4 ms·

You could have an air-gapped system and still have remote access. Just not external access. I don't think it's unreasonable to have a couple of people in a cont

You could have an air-gapped system and still have remote access. Just not external access. I don't think it's unreasonable to have a couple of people in a control booth monitoring a computer that regulates the pipeline 24/7. The recommendation is, however, that we should not have that monitoring computer connected to any other network besides the internal one. If you're running pipeline, surely you can run some data cables with it?

sdenton4 5y ago
This basically describes the Iranian nuclear system that was hit by stuxnet, which, as I recall, was spread via USB drive. The airgap certainly reduces the chances of getting hit with a joe-random ransomware attack, though. Defense in depth...
- acdha 5y ago
  Yes - and consider how many people have the resources needed to run Stuxnet versus ordinary ransomware. That seems like a pretty clear win if you can shrink the pool of likely attackers down to “top-tier nation-state”.
- kova12 5y ago
  Stuxnet was built by a very well funded organization and was not targeting monetary gains. Getting ransomware spreading via USB drive is insanely expensive and complicated. You won't make money on it, whatever they are extorting will not cover development expenses
  - teclordphrack2 5y ago
    "and was not targeting monetary gains" But in the end was it really though?
- takeda 5y ago
  Let's not let perfect be enemy of good, especially since we can't never be perfect.
kchoudhu 5y ago
This is what the financial industry does. There's a secured "extranet" that everyone runs FIX on top of. For the most part, it works.
- kevin_thibedeau 5y ago
  There's an entire parallel internet for the DoD and it's contractors. It's not like there isn't precedent that critical industries can emulate if they ever became concerned about the common good.
  - kingsuper20 5y ago
    That's interesting. Is it physically separate? I would assume so but don't know. I'd love to read an article on it. Maybe there are others that are geographically dispersed.
6nf 5y ago
> You could have an air-gapped system and still have remote access You're suggesting the gas company run their own network, and then you assume no employee will connect that network to the general internet for their own convenience? Not happening.
- hosteur 5y ago
  That would be a fireable offense. Even criminal.
  - 6nf 5y ago
    Again, stuff like that just don't happen. It's too inconvenient. How many major utility companies run such airgapped networks? https://gca.isa.org/blog/common-ics-cybersecurity-myth-1-the-air-gap https://gca.isa.org/blog/common-ics-cybersecurity-myth-1-the...

sdenton4 5y ago

This basically describes the Iranian nuclear system that was hit by stuxnet, which, as I recall, was spread via USB drive. The airgap certainly reduces the chances of getting hit with a joe-random ransomware attack, though. Defense in depth...

acdha 5y ago
Yes - and consider how many people have the resources needed to run Stuxnet versus ordinary ransomware. That seems like a pretty clear win if you can shrink the pool of likely attackers down to “top-tier nation-state”.
kova12 5y ago
Stuxnet was built by a very well funded organization and was not targeting monetary gains. Getting ransomware spreading via USB drive is insanely expensive and complicated. You won't make money on it, whatever they are extorting will not cover development expenses
- teclordphrack2 5y ago
  "and was not targeting monetary gains" But in the end was it really though?
takeda 5y ago
Let's not let perfect be enemy of good, especially since we can't never be perfect.

kchoudhu 5y ago

This is what the financial industry does. There's a secured "extranet" that everyone runs FIX on top of. For the most part, it works.

kevin_thibedeau 5y ago
There's an entire parallel internet for the DoD and it's contractors. It's not like there isn't precedent that critical industries can emulate if they ever became concerned about the common good.
- kingsuper20 5y ago
  That's interesting. Is it physically separate? I would assume so but don't know. I'd love to read an article on it. Maybe there are others that are geographically dispersed.

6nf 5y ago

> You could have an air-gapped system and still have remote access You're suggesting the gas company run their own network, and then you assume no employee will connect that network to the general internet for their own convenience? Not happening.

hosteur 5y ago
That would be a fireable offense. Even criminal.
- 6nf 5y ago
  Again, stuff like that just don't happen. It's too inconvenient. How many major utility companies run such airgapped networks? https://gca.isa.org/blog/common-ics-cybersecurity-myth-1-the-air-gap https://gca.isa.org/blog/common-ics-cybersecurity-myth-1-the...