U.S. Senator Ron Wyden has sent a letter to the Federal Trade Commission (FTC) requesting the agency to investigate Microsoft for failing to provide adequate security in its products, which led to ransomware attacks against healthcare organizations.
www.bleepingcomputer.com
The U.S. Senator's request to the Federal Trade Commission (FTC) goes against all U.S. and international laws governing accountability and responsibility for incidents. It is ALWAYS the user's accountability and responsibility for the security of their infrastructure and networks, unless there is a contract and a shared responsibility matrix. Even then, the client is accountable and responsible for all items outlined in the contracts and agreements.
That U.S. Senator is a moron.
How can a software publisher or provider be made accountable or responsible for the actions of inept administrators and users? To suggest anything other "That cannot be done, ever. Unless there is a contract that makes them responsible." is idiocy.
Like everything, it needs govt regulation.
Some things do. Some things do not. With any government regulation there comes significant operating costs and the government is not going to pay those costs, generally.
For example if there were no FIPS
FIPS applies only to U.S. federal executive agencies, contractors, and partners.
The U.S. federal government does not enforce FIPS onto itself at all. It barely enforces compliance by contactors or partners.
If the U.S. Government is going to begin robust enforcement, then it will have to develop an assessment and enforcement framework that will result in very high costs for contractors and partners. In those cases, those very high costs are considered "overhead" and the costs passed along to the U.S. Government, within limits, as long as the contractors or partners have the type of contracts that permit the billing of those costs to the U.S. Government.
For contractors that have fixed-price contracts, they are beat. They have to pay the regulatory expenses themselves and cannot bill the U.S. Government. Most will tell the U.S. Government to FO and either break the contract or just not comply and refuse to renew at the next contract solicitation.
The U.S. Government, like any other government, is notorious for non-enforcement of contract terms and requirements.
Imposing and enforcing cybersecurity regulations on any digital product or service provider will never be practical, let alone is there is the political or societal will to do it.
