It's so disheartening to explain this over and over working in critical infrastructure cybersecurity full time. It's because everyone demands cheap, fast remote support and AI enabled real time telemetry and control. We’ve worked ourselves into this corner through demanding connectivity and I see next to nothing truly airgapped anymore. In fact, it’s impossible to convert some critical systems back at this point.
A lot of our power infrastructure is so complex with microgrids and renewables and real time billing and buy backs that it can’t be switched to manual anymore. A lot of industrial vendors won’t provide warranty support if their remote access is removed.
And this is all happening in super low maturity environments with limited if any cybersecurity resources or tools.
We’re trying, but the state of things is pretty dire, the barrier to basic disruptive attacks is lowering rapidly, and we can’t find enough people who understand the industrial environments and cybersecurity on thirty year old computers fast enough to hire close to enough people.
@hacks4pancakes I worked for a security firm for a number of years. Whenever at conferences talking to potential vendors I would always ask "can it work in an air gapped environment". Some didn't even know what it meant. Not one ever said yes.