This is what you get when there's no checklist enforced. I would like to see all those people pour into the conversation jumping up and down with glee that their plan worked.
I don't think this aligns with the reality of modern IT. Even with high competence and good intentions, it's an organizational problem and mistakes are easy.
We need better checklists, I guess.
But you can, as an organization, choose to follow one and be "Secure by default", with exceptions e.g. "Open a port other than 443 to the Internet" being understood and risk managed.
It will slow down developers, for sure. But everything's a tradeoff.
The problem with that, however, is that vulnerabilites are constantly discovered, and what is safe today is not safe tomorrow. Electrical safety and fire resistance is much more permanent: if it's done right, it's likely to be safe for a long time.
Vendors just find it too difficult to certify against attacks at the “script kiddie” level, so they lobbied the government to lower the standards so even the lowest rated systems, ones not even audited for security, are allowed for general usage in critical systems.
The large commercial vendors, such as Apple, Microsoft, or Amazon, have spent billions of dollars and literal decades trying to improve their security and have uniformly failed to certify that they can deploy any system that can protect against small commercial teams unlike actual high security vendors who can produce systems secure against even state actors.
You can find hundreds of upvotes for checklists. The same sort of institutionally-decreed checklists. For every admin that lets compromised passwords linger there's one that can closes his port and vice-versa.
It's a cultural resentment of being forced to do the simple things. You dont honestly think a doctor needs to be told how to prep for surgery. But the doctor has and follows a checklist. You don't honestly think a pilot needs to be told how to prep for departure, but the pilot follows a checklist
Watching "modern IT" people demand special treatment because "modern IT" is just built different than modern flying or modern surgery is watching the height of arrogance.
Not really. In > 99.99% of software projects, the risk of an error leading to people dying is lower than it is for a surgeon or a air traffic controller.
Additionally, software is an extremely broad tool, like mathematics, that can be applied to nearly any domain. Consequently, slowing down devs via regulation as you suggest will also slow both technological progress and economic growth. In a few circumstances, the risk may be enough to justify that cost, but it there’s high bar to clear.
You really need better defaults (“all ports start closed”) and a culture of strong justification for any changes from the known safe defaults.
This is of course at odds with convenience so it probably won’t happen.