3 ms·
I assume water treatment plants are considered critical infrastructure and have regulations to prevent unauthorized access. Either someone messed up, or there
by hoppla 6y ago
I assume water treatment plants are considered critical infrastructure and have regulations to prevent unauthorized access.
Either someone messed up, or there is a resourceful attacker.
- er4hn 6y agoThe regulations are not as locked down as you would expect. Think less: * Remote access to systems that could kill people must be limited to people with the following thought out permissions and secured credentials And more: * The list of people who can access this system must be documented * The accounts must have their password be changed every 6 months * A committee must review the set of outstanding patches and upgrades for known issues every 4 months and prioritize what to fix * I hope that someone is actually installing those patches and upgrades.
- bilbo0s 6y agoAll the patches and upgrades in the world won't help if some dingbat installs TeamViewer and leaves it running.
- generalizations 6y agoI can imagine that especially during covid, there might have been some substantial convenience to having teamviewer on that computer system. Not justifying it's presence, but I do think this is a failure of IT not finding a way to make access to the system both secure and convenient.
- acct776 6y agoYeah, the IT person who is there Tuesdays and Thursdays, and helps plug unplugged mice in. Surely they'll be capable of configuring a corporate VPN without a fat budget to have Cisco do it for them...right?