[usconservative]

I’m a cyber security expert, and I am stunned they have not corrected this hacking problem by now.

As a cyber security expert, you'd know as well as I do that just because you can put something on the Internet that doesn't mean you should.

Why is all this critical infrastructure accessible via the Internet? Where's the air-gap? Why isn't all this critical infrastructure on its own managed WAN, completely independent of Internet access?

Who are the assclowns responsible for the security of the infrastructure connected to the Internet which provides access to the pipeline infrastructure controls? Are they still employed?

Why wasn't there a manual fail-over plan available to be implemented in the event of a computer based controls outage?

Finally, who's the idiot who thought making critical infrastructure accessible via Internet was a good idea? We seem to have this issue with every piece of critical infrastructure. If it's critical, why is it connected to the Internet in any way rather than a dedicated, fully manged WAN and fully managed/isolated VPN solution that allows secured & managed access with zero connectivity to the Internet?

[TexasGunLover]

As a cyber security expert, you'd know as well as I do that just because you can put something on the Internet that doesn't mean you should.

Virtually nothing is air-gapped in our infrastructure... zilch, nada, nothing.

[CodeJockey]

Excellent post. Exactly what systems were breached? Was it strictly financial data that got jacked? If so they must have backups.

Was it the process control systems? Are there not separate redundant systems? This is a major fail by what is suppose to be a top tier infrastructure.

It’s not like this company, Colonial, did not know the risks. If Congress were not so incompetent, there should investigate what happened. But then again, have you seen the members of congress? My dog is smarter than most of them.

[goodnesswins]

I am NOT in IT...and I’ve questioned the loading of software to “clouds” for years

[CodeToad]

Here’s the thing, the “Internet” rides on many paths that existed decades ago. There really isn’t an “Internet” as far as a network goes. Many segments where built on routing technologies for the Internet, but they are used for many things. All those microwave, satellite, fiber, copper, and other communication mediums make up today’s Internet. It looks seamless and high-tech, but it’s a lot of old-tech wired together.

[BobL]

“Why is all this critical infrastructure accessible via the Internet? Where’s the air-gap? Why isn’t all this critical infrastructure on its own managed WAN, completely independent of Internet access?”

Very simple - the VP likes to pull up pipeline data to show off to his friends when he has parties at his house. Really no different than showing off his latest Tesla.

[BobL]

“Finally, who’s the idiot who thought making critical infrastructure accessible via Internet was a good idea?”

You need to get out of that Neanderthal mindset, EVERYTHING is now on the Internet. It’s absolutely wonderful...what could go wrong? LOL.

[GOPJ]

Why is all this critical infrastructure accessible via the Internet? Where's the air-gap? Why isn't all this critical infrastructure on its own managed WAN, completely independent of Internet access? Who are the assclowns responsible for the security of the infrastructure connected to the Internet which provides access to the pipeline infrastructure controls? Are they still employed? Why wasn't there a manual fail-over plan available to be implemented in the event of a computer based controls outage?

ANY office you want to run for - - I'll vote for you...

[Lazamataz]

Where's the air-gap?

BTW, interesting aside: I have it on pretty good authority that some of our electronic warfare aircraft have the ability to penetrate an air-gap and cause all sorts of mischief on a gapped WAN.