@hacks4pancakes

You don't have to disconnect the systems from the network - as first measure make sure that only known entities can reach it.
Limit access to known IP addresses or to connections via VPN.

Or do that the other way 'round (which is done on PV systems, home appliances, but also agricultural OT): have the system connect outward to the service partner's / manufacturer's cloud. This way the OT is hidden behind a simple NAT router, unreachable (from the internet) for attackers.

Great post. I'm kind of stunned how many commenters have apparently read it while failing to absorb any of the patient explanations.

@hacks4pancakes I hear you and agree with your assessment but I am still annoyed that corps decided to go the cheapest route even when they knew better. I spoke with execs in the early 2000s about this and they saw no reason for have these things on a separate network, I believe they couldn’t see this because it represented a cost center with no ROI.

@hacks4pancakes my team kind of solved this back in the 80s. The equipment used modems and the phone line and used a call back system. So if somebody initiated a connection this machine would close the connection and call home. Which, if we had initiated the connection, would instantly start getting the work done, and if we had not, would it instantly raise alarms! I'm not quite sure what the modern equivalent of that would be, "but we wants it"!

@hacks4pancakes are the underlined abbreviations supposed to be hover-explainers? Not hovering for me 😒 (phone)

@hacks4pancakes i do not agree. It has nothing to do with slow shifts to ethernet cables. It's all about how these machines are marketed, sold, supported and maintained. You buy them because marketing tells you about their amazing features. These features are only available while you have a support contract. For the support contract the vendor wants access, but the vendor doesn't care about your security. Installation is done by people with zero IT knowledge. DHCP, VLAN, IPv6, Routes? Never ..

@hacks4pancakes
Completely disagree. Cheap service means big problems.
And they had both. For this, the shame must fall only on who offered and accepted cheap service.

@hacks4pancakes

When even SMB routers have vpn capability though why can’t they at least be placed behind a vpn? Or are we saying the scale of remote users would mean a massive power firewall requirement beyond what they can afford?

And at that surely the fallout from this kind of hack costs more?

@hacks4pancakes wow, thanks. I barely understand it, and yet the contours are clear.

@hacks4pancakes @audrey for those of us outside your specialty, what is "OT" in this context?

@hacks4pancakes I'd wondered this myself a few years ago, and guessed (correctly, it turns out, after reading your article) that it ultimately comes down to cost. It's more expensive to have people go look at/configure things than to do it remotely. And as always, it's easy to dismiss security until a breach occurs, and then the execs who skimped on security costs don't pay the price. So they have little incentive to bolster security.

@hacks4pancakes "we have to do it this way" with a tinge of "neglect". Tale as old as time.

@hacks4pancakes thank you for writing this up, I will read with interest! while I am wise enough not to *post* a “why don’t you just X, I would just X, it would be easy for me” about complex system security outside of my expertise, I will confess that I have found this argument quietly compelling and have been wondering just this for a while!

@hacks4pancakes I get your point - and I think there is some important aspects of this. However, it seems that the root problem is not enough people to look after stuff. Maybe if people could be employed to look after things, it would mean less stuff needed to be online.

But, of course, firing people and putting everything online so it can be controlled by one person miles away much cheaper is the way.

Cheaper, until everything goes down.