The article makes three interesting assertions (paraphrased):
- Technology vendors haven't been held accountable for their shoddy products and services
- US importation policies don't check for foreign malware (or malice)
- Small manufacturers don't have resources to defend against cyberwarfare.
I disagree mostly with the third. In a prior life, I worked with a small, very specialized manufacturer with several government contracts. The small operation made security much easier from a strategic standpoint. That said, the attitude of senior leadership was the biggest challenge to security - and that is the truth no matter the operation's size. It's more about planning and commitment than size or even cost.
What's an interesting takeaway is that we may be seeing a shrinking of globalization. If you want to be a global player, the risk or cost of mitigation may be too much. Sure, Toyota may have suffered a $400 million hit because a supplier was hit with ransomware. But that is (and was) a measurable business risk that Toyota and its supplier should have identified at some point. The solution may lead to bringing supply chains entirely within the well-secured (ideally) walls of your big-business castle, in essence, cutting off a lot of the smaller global commerce that has been on the rise over the past quarter century or so.
