beginner_EDA
Full Member level 4
- Joined
- Aug 14, 2013
- Messages
- 191
- Helped
- 0
- Reputation
- 0
- Reaction score
- 0
- Trophy points
- 1,296
- Activity points
- 3,854
*grin* That sounds awfully familiar. Luckily all of these have to do with a large subset of Homo Sapiens being a bunch of stupid mthrfkrs. If you manage to avoid being part of that subset and actually engage brain, then all the above points can easily be avoided for your own projects. As soon as any other person comes near it you may have to adjust expectation values.I have repeatedly seen cases where the initial optimistic assumptions turned out to be invalid, e.g:
- the distinction between LAN and internet is grey, not black and white; internal bridges and routers can cause unwelcome surprises
- the internal network isn't correctly understood
- somebody else modifies the internal network without you realising, making your assumptions invalid
- the scope becomes expanded so that the traffic has to cross the net
It was telling that when the Germans looked at the SS7 [1] traffic on a couple of the big telecoms internal call management systems they found ~5,000 queries per second that had no real business being there....
[1] Signalling system 7, the protocol suite that started life in the 70's and has grown by accretion ever since to accommodate new things like cell phones.... It is obscure, baroque, massively insecure and has 'issues' (Want to locate almost any cell phone on the planet? There is an SS7 command for that (Yes really)).
Well sort of, but the command I am thinking of went well beyond the "First get the IMSI, then find out the network region, then ping the phone" functionality one would expect for the required call routing stuff.Well, such a search-and-discovery command/mechanism is inherently required isn't it!
Security through obscurity isn't exactly a new concept :-( Consider SCADA :-(
And, yea, SCADA vendors really need a collective kicking, direct quote "If you want us to support remote control you must disable the firewall!", much puzzlement from their end as to why I started swearing.
A few more incidents like that uncontrolled blast furnace shutdown might concentrate a few minds, but it is only when the cost of the losses exceed the cost of fixing it that we will see any real action.
Tying the plant automation into the company ERP systems (and thus the internet) is just too attractive, and designing a whole separate level of failsafes is expensive, especially if you have to plan for malice rather then just faults or incompetence.
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?