> While the most obvious security failures could be patched, it’s near impossible to guarantee perfect security for most reasonably sized companies. And for most non-tech or smaller businesses, it’s prohibitively expensive.
Would you rather theft insurance also be outlawed, since the fault is on the home owner who failed to secure their home well enough?
I deal with ransomware a lot with clients, and while I absolutely sympathize with persons who are hit by an attack, I feel there are many different aspects to this where applying existing law/comparisons is more derailing than helpful.
1. Perfect is the enemy of good
I see far too many people who get so hung up on this [0] that they ignore practical and easily fixable problems as a result. Far too many companies get the idea they need to protect from nation-state actors when, as is mostly a given, it's infeasible to do so as any given nation-state is likely going to be able to throw more resources at a problem than a given company. Even North Korea (maybe with help from China) has a fairly successful* cyberwarfare division, and they really did almost get away with a major heist. [1]
2. The conclusion one should draw from the above isn't that it's hopeless and you shouldn't do any protection, but instead, you should scale your protection for the risk you carry. Nation States "likely" aren't interested in Bob and Alice's Autoshop in Shucksville, USA. But ransomware gangs that just scan casually for openings certainly are. The answer here is consider your value practically and check your risk assets; what's exposed online, what ways do outsiders have into your environment?
3. Avoid checklists and passive scanners
Passive scanners are a huge pain in the ass for my company as an MSP as we get clients that end up with a checklist they paid a non-trivial amount of money for and the recommendations would be funny if the payment for the recommendation wasn't so high. Passive scanning applications, even if we assume they have good intentions, have poor implementation and in fact reinforce the core problem; they allow IT administrators to just not think about the situation and instead fall back on the excuse of "I followed the list, there was nothing I could do", even when they had gaping holes in their infrastructure or extremely unsafe security practices.
I could continue on, but I need to address the inevitable comparison to other crimes that produced the term "victim blaming", and while indeed ransomware attacks share some similarities, I'd like to point out where I see some differences.
1. Victims of personal attacks only have the duty to themselves; the implication is that reasonably, a person should be able to exist without another infringing on their freedoms and rights.
2. Victims of ransomware at a business level are responsible for the data of others; even if it's their own company, that's employee data which likely is not theirs, employee money among their resources, and so on. There is an expectation I think here that they're responsible not just for their own security, but have accepted and suggest responsibility for the livelihood of others. That is, I expect that someone who undertakes responsibility for others has a duty to go beyond to protect that which belongs to others. To me, this means when you accept responsibility for someone else's livelihood, you don't have the right to decide to expose their livelihood to potential risk without their consent.
3. An attack is an attack, for sure, and regardless of the situation, the attacker is the one at fault. The issue for me is more about those who choose to put others properties at risk because of decisions the responsible person made, because as above, my expectation is that when it involves someone else, unless they have 100% transparency into decisions I make, I have a duty to make the most responsible decisions for a given situation. If a sysadmin/netadmin implements lazy security because it's convenient for them and gets attacked, yes, I hold the attacker accountable. But I also then hold the admins accountable for not being responsible with my property.
The responsibility for others is where I see that there's a significant difference, as it's no longer about personal liberty and freedom to exist online as much as it is about "did you take the reasonable steps to protect the data you are the protector of?" Me walking down the street, I should have an expectation I shouldn't be attacked, and I should have recourse if I am. If my data is exfiltrated by an attack that someone holding my data was a victim of, I have a right to know if that person was negligent while they were in charge of my data, and if they were found to be committing obvious flaws, despite that they were attacked, I have a right to know this and likely should have some recourse.
[0] - "it’s near impossible to guarantee perfect security"
[1] - https://www.bbc.com/news/stories-57520169