Re: [Fwd: Question]

Marcus J. Ranum <[email protected]> wrote:


.d.
> I just love the way that any person with a brain who
> encounters this internet security stuff can immediately
> cut to the core of the problem as Olaf does below:


A lot of it doesn't require us to actually show up and write a thesis to fix, that's for sure.  But the real answer for Olaf is twofold, sure, part one is a knee-slapper but part two is a chin-scratcher:

1/  They shouldn't be but someone screwed up.

and/or

2/  If it's not a screwup (HMI with a live modem, etc...) then it may be that the control system network is connected to the corporate network, and that one is connected to the Internet.  Even where this is absolutely necessary for business purposes, and has been implemented at least reasonably well, it is at best a struggle between those who want to protect and those who want to disrupt.  Frankly, many of these sites have not put enough effort into security to compensate for their busines needs for external connectivity.

It's not as simple as saying "they shouldn't be connected to anything".  Beyond nuke generation (which is very much not connected to anything) you have hundreds of thousands of control system networks in the country and running each of these in air-gap isolation is not something that has been economically viable.   The number of sites that can be completely isolated will always be a minority, the rest we will need to do better with.

-chris

>> From:     Olaf S <lightdesigner@---->


> So, I'm watching a piece on the news this morning that "hackers" from
> China, Russia, Korea and maybe others have got into the computers that
> control the electrical grid.  My question is why the fuck are these
> computers connected to the internet?