure, then use them all at once, rather than one at a time.
Sure but it might keep out all the people who don't know what they are doing. Like some clueless junky.
Classifying someone as a “junky” adopts a cruel and unrealistic worldview blaming the victim and absolving a number of powerful actors of their role in contributing to addiction on mass scale.
What about those who were recreational drug users that went down a dark and dangerous path? Presumably in this case it's fair to put the blame on them. Yeah, maybe they had issues with their parents and maybe they had some other problems. But nobody put a gun to their head. They made a bad choice and paid the price. That's how life is.
You can't absolve personal responsibility either.
What about the rev users who didn’t go down the dark path?
This precisely is the difference of having genetic predisposition to addiction, trauma etc.
No, it’s not a choice more than obesity / food addiction is.
If you’re interested in expanding your thinking see the work of Gabor Mate.
Maybe. Or maybe just the culmination of a series of bad choices.
> No, it’s not a choice more than obesity / food addiction is.
That's a choice. Nobody is making you buy the potato chips and cheesecake. Nobody is holding you back from the gym. It might annoy a lot of very fat Americans, but you've got effectively the same DNA as everyone else - but they're not as fat. It's a cultural thing and a choice.
Yes I know I'm glossing over some nuance here, but personal responsibility remains. Ignoring that seems like just resigning yourself to be blown wherever the wind takes you.
Take responsibility for your decisions, take a good honest look at where you are, what you don't like about that, make a plan to change that, and then execute it.
I think I'm familiar with the consensus views. What am I saying that you feel is unjustified?
I agree that obesity/food addiction and drug addiction are both on a similar level, but to me they both sound like a choice.
Mostly because if we decide to apply the same standard you use for qualifying whether something is a choice or not, then literally nothing is a choice.
A man who physically abuses his wife and children? Not a choice, he is doing it simply because he had some experiences in his life that made him that way or he is just simply genetically predisposed. Someone cheats on their partner? Not their choice, they were predisposed to do it or their partner was just not making them happy enough. Harvey Weinstein? Not his choice, he was just a victim of his own circumstance who was also genetically predisposed to do what he did.
You get the idea, but I honestly do not believe that most of those things are anything but choices, unless we decide to pretend we believe in predetermination and complete lack of free will. In which case, I would agree with you, those decisions were not choices, because choices don't exist in the context of belief in predetermination.
Mind you, I am not saying there are no circumstances in which those situations would not be a choice. There are indeed some scenarios like that. However, and that's purely subjective based on my personal observations, those scenarios are a minority.
I don't think it is a binary choice vs. not choice. If speaking frankly, I do believe that any of those things discussed feature both a choice component and a predisposition component. The proportion of each of those two components varies heavily based on a person and a situation.
However, even with this in mind, it is difficult to say that the choice component is ever at zero.
We can discuss to which degree humans have a choice in their actions, because it is definitely debatable, since they all agree on the ground truth that there is always some degree of choice. But that discussion cannot coexist with a belief in total predetermination, since that removes any ground truth completely.
Addiction Is a Brain Disease, and It Matters: https://science.sciencemag.org/content/278/5335/45
Maybe the goal isn't to make every single facility 100% secure to all threats, but it's totally defeatist to say that we couldn't somewhat increase the actual security of many systems. VPNs alone would provide a great first line of defense, and even for a government-run utility, the barrier to installation is very low there.
I have a fair level of skepticism around security theatre, too, but I think it's unfairly cynical to suggest that we don't have a goal of making ourselves more secure.
https://en.wikipedia.org/wiki/Kerckhoffs's_principle
In addition to assuming the adversary knows how everything is designed (as opposed to security-by-obscurity) there should also be an assumption that security is obtained through real implementations, not theatre.
What happens when everyone in my street buys the same security system? Seems like we all just spent a lot of money buying something that now offers us no benefit.
Short of purchasing a honeypot property with (seemingly) no security system and going full Home Alone on the inside of it, it seems like you're going to need actual security at some point.
At least for the home example, you're usually better off reducing the factors that would make a break-in happen in the first place rather than trying to win an arms race against a determined attacker; there are high trust societies where people don't bother locking their doors and people don't get burgled. But obviously the threat model is different than a utility.
You mean men with guns stationed 24/7? There is no "actual security" against determined burglars available on the market for regular people. There's delaying action (e.g. laminated glass), noise making and deterrence (cameras). Each can be worked around.
This is also a general point on security: there's no perfect security, there's only adequate security - where "adequate" means it costs the attacker more to breach it than they can expect to profit. From this view, appearance of security is almost as good as actual security measures - you make security look expensive to breach, which achieves the same effect, as long as nobody is willing to call your bluff.