5 ms·

When you reach a certain size of HVAC system it is common for the dealer to regularly service the system and proactively monitor it. This requires access to the

by jauer 13y ago

When you reach a certain size of HVAC system it is common for the dealer to regularly service the system and proactively monitor it. This requires access to the controllers to see a pump has failed, coolant pressure dropped, etc. They should have ordered a stand-alone Internet connection for such things but probably figured they'd save the money and use the existing network connection.

Shivetya 13y ago
the real problem here is that they should have had two distinct networks, one for their payment system that is wholly separate from all other network activity. Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated.
- VLM 13y ago
  "Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated." Not really, you've got a store manager who wants instant access to the same refrigeration alarms and control system his vendor sees and live sales figures all from the same PC. I can totally see it happening. Wholly unrelated would be the Target store manager (or district mgr or whatever) having access to Walmarts backup generator telemetry.
ericcumbee 13y ago
Really all they would need is a VLAN and a proper set of ACLs.
- deleted 13y ago
  [deleted]
- jessaustin 13y ago
  It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Defense at the perimeter only is flawed, especially when the perimeter is the only thing protecting cash registers that update with unsigned firmware. One wouldn't connect such a client directly to the internet, so neither should one connect it directly to a network shared by millions of devices at 1700 stores.
  - bdunbar 13y ago
    > It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Exactly this. I realized this a few years ago, at a previous employer. We had _excellent_ security at the firewall boundary. Inside the network gave me cause for concern. Once could plug into any port, in any building, get an IP address and ping anything on our network. And how good was site security at a given location? Who knew, really. When your server's security depends on J. Random Employee not allowing tail-gaters at the back door ... you got problems.
- toomuchtodo 13y ago
  ACLs don't go far enough. You need an air gap. Chances of ACL/VLAN configuration failures are higher than someone purposely connecting a patch cable between networks.
  - jessaustin 13y ago
    What does this mean? Do you envision Target leasing dark fiber to connect all their stores, even those that aren't within ten miles of a POP? Because that isn't going to happen, for reasons, and without it they can't eliminate VLANs at some level. It's more practical to realize that VLAN configs should be regularly updated and tested.
    - toomuchtodo 13y ago
      > Do you envision Target leasing dark fiber to connect all their stores, even those that aren't within ten miles of a POP? Do you remember the days of T1s and private lines? You can actually get a dry loop (a DSL line with no service, just twisted pair between two points) for $50-100/month depending on the distance between termination points. I'm not suggesting we go back to that level of network segregation though for branch offices. The intention of my comment was to communicate that when an outside vendor needs internet access for remote access/control/etc, you provide it to them via a separate physical network. In this case, it could have been a seperate switch with a DSL or LTE connection. PCI standards don't require a separate payments-only network, but would you put remotely accessed gear on your internal network if it was handling payments data? Target liability is estimated at ~$450 million and climbing. >It's more practical to realize that VLAN configs should be regularly updated and tested. I agree with this point. The reality is, it rarely happens as often as it should, if at all. If your policy isn't enforced programmatically and with checks/balances, it doesn't exist.
      - jessaustin 13y ago
        I'm not suggesting we go back to that level of network segregation though for branch offices. We agree! My point was just that, even if there are physically separate networks within the store (and who knows, that might make sense in some cases...) all of those networks will connect in some fashion to the internet, so the air gap doesn't really exist. You can eliminate some onsite vlan'ing by running more cable, but as long as Target wants to be able to administer cash registers from far away, they'll need some sort of VPN setup, and you're right back where you started.
deleted 13y ago
[deleted]

by jauer 13y ago

Shivetya 13y ago

the real problem here is that they should have had two distinct networks, one for their payment system that is wholly separate from all other network activity. Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated.

VLM 13y ago
"Its boggling to me that any company would permit another company on the same network when their work is wholly unrelated." Not really, you've got a store manager who wants instant access to the same refrigeration alarms and control system his vendor sees and live sales figures all from the same PC. I can totally see it happening. Wholly unrelated would be the Target store manager (or district mgr or whatever) having access to Walmarts backup generator telemetry.

ericcumbee 13y ago

Really all they would need is a VLAN and a proper set of ACLs.

deleted 13y ago
[deleted]
jessaustin 13y ago
It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Defense at the perimeter only is flawed, especially when the perimeter is the only thing protecting cash registers that update with unsigned firmware. One wouldn't connect such a client directly to the internet, so neither should one connect it directly to a network shared by millions of devices at 1700 stores.
- bdunbar 13y ago
  > It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Exactly this. I realized this a few years ago, at a previous employer. We had _excellent_ security at the firewall boundary. Inside the network gave me cause for concern. Once could plug into any port, in any building, get an IP address and ping anything on our network. And how good was site security at a given location? Who knew, really. When your server's security depends on J. Random Employee not allowing tail-gaters at the back door ... you got problems.
toomuchtodo 13y ago
ACLs don't go far enough. You need an air gap. Chances of ACL/VLAN configuration failures are higher than someone purposely connecting a patch cable between networks.
- jessaustin 13y ago
  What does this mean? Do you envision Target leasing dark fiber to connect all their stores, even those that aren't within ten miles of a POP? Because that isn't going to happen, for reasons, and without it they can't eliminate VLANs at some level. It's more practical to realize that VLAN configs should be regularly updated and tested.
  - toomuchtodo 13y ago
    > Do you envision Target leasing dark fiber to connect all their stores, even those that aren't within ten miles of a POP? Do you remember the days of T1s and private lines? You can actually get a dry loop (a DSL line with no service, just twisted pair between two points) for $50-100/month depending on the distance between termination points. I'm not suggesting we go back to that level of network segregation though for branch offices. The intention of my comment was to communicate that when an outside vendor needs internet access for remote access/control/etc, you provide it to them via a separate physical network. In this case, it could have been a seperate switch with a DSL or LTE connection. PCI standards don't require a separate payments-only network, but would you put remotely accessed gear on your internal network if it was handling payments data? Target liability is estimated at ~$450 million and climbing. >It's more practical to realize that VLAN configs should be regularly updated and tested. I agree with this point. The reality is, it rarely happens as often as it should, if at all. If your policy isn't enforced programmatically and with checks/balances, it doesn't exist.
    - jessaustin 13y ago
      I'm not suggesting we go back to that level of network segregation though for branch offices. We agree! My point was just that, even if there are physically separate networks within the store (and who knows, that might make sense in some cases...) all of those networks will connect in some fashion to the internet, so the air gap doesn't really exist. You can eliminate some onsite vlan'ing by running more cable, but as long as Target wants to be able to administer cash registers from far away, they'll need some sort of VPN setup, and you're right back where you started.

deleted 13y ago

[deleted]