The current trend goes to make every device accessible from the Internet for convenience, economic reasons and so on (sometimes even including the control station of a power plant).
But many industrial solutions like SCADA systems, Motor Control Units of cars, industrial robots, railway control, medical devices like X-ray machines, and so on run not updated for decades because:
- The manufacturer does not provide updates
- Updates would require revalidation/recertification (internal or by an external organisation/governmental authority)
- Updates are not allowed (manufacturer officially supports only a specific patch-level of the underlying OS, and so on)
- "Never change a running system" (especially if the update might cause life threatening situations/liabilities)
- From some insiders of these branches I heard that some of them are only allowed to use compilers 5 years or older, because this way they think about all bugs in the compiler are found in the 5 years and use the official list of bugs of that compiler and use the workarounds for them.
Running Windows NT 4 is not unheard of in these environments for these reasons.
My first step would have been to use HTTPS/SSL to secure the channel but most of us have heard of Heartbleed, POODLE, Diginotar, etc. which require updates within days or faster. But this would be impossible because revalidation normally takes weeks or months and leaves the system vulnerable in the meantime. Next there could be vulnerabilites in the network-stack, authentification, and other subsystems.
So how would one design security in Internet/network-facing industrial devices running for decades where malfunctions could cost lives?
(This is just a hypotethical question since I am not involved in developing such devices and the insiders I know could not answer my questions. This question mainly focuses on the embedded device or the computer/device controlling the device and an attacker trying to gain access to it/control it.)