Thread by @ErrataRob

No. This is a trope. It's not reality.

Every company has internal political fights. Whenever something bad happens, some will claim victory for their side, that they should've been listened to.

https://twitter.com/slashdot/status/1414327982643056642

The specific problem was OWASP Top 10 on their HTTP-based product. These weren't mentioned in the Bloomberg, instead they mentioned other security weaknesses unrelated to the hack.

Every company "focuses on sales". Every company has to make tradeoffs and take risks. Every organization has people claiming the risks are too high. Just because you always find them after the accident doesn't mean they were right.

In this case, the weren't right. They didn't warn about OWASP bugs in the product, the thing that lead to the ransomware. They warning about things like "weak encryption", which I don't even know what that means.

The O-ring flaw and insulation flaw that lead to the Space Shuttle disasters are good examples. They weren't the causes. The cause was a design so complex that it would never be able to fly without risk.

Even after those flaws were address, there were still insiders complaining that there were still more risks that were being ignored. Of course there were: the Space Shuttle was so complex it couldn't fly if you paid attention to every risk.

SpaceX is an amazing company. One of the things that makes it amazing is how much is celebrates all its failures. A failure doesn't become a witchhunt to find blame, but a fact of life that needs to be studied, fixed, and moved past.

Kaseya's flaws were pretty glaring. The company needs to do a lot to become more transparent about their security and communicate to their customers how they are addressing the failure.

In other words, the trope of finding blame in the past is a bad one. The concept of "how we win back customer confidence for the future" is the one that people need to focus on. Everyone makes mistakes -- the issue is confidence they won't be repeated.