New ideas are popping up. I started with fridges because of the recent attacks, but the code makes it easy to add personas. Electric car charing stations and coffee machines were my initial idea, but HVAC and building controllers are probably better ideas. Thanks!
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team.
If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default.
One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed.
Hopefully this is a wakeup call for the industry.
> Hopefully this is a wakeup call for the industry.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.
My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting).
In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets.
My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.
What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.
reply