3 ms·

How did we end up at a point where we are this reliant on the internet? Any truly critical system should not be connected to the public internet. Computers wit

How did we end up at a point where we are this reliant on the internet? Any truly critical system should not be connected to the public internet. Computers with internet connections are for sending email and reading Wikipedia. Any data critical to your organization should be accessed from separate terminals connected via LAN. No VPN, that's still the internet. Do that, and unless you're the CIA you will never be hacked. You can even run Windows XP if you feel like it. The internet is the root of the problem, and it's time we start realizing that some things shouldn't be online.

jacobr1 5y ago
The problem is that much (not all) the business important data is involved the public internet. Take this school for example - prospective students applied online. One could imagine sneaker-netting the application data to an airgapped network, but that introduces its own costs and risks. Email (or other messages systems like slack) are one of primary tools of business, facilitating communication within an organization. You can't do that well with an air-gapped network, except to make that network really leaky.
- Wowfunhappy 5y ago
  I totally get it, but the internet hasn't been around that long. How did we handle this 30 years ago? I imagine students applied via snail mail, and then someone manually entered the information into a database. There's no reason to go back to paper applications, and that database should absolutely be digital—but I think we could do a lot more manual entry.
  - MandieD 5y ago
    25 years ago: carefully hand-write half-page essays on pre-printed application forms, attach $50 checks for application fees, beg your mother to drive your procrastinating self to the downtown post office by 5pm on December 31. Start receiving long-awaited envelopes around Spring Break, and speculate on whether said envelopes were thin because they contained simple rejection letters, or because the desired financial aid details would follow the next week.
zamadatix 5y ago
Having worked in healthcare up until very recently I can assure you a bunch of unpatched XP machines connected via LAN will still be rampantantly infected regardless if they have access to the internet. Wannacry was just absolutely rampant on these systems for years. At the same time the publicly inbound accessible servers in the DMZ never had an issue because we were actually able to manage the security controls on those. The LAN is a much more used attack vector than the internet. It has nothing to do with some hacker sitting there banging at your door users just share files and reuse devices as part of their day to day effort. The instant someone in the college brings in a compromised USB, intentionally or unintentionally, all of the isolation in the world from the internet doesn't save you from ransomware.
- Wowfunhappy 5y ago
  Why did those machines have uncovered USB ports?
  - zamadatix 5y ago
    Which machines? The medical device? They didn't, WannaCry would spread over the LAN to the systems silently then when the vendor came to do maintenance on a system or an upgrade they would become a transport vector between sites. Generic? Because limiting college computers to only be able to work on what you can type into each one you visit makes them relatively useless and creates a much larger burden than managing security.
elevation 5y ago
Full internet isolation is an underrated solution for critical systems. And it doesn't mean the students or staff themselves can't use the internet via mobile devices or school-issued netbooks -- only that the critical data systems themselves aren't accessible online. Another helper technology that's underused is data diodes, which prevent two-way connections but allow one-directional data flows, such as security updates for a lab full of workstations, or in the other direction, allowing internet monitoring of a source-of-truth or sensor while preventing internet tampering. Unfortunately, distributed orgs can't as easily benefit from air gaps and data diodes, but they're effective tools when your physical boundaries align with your security boundaries such as in a lab or around a campus.

jacobr1 5y ago

The problem is that much (not all) the business important data is involved the public internet. Take this school for example - prospective students applied online. One could imagine sneaker-netting the application data to an airgapped network, but that introduces its own costs and risks. Email (or other messages systems like slack) are one of primary tools of business, facilitating communication within an organization. You can't do that well with an air-gapped network, except to make that network really leaky.

Wowfunhappy 5y ago
I totally get it, but the internet hasn't been around that long. How did we handle this 30 years ago? I imagine students applied via snail mail, and then someone manually entered the information into a database. There's no reason to go back to paper applications, and that database should absolutely be digital—but I think we could do a lot more manual entry.
- MandieD 5y ago
  25 years ago: carefully hand-write half-page essays on pre-printed application forms, attach $50 checks for application fees, beg your mother to drive your procrastinating self to the downtown post office by 5pm on December 31. Start receiving long-awaited envelopes around Spring Break, and speculate on whether said envelopes were thin because they contained simple rejection letters, or because the desired financial aid details would follow the next week.

zamadatix 5y ago

Having worked in healthcare up until very recently I can assure you a bunch of unpatched XP machines connected via LAN will still be rampantantly infected regardless if they have access to the internet. Wannacry was just absolutely rampant on these systems for years. At the same time the publicly inbound accessible servers in the DMZ never had an issue because we were actually able to manage the security controls on those. The LAN is a much more used attack vector than the internet. It has nothing to do with some hacker sitting there banging at your door users just share files and reuse devices as part of their day to day effort. The instant someone in the college brings in a compromised USB, intentionally or unintentionally, all of the isolation in the world from the internet doesn't save you from ransomware.

Wowfunhappy 5y ago
Why did those machines have uncovered USB ports?
- zamadatix 5y ago
  Which machines? The medical device? They didn't, WannaCry would spread over the LAN to the systems silently then when the vendor came to do maintenance on a system or an upgrade they would become a transport vector between sites. Generic? Because limiting college computers to only be able to work on what you can type into each one you visit makes them relatively useless and creates a much larger burden than managing security.

elevation 5y ago

Full internet isolation is an underrated solution for critical systems. And it doesn't mean the students or staff themselves can't use the internet via mobile devices or school-issued netbooks -- only that the critical data systems themselves aren't accessible online. Another helper technology that's underused is data diodes, which prevent two-way connections but allow one-directional data flows, such as security updates for a lab full of workstations, or in the other direction, allowing internet monitoring of a source-of-truth or sensor while preventing internet tampering. Unfortunately, distributed orgs can't as easily benefit from air gaps and data diodes, but they're effective tools when your physical boundaries align with your security boundaries such as in a lab or around a campus.