points by hedgerow-dev 11 hours ago | 0 comments
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
[–] _kb 3 hours ago
[–] amenghra 9 hours ago
This is how it should work: supermarket wants to use high tech stuff such as connected fridges, they get a cyber insurance policy as part of all the other insurances they have. The insurer then has domain experts to figure out what the insured needs to do to meet a risk threshold (or they adjust fees accordingly).
This model has worked fine for many other types of risks.
[–] hedgerow-dev 9 hours ago
Many of these supermarkets are part of big brands but operate independently. I doubt cyber insurance is top of mind for those small owners
[–] SoftTalker 8 hours ago
It will be soon. How many refrigerated cases of product can they afford to lose?
[–] gruez 4 hours ago
Not to mention other ways cyberattacks can paralyze their business, eg. their POS system
I think this is more indicative of the plethora of technical debt and straight up technical negligence that's accompanied the past 10-15 years of internet connected everything. What's happening today is the predictable result of project based works funded by capex deploying assets (of all types) with no consideration of opex funding for the technology components.
Just because a webserver is running in some physical device (fridge, camera, vacuum, washing machine, pump controller, lighting system, audiovisual equipment, access control system etc) does not magically exempt it from the same sort of ongoing sysadmin and maintenance you'd expect as a baseline for something running on standard compute. That applies equally to manufacturers publishing firmware, and the asset owners/service companies that have the responsibility to apply.