3 ms·
Ofcourse, and that's a good thing, but networked doesn't have to be the internet. Why have that connected to the internet? And not some setup where it is physic
by tluyben2 9y ago
Ofcourse, and that's a good thing, but networked doesn't have to be the internet. Why have that connected to the internet? And not some setup where it is physically or at least reasonably physically seperated. Those values would also be fine on the LAN. Not networked is safer than networked, but connecting them to the actual internet (via usually not more than some basic router) is the other extreme.
- packetplumber 9y agoMy thoughts exactly. Just use an IPsec VPN through to the monitoring centre if it must be monitored. No need to have listening ports on the Internet. It's not exactly network engineering black magic. I imagine what happened is that it was compromised by phishing on an unprotected host. In that case the control systems should be air-gapped from Joe Blog's in accounting PC.
- simcop2387 9y agoDefinitely agree, I've never understood why so many seem to end up connected to the internet at large, or through some easy to pass through gap. Even before Stuxnet it never quite made sense, and post stuxnet it's hard to argue that it's not negligent to have a setup like that. The only thing I can assume is that because having it as a separate lan that's not routed to the internet (arguments about vlans being sufficient, etc are a different discussion) would cost more in both hardware and maintenance.