21–30 of 163 posts
There are many wireless pump-and-reservoir systems that while not internet connected, use insecure RF links. These local RF (and casting a wider net, Bluetooth) interfaces are also ripe for abuse.
Wouldn't the physical facilities themselves have security?
Earlier quoted context omitted.
Wouldn't the physical facilities themselves have security?
I assume they are talking about things like water towers that are spread around, and linked back to hq via insecure wireless.
He is wrong and right. They should be connected to the Internet when they aren't 30 year old PLCs ripe for abuse. Until then, cut the data lines and do water monitoring the old way.
Rather than "on/off" I think we need to distinguish between at least four things: 1. Connected naively to the internet. 2. Behind a hardened VPN endpoint which is on the internet. 3. Has a separate physical private network. 4. Requires physical access. I think it's obvious that #1 should be prohibited in favor of #2. After that point we need to ask what the impact is of a Denial of Service attack that prevents anyone…
He is wrong and right. They should be connected to the Internet when they aren't 30 year old PLCs ripe for abuse. Until then, cut the data lines and do water monitoring the old way.
If it’s connected, it’s compromised. Or will be. Folly to think otherwise.
There are many wireless pump-and-reservoir systems that while not internet connected, use insecure RF links. These local RF (and casting a wider net, Bluetooth) interfaces are also ripe for abuse.
Wouldn't the physical facilities themselves have security?
I’ve been doing industrial controls for 15 years and surprisingly infrastructure is some of the most poorly funded. I believe a lot of these places are run by operating companies, so it’s bidded out (we all know how bids work I think). I’m not surprised when I walk into these places and see the computers are running EOL operating systems and the networking is essentially flat.
He is wrong and right. They should be connected to the Internet when they aren't 30 year old PLCs ripe for abuse. Until then, cut the data lines and do water monitoring the old way.
Disagree. Why connect them to the internet? They should be super hardened against attacks, and should NOT have a physical connection to the internet. Same with electrical infrastructure. Network access? Possibly, however that network should NOT be accessible from the internet. The only exception I can think of would be for meter reading, which should be a separate, read only device with no ability to do harm altogeth…
Earlier quoted context omitted.
Disagree. Why connect them to the internet? They should be super hardened against attacks, and should NOT have a physical connection to the internet. Same with electrical infrastructure. Network access? Possibly, however that network should NOT be accessible from the internet. The only exception I can think of would be for meter reading, which should be a separate, read only device with no ability to do harm altogeth…
People start freaking out at the costs of dedicated fibers to every monitored facility. Hence even 'private' networks still run over the same actual lines as the internet.
Earlier quoted context omitted.
Disagree. Why connect them to the internet? They should be super hardened against attacks, and should NOT have a physical connection to the internet. Same with electrical infrastructure. Network access? Possibly, however that network should NOT be accessible from the internet. The only exception I can think of would be for meter reading, which should be a separate, read only device with no ability to do harm altogeth…
At a few of our sites, we have webcam-pointing-at-gauge. Deemed secure via air gap and simple to deploy.
Earlier quoted context omitted.
Wouldn't the physical facilities themselves have security?
You’d be surprised how insecure some of these facilities are, especially to someone who has working knowledge of what a PLC (or other process controllers) does and how it works. You can easily look like a tech who belongs there either troubleshooting something or working on a project. I’ve been doing industrial controls for 15 years and surprisingly infrastructure is some of the most poorly funded. I believe a lot of…
I'm kind of worried (probably unnecessarily) that posting ideas would get me on some list, but it seems like there would be many simpler terrorism opportunities once you have physical access.