Re: Telnet and FTP to Historic

[Keith Moore <[e-mail]>]

On 12/3/20 3:45 PM, Phillip Hallam-Baker wrote:

>
>     For that matter not even "air gapped" networks are really safe.
>     There's
>     almost always some laptop or other that occasionally connects to such
>     networks, and malware can creep in that way.
>
>
> There are viable controls but they are very expensive. At VeriSign we 
> constructed a tier 6 SOC and kept the machines that perform offline 
> operations in a very pricey safe along with the HSMs (see the CPS 
> which documents all of that).

Yes but this is a far cry from the typical "air gapped" LAN which is an 
Ethernet switch or WiFi access point that just doesn't happen to have an 
upstream link (most of the time).

And for most sites the kinds of measures you employed at VeriSign (glad 
you did!), or really anything more than perhaps an extra lock on the 
gate or door, would be prohibitively expensive.

I know of sites that are part of critical infrastructure, on concrete 
pads in the middle of nowhere, surrounded by a chain link fence (if 
that).   The fence is just to keep the nearby cows out.

Keith