Any systems experts out there that can tell me what is wrong with my thinking on this?
Not my line of work, but as noted in #4 my employer maintained a sneaker network. And I doubt that is still a viable approach?
Anything that involved money had ZERO connections, everything stayed in one room.
I imagine it would depend on the business model. I’m in IT and the company I work for would be crippled if everyone that works here didn’t have both internet and intranet access. Years ago we were hit by 3 of these attacks. 2 of them even involved the same user and yet they still refused to fire him.
The weakest point in any network will always be the users and no amount of security preparedness will make up for that. I can tell you how most of these infections occur.
At the time we had a modern, powerful and expensive firewall. It had a weakness though. It could not scan compressed email attachments. Our new firewall can. For that reason I requested that we block these types of attachments but it was determined by those with no IT knowledge that it was better to take the risk rather than teach our users and customers how to use FTP or Drop Box.
In every one of these cases an email was sent to an employee with a compressed attachment. The employee wouldn’t noticed the mangled English in the subject or body of the email. They would pay no attention to the fact that it was sent by someone we don’t do business with, nor would they notice the address was obviously (to IT anyways) spoofed. They would unzip the attachment and run it, also failing to notice that the file type was an executable.
The application would immediately start compressing every file it could find on the employees computer or any other files the employees computer had access to on the LAN. Their computer would start acting funny pretty quickly and they would call IT.
We would disconnect their computer from the LAN and go about restoring everything touched from backups, which were run nightly. We we’re back up and running in an hour or two and everyone would just lose half a days work.
Stupid is supposed to hurt...
At our work, the accounting computers were not connected to the internet. Same.