@hacks4pancakes
Two nitpicks, the first one minor:

1. The thermometer example, I am pretty sure the person who asked the question meant connecting the thermometer to the internet, not the thermostat. That way you don't need someone staring at it, and a thermometer can do a lot less damage than a thermostat.

2. No mention of leased lines. That was how we used to do remote connections before VPNs. Which, btw, I didn't see mentioned either. There are big jumps between connected to the internet -> vpn -> leased line -> air gap. There are plenty of these systems that exposes VNC directly to the internet, and a lot of improvement possible before you need to rethink your setup

@hacks4pancakes I see a lot of paralles with the PC.

The shift from bespoke systems maintained by expert engineers (the UNIX minicomputer) gave way to a commodity of the shelf system that you could install yourself with no assistance or approval from the computer room (the DOS microcomputer). The micro had zero memory protection, zero authentication, zero multitasking, and zero management. The decades of progress that followed were about bolting on security and management from the outside.

@hacks4pancakes I'm sorry but they could have very easily put a temp sensor, and only a sensor that is not connected to anything else, in those refrigeration units and put that online. That allows monitoring and even if it got hacked, it would be independent of any controls so long as it is a dedicated, independent sensor.

Infosecurity from my days in the military 30 years ago to today is stunning in the casualness people now show for the sake of cost cutting and stock prices.

@hacks4pancakes
Thanks for the detailed explanation! It didn't occur to me that "industrial refrigerators" fell into the same device class as PLC-based systems, but it makes sense with this context.

@hacks4pancakes

The problem already is in the devices firmware themselves. Usually they have no permission model beyond everything or nothing. You want to read temperatures? Fine. But across exactly the same bus you get access to setting the temperature, or even uploading new firmware entirely with usually the thinnest of default passwords and encryption that would not have passed muster in the Napoleonic wars.

@hacks4pancakes "sensible business decisions" are the reason we've got PFAS in the water supply.

Putting on my grey hat for the moment: increasing the costs of remediation above the cost of implementing better architectures should (ultimately) result in better outcomes. I just hope we survive the interim ;)

@hacks4pancakes Spot on with the assessment that most assume the DMZ+jump box model should be standard practice (if not full air gap).

and it totally makes sense that it was a business decision behind abandoning the concept that industrial controls systems have no business being on the internet.

I appreciate the explanation, and i suspected it was probably something like you described.

@hacks4pancakes I understand why it's difficult to disconnect it. But why not VPN it to reduce the attack vector?

@hacks4pancakes Thanks for this Lesley. Very educational.

@hacks4pancakes I often find myself wondering if the a competently administered homelab wpuls be more secure than most corporates, because the only barriers they have to being more secure is technical.

There's no need to grapple with the organisational messes to do what needs to be done to lock things down. And it seems like organisations, people and politics are the bigger challenge to doing technology well than the technology is.

@hacks4pancakes 100% If we accept that there’s some value in reaching them remotely for monitoring or whatever, that still doesn’t mean they need to be on the _public_ internet. Make them accessible only on the local network, perhaps reachable by VPN. At least that way you’re not entrusting the devices themselves to have decent security (they won’t).

@hacks4pancakes
Thanks for this; I hadn't realised how big a part OEMs played in the rise of these problems.

@hacks4pancakes There was this post on Reddit a few days ago, which nicely explains how these systems end up open to the Internet:

@hacks4pancakes
A great summary of the journey. Understanding the whole problem is only way to develop appropriate solutions.

@hacks4pancakes I am reminded of a startup I worked for about 10 years ago to ensure cold chain. We cared about security. It made our devices more expensive. The customer did not care. It went out of business.