[jkimmel]

> The situation in the clinical biotech companies I worked at was never that bad because of HIPPA compliance and more focus on networked services like lab databases but still atrocious.

I can attest that academic biotech labs are still pretty atrocious, for the reasons you mention.

Windows XP (or super old OS X installs, pre 10.5) are pretty common on non-networked machines that function as appliances. It's not uncommon to hear about a machine controlling a $X00,000 device being compromised by malware that road in on a USB drive, despite the air gapping.

Sometimes I feel that it would be better for vendors to use a super minimal Linux distribution for each of these workstations that basically function as an appliance. Not only could the vendor reduce the attack surface for any potential malware exposure, but the one-off nature of the distro and small overall number of workstations would provide a minimal incentive for malware authors to target.

[pjmlp]

Now try to get those hardware manufactures to provide anything else other than OCX or DLLs as device APIs.

[bostand]

Check out ubuntu Core, one if its main use cases is exactly this.