Why are critical systems such as the pipeline or meat supply open to the web, or if they need

[JohnSJ]

webservers, why isn't there adequate protections to prevent access to vulnerable websites, phishing emails with malicious attachments, etc.

Ransomware has been known for sometime. Why does it seem that we are always a day late and a dollar short?

[NightWatcher]

1. They've hit hospitals, traffic controls, and power grids and more. We've been wide open for years

I'm shocked we haven't been shut down actually. They, Russian hackers, could cripple u all at once if they wanted. We'd retaliate as soon as we recovered which might take a while and leave us dark, hungry, and unable to move, eat, pump water, or pump gas

[JohnSJ]

6. Exactly

[Bettie]

10. I think they are probing right now

seeing what they can do. There will be bigger/more damaging attacks.

I'm beginning to understand (if not fully agree with) my DH's point of view. He says these are acts of war and should be treated as such and that it is all coming, ultimately, from Putin.

[bamagal62]

11. I said the same to my DH last night.

[Phoenix61]

2. Because good security costs money and it's

hard to justify the expense to the board. It’s going to be just as hard to justify how they got jacked but some folks just don’t think ahead.

[notinkansas]

7. Yup - penny pinching shortsightedness.

[Amishman]

13. bingo, IT security is expensive in both setup and maintenance

Until recently I was a IT contracting nomad, I've worked for a lot of clients doing rush projects. One of the most common theme is management refusing to spend for IT, especially security and maintenance, until something goes wrong. Damn near every IT department I've ever seen is perpetually understaffed and functioning almost entirely reactively and not proactively.

In other words, their sys admins and net ops people are so busy keeping things running that they have zero time to keep up on emerging vulnerabilities, let alone proactively close them.

[Abnredleg]

3. The pipeline control system wasn't connected

It was the corporate network (ie. email, billing, etc) that was hit.

[Disaffected]

4. The pipeline company claims

it's pipeline control system is/was isolated from the web - it was their billing and payments system that was jacked.

AFAIK it is the same for other infrastructure such as electricity grids and generator stations.

[Brother Buzz]

5. They're not open to the public, but they find an easy peasy socially engineered backdoor

All they have to do is find one lazy person who has access, break their password out in the social media world, then access the system through it's password protected portal because there's a good chance the lazy person uses the same password EVERYWHERE.

[Throck]

8. I'm more concerned about the electric grid.

Pipeline networks are small compared to the nationwide network of electrical infrastructure. The electrical network is currently well aged too.

[JohnSJ]

9. Texas was an example of that

[Hortensis]

12. "We" are private industry in this case. Republicans are strongly opposed

to government requiring expensive security upgrades for free enterprise. So it's left to them... I

If you think meat is bad, take a look at our thousands of independent power companies. Last I read, it sounded like most of their owners were RWers more afraid of, and outraged by, the idea of national security involvement by our government than the now very real possibility of massive death and devastation from going bare. The TX-area outage was nothing, strictly local and temporary.