Discussion
“Why are these systems even on a network? Just disconnect them!”
I see this after every OT attack, usually from smart IT people. As someone who responds to these incidents, I wish it were that easy. I wrote up how we got here, and why water utilities and refrigerators keep getting hit.
https://tisiphone.net/2026/11/08/lets-talk-about-why-all-this-ot-stuff-is-connected/
@hacks4pancakes I remember reading somewhere recently that a lot of these systems were installed by facilities people not IT people and the facilities don't know what they don't know.
Man, I worked on setting up the firewalls for our test floor for our EMS projects 30 years ago and we spent more attention protecting the test floor than it seems like most vendors spend protecting their customers production environments.
If the OEM wants to require remote access then it's on the OEM to architect their remote access so it's easy to do securely, and if they can't they need to be held directly accountable.
ever notice that you can pretty much guarantee something is a simplistic take on a complicated problem if they start with "you just need to..."?
@hacks4pancakes very interesting. The plant I work in has several layers of firewalled and air-gapped networks and jump boxes where needed, sensitive things are pretty damn well isolated. I like this model a lot and try to use it where possible.
@hacks4pancakes on the one hand, it might not be “easy”, on the other hand, it is *not* optional. Decision makers here need to understand this is the price of everything being connected to, and thus attackable from, everything else.
@hacks4pancakes Silicon Valley S4 Ep7
@hacks4pancakes
Two nitpicks, the first one minor:
1. The thermometer example, I am pretty sure the person who asked the question meant connecting the thermometer to the internet, not the thermostat. That way you don't need someone staring at it, and a thermometer can do a lot less damage than a thermostat.
2. No mention of leased lines. That was how we used to do remote connections before VPNs. Which, btw, I didn't see mentioned either. There are big jumps between connected to the internet -> vpn -> leased line -> air gap. There are plenty of these systems that exposes VNC directly to the internet, and a lot of improvement possible before you need to rethink your setup
@hacks4pancakes I see a lot of paralles with the PC.
The shift from bespoke systems maintained by expert engineers (the UNIX minicomputer) gave way to a commodity of the shelf system that you could install yourself with no assistance or approval from the computer room (the DOS microcomputer). The micro had zero memory protection, zero authentication, zero multitasking, and zero management. The decades of progress that followed were about bolting on security and management from the outside.
@hacks4pancakes I'm sorry but they could have very easily put a temp sensor, and only a sensor that is not connected to anything else, in those refrigeration units and put that online. That allows monitoring and even if it got hacked, it would be independent of any controls so long as it is a dedicated, independent sensor.
Infosecurity from my days in the military 30 years ago to today is stunning in the casualness people now show for the sake of cost cutting and stock prices.
@hacks4pancakes
Thanks for the detailed explanation! It didn't occur to me that "industrial refrigerators" fell into the same device class as PLC-based systems, but it makes sense with this context.
The problem already is in the devices firmware themselves. Usually they have no permission model beyond everything or nothing. You want to read temperatures? Fine. But across exactly the same bus you get access to setting the temperature, or even uploading new firmware entirely with usually the thinnest of default passwords and encryption that would not have passed muster in the Napoleonic wars.
@hacks4pancakes "sensible business decisions" are the reason we've got PFAS in the water supply.
Putting on my grey hat for the moment: increasing the costs of remediation above the cost of implementing better architectures should (ultimately) result in better outcomes. I just hope we survive the interim ;)
@hacks4pancakes Spot on with the assessment that most assume the DMZ+jump box model should be standard practice (if not full air gap).
and it totally makes sense that it was a business decision behind abandoning the concept that industrial controls systems have no business being on the internet.
I appreciate the explanation, and i suspected it was probably something like you described.
@hacks4pancakes I understand why it's difficult to disconnect it. But why not VPN it to reduce the attack vector?
@hacks4pancakes I truly wish we could go back to the days of some things just being manual... not that hard to push a button on a fridge to change the temp