4 ms·

For industrial machines it's also becoming common to have them networked and open so that you can gather data about everything. Watch the temperatures of the i

For industrial machines it's also becoming common to have them networked and open so that you can gather data about everything. Watch the temperatures of the injection molding machine and how long it's taking to do it's job. If things change then you know that parts need replacing or it's getting ready to fail. This lets you do more runs, faster, without having to take down for maintenance at intervals rather than when it's needed. That both increases reliability (early failures can be caught) and how much you can produce before needing to take it offline (since you can go longer knowing the machine is performing identically).

tluyben2 9y ago
Ofcourse, and that's a good thing, but networked doesn't have to be the internet. Why have that connected to the internet? And not some setup where it is physically or at least reasonably physically seperated. Those values would also be fine on the LAN. Not networked is safer than networked, but connecting them to the actual internet (via usually not more than some basic router) is the other extreme.
- packetplumber 9y ago
  My thoughts exactly. Just use an IPsec VPN through to the monitoring centre if it must be monitored. No need to have listening ports on the Internet. It's not exactly network engineering black magic. I imagine what happened is that it was compromised by phishing on an unprotected host. In that case the control systems should be air-gapped from Joe Blog's in accounting PC.
- simcop2387 9y ago
  Definitely agree, I've never understood why so many seem to end up connected to the internet at large, or through some easy to pass through gap. Even before Stuxnet it never quite made sense, and post stuxnet it's hard to argue that it's not negligent to have a setup like that. The only thing I can assume is that because having it as a separate lan that's not routed to the internet (arguments about vlans being sufficient, etc are a different discussion) would cost more in both hardware and maintenance.

tluyben2 9y ago

Ofcourse, and that's a good thing, but networked doesn't have to be the internet. Why have that connected to the internet? And not some setup where it is physically or at least reasonably physically seperated. Those values would also be fine on the LAN. Not networked is safer than networked, but connecting them to the actual internet (via usually not more than some basic router) is the other extreme.

packetplumber 9y ago
My thoughts exactly. Just use an IPsec VPN through to the monitoring centre if it must be monitored. No need to have listening ports on the Internet. It's not exactly network engineering black magic. I imagine what happened is that it was compromised by phishing on an unprotected host. In that case the control systems should be air-gapped from Joe Blog's in accounting PC.
simcop2387 9y ago
Definitely agree, I've never understood why so many seem to end up connected to the internet at large, or through some easy to pass through gap. Even before Stuxnet it never quite made sense, and post stuxnet it's hard to argue that it's not negligent to have a setup like that. The only thing I can assume is that because having it as a separate lan that's not routed to the internet (arguments about vlans being sufficient, etc are a different discussion) would cost more in both hardware and maintenance.