@phae@jonty one of my old housemates at uni was a massive caner and the least reliable person I’ve ever met, so it was somewhat surprising to hear he’d trained as an air traffic controller. I think about this whenever I fly. He was quite good at Monkey Target tho?
@red@jonty assess critical infrastructure and industrial control systems for security issues, they said. it'll be interesting and rewarding, they said.
@gsuberland@jonty wait wait wait you’re saying I’m not meant to put the AIS, GNSS, RADAR and bridge instrumentation for an FPSO on a common DMZ network using moxa unmanaged switches so that it’s easier to make them all communicate?
@red@jonty network encapsulated NMEA traffic bridged onto the IT network with no filtering? VDR from 20 years ago running Windows XP, with a known hardware fault that causes the PSU to catch fire under unusually high load? I'm sure it's all fine, it's only a checks notes LPG tanker full of flammable gas.
@gsuberland@jonty you’ll be glad to hear that in the last decade I’ve seen huge leaps forward in network design and security in the energy industry.
Fiber to the platform and wind farm was a generational shift big enough for the majors to realise that they weren’t secure by default and that good design starts on paper years before and is included all the way through.
The usual human factors still exist though, and the companies that aren’t keeping up with the best in the field are definitely numerous.
@red@jonty I spent a lot of the last 5 years doing operational technology assessments on marine & offshore, so can definitely agree there. It used to be dire, but the push for remote monitoring and emergency access systems (plus new regs from the IMO) have really gotten people to pay attention. vendors are still a bit behind the times, but the actual network segmentation and patch management stuff got a lot better.
@red@jonty ICS/SCADA on land is still a total mess though. I find half a dozen RCEs and safety system bypasses in the (usually bloated) middleware on an average test. Lots of stuff architected insecurely from the ground up so it's near impossible to fix. Sorta goes to show that you need external regulators to set mandates for security, otherwise nobody bothers.
Add comment