It’s really surprising what you hear in M2M (Machine-to-Machine) groups. Last time I read an unbelievable data point:
55,000 air-condition or heating systems are connected to the Internet without adequate (or any) protection
Due to my job, my first impression was, “That’s a hoax.” Right now, I’m deep in constantly improving the security of connections on topics like wireless (e. g. IMSI catcher) or regulations on length of an encryption key. After reading some other articles in German magazines I learned some companies simply:
Connect by SSH and enable port forwarding and you are in the company’s network!
Am I the only one considering security as a holistic approach?
Imagine you start adding a backdoor to your company’s network – say OPENVPN on Port 443. You set -up authentication with the username “USER” and the password “PASSWORD”. What do you think your IT people will do to you once they find out? Of course it depends on your company’s policy, but in some cases you may lose some private money due to “gross negligence”.
At the same time, the heating system suppliers are talking about the risk of setting the wrong temperature. So we will sweat! From my point of view they’re making a big mistake: Even if the hacker destroys the entire heating system, no real big harm is done to the company itself. However, by a backdoor like this you are internal to the protected network. Many precautions might not work in this case. Imagine if someone could erase all servers including the mirrors most companies tend to use today instead of real backup. Rotating storage is too cheap compared to DLT drives. The latest backup that was done may be a week old, and from my experience, you always learn in cases like this the important data which is missing is in the backup.
So at least the work of e. g. 1000 people for one week is lost forever.
Some might know my position to this:
If you still use the cheapest possible controller with a homebrewed OS for safety-critical applications, safety itself will have the lowest priority!
And in many projects, I know the feature with the lowest priority was never implemented due to time pressure.
Make a comment below on your ideas of how to avoid things like this in the future while still considering usability. The only thing I’m sure of is that open ports are not helpful.
{{comment.comment}}