@WiteWulf @Jer @Gargron - They're insecure here because the devices are End of Life and no longer supported. The cost to replace all of those devices is prohibitive and can't be done. So now they're see how much it costs to put in mitigations and limit exposure.
Like... y'all... this is literally every ICS / OT environment in the world.
If you ever find yourself asking "Why don't they *just*...", I guarantee you don't have the experience needed to provide an answer.
They have tried your "just" and it didn't work.
@tinker @Jer @Gargron they’re not insecure because they’re “end of life and no longer supported”. They never *were* secure. Those devices should never have been connected to an adversarial network, but the Internet is a lot cheaper to use than a private network and everyone wants to cut corners and lower costs.