5 ms·

Which is why we have air gapped OT networks. Critical systems like this shouldn’t even be reachable remotely. The slight convenience of remote troubleshooting

by tw04 3y ago

Which is why we have air gapped OT networks. Critical systems like this shouldn’t even be reachable remotely. The slight convenience of remote troubleshooting isn’t worth it. Plus there are solutions out there to only temporarily and securely bridge the gap if it’s an absolute necessity.

bagels 3y ago
That won't save you if the attacker crosses the gap. Someone did this to Iran's centrifuge controllers.
lisper 3y ago
> Which is why we have air gapped OT networks. Which is why compromised USB thumb drives are a thing. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- tw04 3y ago
  You're talking about a several orders of magnitude difference in attack vector. Yes, a motivated nation-state actor willing to put literally ALL of their resources into attacking you will probably find a way to get it done whether through cyber-attack or just dropping a bomb on your head. Air-gapping your OT network protects the average company from 99.99999% of threat actors. If you're attempting to create nuclear weapons and a western nation is trying to stop you, you're either going to be compromised or murdered. That doesn't mean Bob's metal stamping should put the IOT controllers for his steel presses onto the public internet.
  - deleted 3y ago
    [deleted]
  - lisper 3y ago
    You are making a logical fallacy here. Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. Just because there is a noteworthy case of such an attack being mounted by one nation-state against another doesn't mean that a state actor is required to mount such an attack.
    - tw04 3y ago
      And how are you planning on getting a USB drive from Russia onto an air-gapped steel press in the US? It is several orders of magnitude more difficult to get malware onto an air-gapped network on the other side of the world that you know absolutely nothing about than to attack it when it's connected to the internet. How are you reconning what actual PLCs Bob is using? How do you know what versions are on those controllers? How do you even know the address of someone who works in a position that has physical access to the OT network in the first place? I'm not using a logical fallacy, you're pretending that Stuxnet is applicable to the average business and it just isn't for a dozen reasons I can think of and probably 2 dozen I can't.
      - lisper 3y ago
        Re-read what I wrote: Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. > And how are you planning on getting a USB drive from Russia onto an air-gapped steel press in the US? Why does such an attack have to originate from Russia? > you're pretending that Stuxnet is applicable to the average business No, you have missed the point. Stuxnet shows that a USB attack can succeed even against a state actor. It does not show that a state actor is necessary to mount such an attack.
        tw04 3y ago
        >Re-read what I wrote: Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. And you're basing this on what? All of the OT networks I deal with are physically secured. You're swiping a badge and being recorded before you get anywhere near the production floor. >Why does such an attack have to originate from Russia? Because someone in the US compromising an OT network with ransomware is going to prison for a LONNNNG with little to nothing to gain from it? >No, you have missed the point. Stuxnet shows that a USB attack can succeed even against a state actor. It does not show that a state actor is necessary to mount such an attack. Go ahead and link some of the OT environments you've seen compromised by USB drive in the US. I work in the industry, you're going to be searching a lonnnnnnnnnnnnnng time to produce more than about 2 and both the ones I'm aware of were insiders who were immediately caught.
deleted 3y ago
[deleted]

by tw04 3y ago

bagels 3y ago

That won't save you if the attacker crosses the gap. Someone did this to Iran's centrifuge controllers.

lisper 3y ago

> Which is why we have air gapped OT networks. Which is why compromised USB thumb drives are a thing. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet

tw04 3y ago
You're talking about a several orders of magnitude difference in attack vector. Yes, a motivated nation-state actor willing to put literally ALL of their resources into attacking you will probably find a way to get it done whether through cyber-attack or just dropping a bomb on your head. Air-gapping your OT network protects the average company from 99.99999% of threat actors. If you're attempting to create nuclear weapons and a western nation is trying to stop you, you're either going to be compromised or murdered. That doesn't mean Bob's metal stamping should put the IOT controllers for his steel presses onto the public internet.
- deleted 3y ago
  [deleted]
- lisper 3y ago
  You are making a logical fallacy here. Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. Just because there is a noteworthy case of such an attack being mounted by one nation-state against another doesn't mean that a state actor is required to mount such an attack.
  - tw04 3y ago
    And how are you planning on getting a USB drive from Russia onto an air-gapped steel press in the US? It is several orders of magnitude more difficult to get malware onto an air-gapped network on the other side of the world that you know absolutely nothing about than to attack it when it's connected to the internet. How are you reconning what actual PLCs Bob is using? How do you know what versions are on those controllers? How do you even know the address of someone who works in a position that has physical access to the OT network in the first place? I'm not using a logical fallacy, you're pretending that Stuxnet is applicable to the average business and it just isn't for a dozen reasons I can think of and probably 2 dozen I can't.
    - lisper 3y ago
      Re-read what I wrote: Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. > And how are you planning on getting a USB drive from Russia onto an air-gapped steel press in the US? Why does such an attack have to originate from Russia? > you're pretending that Stuxnet is applicable to the average business No, you have missed the point. Stuxnet shows that a USB attack can succeed even against a state actor. It does not show that a state actor is necessary to mount such an attack.
      - tw04 3y ago
        >Re-read what I wrote: Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. And you're basing this on what? All of the OT networks I deal with are physically secured. You're swiping a badge and being recorded before you get anywhere near the production floor. >Why does such an attack have to originate from Russia? Because someone in the US compromising an OT network with ransomware is going to prison for a LONNNNG with little to nothing to gain from it? >No, you have missed the point. Stuxnet shows that a USB attack can succeed even against a state actor. It does not show that a state actor is necessary to mount such an attack. Go ahead and link some of the OT environments you've seen compromised by USB drive in the US. I work in the industry, you're going to be searching a lonnnnnnnnnnnnnng time to produce more than about 2 and both the ones I'm aware of were insiders who were immediately caught.

deleted 3y ago

[deleted]