1

TL;DR:

We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the internet and/or other computers? We'd only need HTTPS access to the server -- what settings/policies/rules should we set on the server to maximize security?


We're a small manufacturing company and in our building we have two sections: the office area and the manufacturing area. Last year we got hit by a virus that took down our manufacturing for almost three days, so we've been considering completely disconnecting the manufacturing side from all access to the outside world. The only thing the manufacturing computers are used for is our Enterprise Resource Planning system, -- tracking all our inventory, sales, etc. We're not planning on changing the connectivity of our office computers, as we need to use those for business related stuff, so when I say "our computers," I'm talking about our manufacturing computers.

Note: While the ERP system that we use is old, and was originally designed for Windows 98/XP, we now run it on Windows 7/10 exclusively. The virus last year happened before we made that transition, while we were still using Windows XP machines.

Option 1: Islanding

We currently use an (ancient) ERP system that runs locally on each machine, and connects to a server for SQL access. The first option we're considering is to continue using this system, and eventually upgrade to a system that works the same way -- local install, connect to server for DB access. All our machines would only connect to the server, and the server would only connect to the machines. Basically as off-the-grid as possible.

Pros:

  • Very hard to get a virus through the internet. I'd say impossible, but I've gotten bit before for that word...
  • For lack of a second bullet point, I'd like to reiterate that the above point is a big deal. We don't often get viruses, but we also don't like it when production goes down.

Cons:

  • More work to get Windows Updates installed (in fact, the updates likely won't get installed on a regular basis -- maybe once a year). The upside here is that hopefully they won't need to get installed.
  • A LOT harder to communicate between our office (sales) people and the manufacturing people. Having the server disconnected from the office area computers would mean we would need either separate computers for entering sales orders, or we'd need to have the sales people go back to the manufacturing area to enter each sale.
  • We'll probably need separate servers (VMs, of course) for the office environment to run DNS, Active Directory, DHCP, etc.
  • Still vulnerable to any physical access based attacks (USB drives)
  • The machines are hard(er) to replace - we need our software installed, and it only runs on 32 bit Windows (originally designed for Windows 98 :|).

Option 2: HTTPS only access to server (local webapp)

This is what I personally am leaning toward, for non-security reasons. This would be a slightly bigger change (since we'd need to re-do our ERP system), but eventually we'll have to do that anyway. It might not be much bigger of a deal than dealing with not being able to communicate with sales. In the meantime, we'd probably leave the computers as they are now, in their unsecured state. (Well, not unsecured, but we wouldn't temporarily do option 1 due to the communication headache that would be.) The key here is that we'd really lock down our server, and the other devices would be treated as untrusted. (Hopefully a bit of locking down on the computers as well, but they'd be much more replaceable.) The computers still don't necessarily have access to the outside world directly, but they're connected to the server which will be connected to the outside world.

Pros:

  • We'll be able to connect the sales people to the manufacturing people easily (both the manufacturing and office would have access to the local web app).
  • The manufacturing computers are much more replaceable -- all they need is a web browser. If one of them gets infected or dies or stops working for reason x, we can replace it with a laptop (or iPad or something) until we can fix the computer.
  • Updates will be easier if not simple. We could add some firewall rules to the server maybe to let Windows Update work.
  • The design of our system will be a lot easier: we won't need separate servers for the office environment to run DHCP, Active Directory, DNS, etc.
  • Maybe not as vulnerable to USB-drive attacks (obviously we don't expect our employees to purposefully insert bad USB drives, but they definitely could accidentally.

Cons: - The server(s) is(are) still connected to the internet (they will be running Active Directory, DNS, company email, DHCP, and SQL Server, as well as this web app, which will probably use PHP and IIS).

The Question

How much more secure is option 1 over option 2? We're not expecting nation-state actors to be hacking our system, but the antivirus company we use had to make a custom solution for the virus we got last year, so we do want to take security seriously. I'd also like tips on what we could do to make each solution more secure (e.g. firewall options to set, policies, tools, etc.).

  • Personally I'd avoid PHP, but that's not what you really need to worry about. For mitigation, I'd probably do 1 immediately, then move two 2 as possible. What I'm more curious about is how the virus got such a toehold on your network - it suggests that (other than user training), you may have configuration issues on the individual machines, or that the EPR itself is insecure (Which is why I recommended 1). – Clockwork-Muse May 17 '18 at 14:08
  • Well, we'll potentially be building the ERP system ourselves, so we could consider ASP.NET as well, but that won't necessarily be an option. The thing is, we can't do option 1 immediately, as the office needs access to the same database as the manufacturing area, and the office also needs internet access. Getting this system to work properly with option 1 could potentially take just as much work (and time) as option 2. The ERP could very well be insecure, being 10+ years old, but it doesn't (directly) connect to the internet, and when it does it uses TLS 1.2 to PayPal only. – Cullub May 17 '18 at 14:31
  • It's also possible we have (or had) configuration issues with the machines, especially since we just upgraded from Windows XP in the last year or so in the manufacturing area. Hopefully much better security now that we're running Windows 10 on most machines and 7 on the rest. – Cullub May 17 '18 at 14:34
  • ...if the office needs access to the same database, then locking down manufacturing alone isn't the answer, you have to do the office as well (as you've indicated). Perhaps one answer would be to virtualize both the server and all clients and remove all internet access from them (barring a specific firewall rule for PayPal), then have interested parties RDP into a machine. That would make recreating an ERP client trivial in the case of compromise, and possibly could make those VMs stateless to boot. Also, make sure your distributed machines aren't admins. – Clockwork-Muse May 17 '18 at 14:38
  • So the servers are already virtual machines. That's definitely an idea to virtualize the rest though. We can't lock down the entire office area per option 1, as we still need normal internet connectivity out here. The manufacturing user accounts definitely aren't admins. – Cullub May 17 '18 at 14:59
1

Option 1 is considerably more secure. You want to do everything you can to keep old computers off the net directly. XP and prior are highly vulnerable, especially considering you patch yearly. If you absolutely must use them, keep them air-gapped. Difficulty communicating with sales is worth the trade off for production going down, and it will certainly happen again as long as you have PC's that old. Consider getting a single laptop using your office LAN for your workers to share or something - this might alleviate the difficulty.

It sounds like moving to 2 is a better approach long-term, but not until you have had a proper tech refresh. Setting up XP and Win98 computers on a net is asking for trouble. They are no longer supported and vulnerabilities are still coming rolling out like clockwork (chiefly because so many people still use them!).

You would probably want to use an extra firewall and DMZ in option 2, but that looks to be a more efficient solution AFTER you have done some upgrades.

These two things are contradictory -

In the meantime, we'd probably leave the computers as they are now, in their unsecured state. (Well, not unsecured, but we wouldn't temporarily do option 1 because of the Cons section.)

and

We don't often get viruses, but production going down is not an option.

If production going down is not an option, stick with 1 and make option 2 for FY2019 plan. I cannot emphasize this strongly enough - The risks of having another attack if you don't keep it air-gapped is very high.

  • Note we no longer use XP computers. That was last year, and likely contributed to getting the virus, but we've upgraded to Win7 and Win10. We'd like to patch more, but realistically that's often how it works. – Cullub May 18 '18 at 3:35
  • Could you clarify what you mean by extra firewall and DMZ (third paragraph)? What machine would we put the extra firewall on? Also I'm really not familiar with the concept of DMZ -- I'll try to Google it, but if you had any suggested reading that would also be wonderful. – Cullub May 18 '18 at 3:40
  • 1
    I would start here security.stackexchange.com/questions/3667/… – SomeGuy May 18 '18 at 5:15
  • Win7 and Win10 are much better than XP, but I would still encourage you to find a workflow that allows for better patching. As a penetration tester, I can testify that missed patches make for much easier targets. – SomeGuy May 18 '18 at 5:28
  • 1
    All right -- I'll bring updates up with management (I'll be doing a report on this subject anyway, so that should fit in nicely ;)). Come to think of it, it's possible we already have a sonicwall appliance, but I'll do some research there as well. Is there a good read you can recommend for the differences between ASA's and Sonicwall appliances? Also, it looks like there are a million different versions of each (ranging from the $500 range to $4,000). What features should we be looking at? – Cullub May 18 '18 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.