Well, yes and no. It increases the pressure on people in power. More pressure, more mistakes.
In this case the question is, if US Army freezers were hacked earlier, why did nobody brief other operators of cooling equipment. Its a failure at the top! Everyone is getting flustered and knives are out.
But maybe they could not fix the underlying software or whatever and were not ready to share details without opening themselves up to more attacks. Also there are a lot of attacks happening all the time, which ones do you share?
If the psychological pressure at the top increases, more mistakes will be made. Sometimes mistakes can be subtle over or under reactions, sometimes the mistake is not to do anything. It is real effort to evaluate an appropriate response. For example, the military could reach out to commercial operators quicker, but then they have to handle all the comms, questions, and they also potentially leak more attack vectors. The commercials also start having this overhead of having to read emails from the military and internally those orgs have to deal with that overhead in comms to evaluate the seriousness.
This is a problem, because very few orgs have spare capacity for this stuff and so they have a choice. They can react to the military comms and risk mistakes somewhere else due to comms / management bottlenecks, or vice versa. There are only bad choices. And every time this happens, another choice has to be made.
Lots of these will be low-level attacks with manageable impact, which lowers the alertness over time, until that moment when something serious happens. If at point everyone is exhausted a real costly mistake will happen. Its the long game.
In this case, I am sure a consideration was that the attack was already used against high-profile cases and it makes sense to just use the attack vector more broadly before it gets closed.
In this case the question is, if US Army freezers were hacked earlier, why did nobody brief other operators of cooling equipment. Its a failure at the top! Everyone is getting flustered and knives are out.
But maybe they could not fix the underlying software or whatever and were not ready to share details without opening themselves up to more attacks. Also there are a lot of attacks happening all the time, which ones do you share?
If the psychological pressure at the top increases, more mistakes will be made. Sometimes mistakes can be subtle over or under reactions, sometimes the mistake is not to do anything. It is real effort to evaluate an appropriate response. For example, the military could reach out to commercial operators quicker, but then they have to handle all the comms, questions, and they also potentially leak more attack vectors. The commercials also start having this overhead of having to read emails from the military and internally those orgs have to deal with that overhead in comms to evaluate the seriousness.
This is a problem, because very few orgs have spare capacity for this stuff and so they have a choice. They can react to the military comms and risk mistakes somewhere else due to comms / management bottlenecks, or vice versa. There are only bad choices. And every time this happens, another choice has to be made.
Lots of these will be low-level attacks with manageable impact, which lowers the alertness over time, until that moment when something serious happens. If at point everyone is exhausted a real costly mistake will happen. Its the long game.
In this case, I am sure a consideration was that the attack was already used against high-profile cases and it makes sense to just use the attack vector more broadly before it gets closed.