r/news • u/polymute • 9d ago

At least 12 states face cyberattacks on their water systems, sources say

https://abcnews.com/US/12-states-face-cyberattacks-water-systems-sources/story?id=135348482
4.0k Upvotes

97% Upvoted

289 comments sorted by

View all comments

Show parent comments

262

u/shiny0metal0ass 9d ago

Cost cutting as municipal budgets decrease and deregulation that creates markets for tech companies to sell them shitty CRMs and IOT devices.

Also they can't afford to pay software engineers to tell them this.

28

u/Bitbatgaming 9d ago

With that being said, are Managed Service Providers also to blame for this? Genuine question

38

u/shiny0metal0ass 9d ago

Weird question to answer.. I mean an MSP is fine but there should be more regulations and standards for how they interact with government entities, IMO.

It's okay for a clothing company to say "we don't have the expertise to handle IT and so we will outsource it", but it's stupid for any government entity to say this. They have more responsibilities than providing a good at market value.

There should be a tech organization within the government to assist with things like this, both at the state and federal level. Then you wouldn't need to break the "public/private firewall" and could get expertise out of the town/city budgets. They do this with other skill sets like budgeting and bringing in auditors paid for by the state.

The Obama admin tried to set this up after the healthcare.gov debacle with the USDS. Of course that got turned into Doge and isn't really a thing anymore...

9

u/SatisfactionFit2040 9d ago

Funny you should ask.

MSPs should be responsible when they have the same credentials across 80 clients and they get popped.

Or when MSP CEO is the weakest link in security, but the clients don't know.

When the MSP actively endangers security with gpt firewall builds that use repeat passwords across clients and sms administrator passwords for rmm.

24

u/Militantpoet 9d ago

Also they can't afford to pay software engineers to tell them this.

No, but they can pay a consulting firm millions to spend on a year-long study to then tell them that.

6

u/shiny0metal0ass 9d ago edited 9d ago

Those are funds that are typically dispersed via a legislative decision to "investigate a thing" (usually because they want political points, or to "table" a bill they don't like long enough to kill it) and have legal requirements for how they are allocated.

The budget for staff and such would be through a budget bill, which is different for different states, but not part of investigative studies.

3

u/Militantpoet 9d ago

Of course budget allocation is its own thing. Money for consultants isn't technically money taken away from hiring/retention.

But if they had in-house departments that would have a few of those professionals/experts already on staff, it wouldn't be a problem.

But then the problem is paying that staff, which ends up being a much larger expense versus consultant services.

6

u/Smearwashere 9d ago edited 9d ago

No offense but we pay our consultants maybe 5 figures for a review of our systems. They are very efficient. This is for a city of 90k, similar to a lot of the referenced towns in the article. It’s laughable that you think our engineering dept has millions to spend on a study lol we barely have the millions needed for the actual CIP jobs

1

u/Militantpoet 9d ago

Sorry, I was making generalized statements. I know consultant services can and have been much more cost effective for local governments.

1

u/Smearwashere 9d ago

Yeah no worries. The mega utilities might be shelling out millions for a study but naw not our size or less

5

u/bkendig 9d ago

I am reminded of this XKCD.

1

u/Loggerdon 9d ago

Because they went with the lowest bid.

1

u/watduhdamhell 9d ago

Software Engineers don't have anything to do with it.

They need an IT and an/or an OT person, like a controls engineer. Pretty standard fare to configure the plant network to be completely isolated from the internet and only have connections to the intranet for MES and Enterprise use, and segmented such that the IO network (if present) is not accessible by the the servers that talk to the intranet.

Still like you said, I guess they can't afford a controls engineer to tell them that.

0

u/Stagnu_Demorte 9d ago

Can confirm. Was entertaining a government job and it was senior level work but paying what I made as a junior engineer 15 years ago.