24 ms·
Anyone who's running Modbus TCP or any other fieldbus is going to do it on an isolated VLAN and if for some reason it needs to run inter site, set up a site2sit
by RedShift1 4y ago
Anyone who's running Modbus TCP or any other fieldbus is going to do it on an isolated VLAN and if for some reason it needs to run inter site, set up a site2site VPN. I don't see the added value of encrypting the protocol itself if you have all the earlier things I said which you're supposed to do anyway regardless of the security provisions of the application protocol.
- oofbey 4y agos/is going to/should/; It's frightening how many industrial product are completely insecure, assuming/hoping/wishing the installers only use them on a secure network. But all too often that "secure network" is the network for the whole facility, with every laptop, phone, device, etc on the same "secure" network. Sure, it's got a NAT "firewall" between it and the scary scary internet. But it's far from isolated the way it should be.
- spacemanmatt 4y agoFormer SRE here. I sure wish more people understood that security means way more than isolation, and hardening is impossible with a bunch of squishy devices that practically conspire to flatten your security model.
- legalcorrection 4y agoZerotrust networking is the current best practice. If you’re relying on network security for something, you’ve already failed.