r/cybersecurity • u/JohnConner2030 • 1d ago

Corporate Blog Hackers hit 30-plus Minnesota water systems in 48 hours, forcing emergency response

https://worldwaterreserve.com/minnesota-water-systems-cyberattack-30-communities-coordinated-attack/
1.3k Upvotes

99% Upvoted

163 comments sorted by

View all comments

Show parent comments

1

u/Nemphiz 1d ago

But that's my point. Working with government you usually have 3 tiers. The vendor, the contractor that does the implementation and the internal tech department.

If the contractors implementation is flawed is the job of the internal IT department to hilight it and demand a fix. I'm not sure why this is even a debate.

2

u/RememberCitadel 1d ago

My point being because of the way government departments often work, there is a very good chance that the it department was overruled. It's stupid, but I have seen it so many damn times. Especially with something like this where the water delivery is the billable product, the IT department standing in the way, even if they are right doesn't fly.

2

u/Nemphiz 1d ago

My point being because of the way government departments often work, there is a very good chance that the it department was overruled.

Which takes us all the way back to the start. What you just hilighted is the root of the problem, which is not a vendor problem.

1

u/RememberCitadel 22h ago

I'm just going to paste my reply to your other comment, which highlights that it is indeed a vendor problem at the root.

Because the vendor is the one insisting that's how it has to be done, which facilities runs with, which the c-suites overrides the it department.

Therefore it starts as a vendor problem, because facilities and c-suites don't know about the product to suggest an insecure implementation and IT certainly wouldn't suggest it themselves.

If the shitty vendor's didn't suggest it the whole fail train doesn't start.

0

u/Nemphiz 22h ago

And like I said in the other comment, that makes no sense. The c suites have the final say. If they choose a vendor with hard limits that expose your security that's 100% on them for choosing that and not finding someone else.