The people who should be held liable never will be. Their money is like an impenetrable shield to any sort of accountability. They'll just scapegoat the guy that warned them about the risk repeatedly for not doing more to prevent it.
replyIt has to start somewhere, even if imperfect.
replyI have been in meetings were the Data Security Officer refused to sign off on specific projects, without having a proper pentesting report in place, for example.
Because legally it would be their responsibility, if something would happen.
I wonder if, following the US army story in August, someone might have bet on a prediction market “Danfoss refrigeration systems will defrost after suffering an already-disclosed vulnerability”.
reply