4 ms·
"It really boggles my mind that we don't air-gap every single one of these types of critical systems." I would go even further. To air-gap something implies t
by rsync 11y ago
"It really boggles my mind that we don't air-gap every single one of these types of critical systems."
I would go even further.
To air-gap something implies that you are breaking the physical link that it could interact on the network with.
I would suggest that these systems should not have networking capabilities at all. The controllers for a dam, or power plant, or (insert critical infrastructure here) should not have networking hardware or even a networking stack.
- thaumasiotes 11y agoThis implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually). If you want someone to be able to adjust the dam, without putting out the physical effort required to make the adjustment, you need to network the dam. That way, the person can send a signal (easy) and a machine that's able to do the work can receive the signal and do the work (hard). The most you can do is ensure that signals from the internet (or anywhere offsite) can't reach the dam. You need onsite signals.
- deleted 11y ago[deleted]
- gizmo686 11y agoThere is still a question of how complex the network is. One could argue that an IP based network stack is unnecessarily complex, and we should use a simpler system to improve reliability and security. In concept, the "network" could be nothing more than dumb wires connected to DIO and PWM ports.
- thaumasiotes 11y agoOh, agreed.
- rsync 11y ago"This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually)." Yes, that is exactly what it implies. This brings with it two very important and extremely valuable effects: First, it means there is a human observing, on a regular basis, the behavior of the system - someone "has a feel" for how things work and can (with the intellect and perception of a human brain) "sense" when something is not right. Second, it means, in the Taleb sense, that someone has "skin in the game". In the same way that I would be very disturbed if a commercial airliner had remote pilots, I would be similarly disturbed if a dam or a power plant had remote operators. Finally, this human, locally present operator or operators probably shouldn't have Internet access - even on personal devices. There's no reason for it and it only adds risk and attack vectors. If you run the nuclear plant you can check twitter when you get home.
- thaumasiotes 11y agoI think you missed the part of my point where this can't be done. You can't hire someone to go open the dam himself and be crushed by the water that comes out. Nor can you hire people to move things that are too heavy for a person, or 100 people, to move.
- rsync 11y agoYes, certainly I am not suggesting that we sacrifice humans to go open the sluice gates manually. I am talking about doing it without computers. These things were done prior to computers with relays and switches and even status lights and a monitoring board, etc. I'm advocating that we take out all of the general purpose capabilities as well as the ability to interoperate. A human being flicks a switch.
- bifrost 11y agoWe'd have to add a secondary remote interlock capability to prevent an out of control operator from doing something aberrant. Infrastructure without automation is hopefully dead, we just need to be smarter about how we accomplish it.