Islanding vs server lockdown

Question

TL;DR:

We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the internet and/or other computers? We'd only need HTTPS access to the server -- what settings/policies/rules should we set on the server to maximize security?

---

We're a small manufacturing company and in our building we have two sections: the office area and the manufacturing area. Last year we got hit by a virus that took down our manufacturing for almost three days, so we've been considering completely disconnecting the manufacturing side from all access to the outside world. The only thing the manufacturing computers are used for is our Enterprise Resource Planning system, -- tracking all our inventory, sales, etc. We're not planning on changing the connectivity of our office computers, as we need to use those for business related stuff, so when I say "our computers," I'm talking about our manufacturing computers.

Note: While the ERP system that we use is old, and was originally designed for Windows 98/XP, we now run it on Windows 7/10 exclusively. The virus last year happened before we made that transition, while we were still using Windows XP machines.

Option 1: Islanding

We currently use an (ancient) ERP system that runs locally on each machine, and connects to a server for SQL access. The first option we're considering is to continue using this system, and eventually upgrade to a system that works the same way -- local install, connect to server for DB access. All our machines would only connect to the server, and the server would only connect to the machines. Basically as off-the-grid as possible.

Pros:

• Very hard to get a virus through the internet. I'd say impossible, but I've gotten bit before for that word...
• For lack of a second bullet point, I'd like to reiterate that the above point is a big deal. We don't often get viruses, but we also don't like it when production goes down.

Cons:

• More work to get Windows Updates installed (in fact, the updates likely won't get installed on a regular basis -- maybe once a year). The upside here is that hopefully they won't need to get installed.
• A LOT harder to communicate between our office (sales) people and the manufacturing people. Having the server disconnected from the office area computers would mean we would need either separate computers for entering sales orders, or we'd need to have the sales people go back to the manufacturing area to enter each sale.
• We'll probably need separate servers (VMs, of course) for the office environment to run DNS, Active Directory, DHCP, etc.
• Still vulnerable to any physical access based attacks (USB drives)
• The machines are hard(er) to replace - we need our software installed, and it only runs on 32 bit Windows (originally designed for Windows 98 :|).

Option 2: HTTPS only access to server (local webapp)

This is what I personally am leaning toward, for non-security reasons. This would be a slightly bigger change (since we'd need to re-do our ERP system), but eventually we'll have to do that anyway. It might not be much bigger of a deal than dealing with not being able to communicate with sales. In the meantime, we'd probably leave the computers as they are now, in their unsecured state. (Well, not unsecured, but we wouldn't temporarily do option 1 due to the communication headache that would be.) The key here is that we'd really lock down our server, and the other devices would be treated as untrusted. (Hopefully a bit of locking down on the computers as well, but they'd be much more replaceable.) The computers still don't necessarily have access to the outside world directly, but they're connected to the server which will be connected to the outside world.

Pros:

• We'll be able to connect the sales people to the manufacturing people easily (both the manufacturing and office would have access to the local web app).
• The manufacturing computers are much more replaceable -- all they need is a web browser. If one of them gets infected or dies or stops working for reason x, we can replace it with a laptop (or iPad or something) until we can fix the computer.
• Updates will be easier if not simple. We could add some firewall rules to the server maybe to let Windows Update work.
• The design of our system will be a lot easier: we won't need separate servers for the office environment to run DHCP, Active Directory, DNS, etc.
• Maybe not as vulnerable to USB-drive attacks (obviously we don't expect our employees to purposefully insert bad USB drives, but they definitely could accidentally.

Cons: - The server(s) is(are) still connected to the internet (they will be running Active Directory, DNS, company email, DHCP, and SQL Server, as well as this web app, which will probably use PHP and IIS).

The Question

How much more secure is option 1 over option 2? We're not expecting nation-state actors to be hacking our system, but the antivirus company we use had to make a custom solution for the virus we got last year, so we do want to take security seriously. I'd also like tips on what we could do to make each solution more secure (e.g. firewall options to set, policies, tools, etc.).

Answer 1

Option 1 is considerably more secure. You want to do everything you can to keep old computers off the net directly. XP and prior are highly vulnerable, especially considering you patch yearly. If you absolutely must use them, keep them air-gapped. Difficulty communicating with sales is worth the trade off for production going down, and it will certainly happen again as long as you have PC's that old. Consider getting a single laptop using your office LAN for your workers to share or something - this might alleviate the difficulty.

It sounds like moving to 2 is a better approach long-term, but not until you have had a proper tech refresh. Setting up XP and Win98 computers on a net is asking for trouble. They are no longer supported and vulnerabilities are still coming rolling out like clockwork (chiefly because so many people still use them!).

You would probably want to use an extra firewall and DMZ in option 2, but that looks to be a more efficient solution AFTER you have done some upgrades.

These two things are contradictory -

In the meantime, we'd probably leave the computers as they are now, in their unsecured state. (Well, not unsecured, but we wouldn't temporarily do option 1 because of the Cons section.)

and

We don't often get viruses, but production going down is not an option.

If production going down is not an option, stick with 1 and make option 2 for FY2019 plan. I cannot emphasize this strongly enough - The risks of having another attack if you don't keep it air-gapped is very high.