Hacker News Reader

Comment by an_taeus | Hacker News Reader

They are all being sold on the idea of granting external access to a cloud application so that a third-party contractor can know when the system goes into disarray and pay for one less maintenance guy's salary.

Could the same thing be done with SMTP way more securely than opening up your firewall to some random AWS EC2 instance? Yeah no doubt.

Do you think grocery retail execs actually understand computers past Microsoft Word and Excel? I report to one, they can barely listen to me say the word WAN failover.

Like all things in IT, experience is the best teacher. Organizations will fail to invest in their technology, security included, and only then will the execs start to trust that the wizards in the backroom are telling them truths instead of asking for new toys - if they're lucky enough to still be the same exec that heard they should take security seriously before the Bad Thing happened.

View on HN

In that case it's just a tradeoff between convenience and security, it isn't because it would be too technically difficult to isolate the systems. Whoever installed them could isolate them if there was no reason for them to be connected to the internet. I doubt most grocery store managers understand the precise engineering behind their freezers either, but they still buy them.

Very likely they were sold on these internet-connected systems without being told about the drawbacks, which is sad.

I never said technically difficult - as in impossible. Just harder. And more costly.

It’s more costly to do it properly, so most don’t.

The people selling the systems often don't fully know the downsides themselves either and in a sense they're incentivized to not know as it makes it easier to sell the lie that there are no drawbacks to having your HVAC system exposed to the wider web. But you are also overestimating the average skill of an IT person in these environments and the capacity for their IT or MSP team to step back and evaluate the security of all the systems they have to manage. There's only the ability to evaluate convenience vs security if you actually have the time to formulate the question - if you're drowning in ticket submissions you will likely fail to properly catch every such issue. Certainly for these larger EU corps they should have the capacity to make those determinations, but who knows exactly how the management of these systems were delegated. My bet would be it was the responsibility of an under-resourced team with too much to do already.

I'm catching issues as I can as the head of IT at an org replacing our Danfoss systems with something else, but it wasn't until about 1.5 years since the initial decision to replace them that I'm finding out from a sub-contractor of the contractor that there's a cloud app our HVAC network will need to talk to - which is not-so-funnily enough a requirement by the state for us to receive associated grant funding for a portion of the new system cost. This was never mentioned to me at all as the head of IT. It's not even a convenience vs security issue, it's a misaligned corporate communications and approval channels issue. In other words, the capacity to secure your technical systems is downstream of political organization.

> They are all being sold on the idea of granting external access to a cloud application so that a third-party contractor can know when the system goes into disarray and pay for one less maintenance guy's salary.

Even in that case there is zero reason for the devices to be reachable from outside the network rather than the devices reaching out to known hosts only.

that is harder to manage, and more brittle. hence more expensive. that is the reason.

Reply on news.ycombinator.com