Maersk, Me and NotPetya
Why would any of the proposals provide any meaningful protection against this threat model?<p>Maersk claims NotPetya cost them $250M to $300M [1]. Assuming a criminal organization could demonstrate to Maersk that they could do an attack with similar effects they should be able to extort Maersk for a similar amount of money. If we discount due to unknown information, ROI, etc. I think it is reasonable to say that an extortion demand for $100M, assuming a credible demonstration that the criminal organization could pull off such an attack, would be an economically sound demand and likely to be paid. A criminal organization, considering their own ROI, would probably be willing to invest $30M for a $100M return. For $30M an organization could hire 30 full-time security specialists for 3 years at SV wages to identify an attack with similar effects.<p>Does anybody here think that their new system could resist such an attack even assuming they adopted all recommendations proposed?<p>Does anybody here think that there is any deployed system in the world that could resist such an attack?<p>Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resist such an attack?<p>All of my research points to no on all of those fronts. And, assuming the answer is no, then adopting all of the recommendations provides no meaningful protection to Maersk or any other company in a similar position since it would still be extremely profitable to attack them. Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack.<p>If the answer to any of those is yes, could you provide an example and evidence that supports that claim? I would sorely like to find a credible deployed case.<p>[1] <a href="https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;notpetya-cyberattack-ukraine-russia-code-crashed-the-world&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;notpetya-cyberattack-ukraine-rus...</a>