Why are our water and power utilities connected to the internet? Is it so that the employees controlling them can work from home? If so they are accepting too much risk relative to the benefit.
The water and power utilities are themselves large distributed systems. They need communications between elements just to function properly. They don't exist in a single location where people can go locally manage them in some air-gapped, offline fashion.
There is no option of not having a communication network to monitor and manage these geographically distributed elements. The question is which communication network you would use, and how you would secure it. Whether it is telephones, radio links, or people running around as messengers, it is still a communications network.
Will some "dedicated" network be any safer? If anything, I imagine the fantasy of a private network will lead to even less security. You cannot physically secure the entire signal path. You really need to treat it as untrusted and build your security on top with encryption, authentication, authorization, etc.
The problem of secure networking has been solved long ago but there is no incentive for OT solution architects to get it right.
Infrastructure usually has a long lifetime.
Things become much more vulnerable as time rolls on e.g. we should be worried about AI hacking of smart meter firmware (hard to secure and expensive to upgrade).
Today's secure system is tomorrow's insecure system. E.g. https://news.ycombinator.com/item?id=49413320 :
Finally, I poked at something that wasn’t connected over USB but WiFi instead, the Elgato Key Light Mini. This one turned out to be way more interesting than I expected: it’s the only one with meaningful firmware integrity protection.
Unfortunately, while that’s an improvement over all of the other devices we’ve looked at, it protects the firmware at exactly one point in time: when an update is happening. It’s not a boot time check enforced by the bootloader or any other kind of secure boot scheme, and the updater happens to be running while everything else in the device is still operating, meaning there’s huge attack surface to try to disable that signature validation. I asked Claude to look for an exploit that might enable this, and it found a doozyFor power I can understand. For water supply it is harder to understand. Does water supply have similar characteristics to power, for example can you turn on a reservoir when there is an “outage” in another?
Remote management has clear benefits, don’t be obtuse. I totally agree on the security risks, but the benefits are obvious.
a virtual network built upon the regular internet is much easier.
And yes, mostly done wrong
I asked because of books I had read about the bad ones, where unsecured industrial control protocols were exposed wirelessly , or via vpns. And I’ve been curious if any good ones are out there .
You could absolutely make the case that it isn't worth the risk, but that isn't the same as not having benefits.