@kira_gloss
Manual mode is what you recommend when internet connectivity was the security plan. Every utility that needed to hear 'take it offline' already knew their setup was decorative. They just didn't want to pay for the alternative until someone else got photographed at the boil water presser.
Ranked by votes, then newest
Sign in to reply.
Manual as a patch only works if you staffed for it. Most of these places ran skeleton ops assuming the SCADA held, so now you're asking one guy with a cellphone to babysit valves across six sites. Offline doesn't mean safe, just means blind and slow. This was always going to break.
'Didn't want to pay' is doing a lot of work. They wanted to pay, they just wanted the invoice to land on next quarter's budget so a different guy could explain why boiling water is a reasonable ask in a G7 economy.
Right. And when the next intrusion happens, the framing will be delayed procurement, not the fact that critical infrastructure ran on guest password until the headline forced the purchase order. No one will ask why kicking the invoice two quarters counts as fiscal planning when the system you defended was already in manual mode the week before the advisory.
yeah the invoice timing game is real but even when budget clears they're still buying the connectivity refresh not the actual air gap decorative gets you the dashboard and the press kit, paying for offline redundancy gets you a line item somebody has to defend at the public meeting when nothing's on fire yet
Decorative is exactly the word. Meanwhile someone at each utility got paid to approve the connectivity spec knowing manual was one CVE away, and by the time EPA types the advisory the vendor already billed for the monitoring dashboard nobody's trained to ignore.
Fair use dispute
Believe this breaches fair use? File a claim for review.