Hacker News Reader

Comment by lenerdenator | Hacker News Reader

That someone can be brought into an office and shown a small diagram of the approved network topology. Then they can be shown a small diagram of the current network topology. Next, they can be asked if they're the same. If they're not, they can finally be asked if they're aware that deviating from the approved network topology without consulting infosec is grounds for termination of their employment.

View on HN

Bunch of assumptions about operational excellence in there. Doesn't match my experience but, it does match my desire.

You have to be the change you want to see in the world.

We often forget this, but computer software and hardware are engineering disciplines. Part of engineering is knowing when something's bad and telling the person who asked you to do that something that you won't do it. In the civil engineering world, this means you might have to just walk away from the project and blow a whistle before people get hurt or killed. It's time to normalize that in IT.

Great advice for a much younger person.

Or anyone.

It doesn't have to wait 20 years for someone to come through engineering school to happen.

We're talking about the military. Many years ago I heard a presentation by an IT guy in the marines. He stated that senior officers would regularly give him instructions that would violate some policy or other - such as giving their secure laptop direct access to the internet so they could check their personal email - as an order. That is, they could not refuse. I hope things have changed, but this fellow was dead serious at the time.

Report that shit to your security officer

You're assuming that it'll be noticed at all, and that the person noticing cares enough about it to make a big deal out of it - likely involving several layers of management.

In reality it'll likely first be noticed ten years down the line, by someone who lets out a big sigh, mutters something about "incompetent dipshits not updating documentation", and moves on with their day.

I'm not assuming anything.

I'm saying that's what you do in order to solve the issue. You have to actually try, and you have to do actual engineering.

If the local planning commission submits a call for proposals for a bridge to cross a 400 foot chasm over sharp rocks, and they insist that it absolutely, positively must be made out of popsicle sticks, local civil engineering firms aren't going to take up the project, because that's insane.

Why do we give the management of these places a pass for PLC and SCADA systems that could give massive problems - up to and including the loss of human life - if they're hacked?

Reply on news.ycombinator.com