[mikewarot]

>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure.

You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety.

Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.

[mindslight]

Please expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correct data structures of a type that can be thrown over a wall. Like sure it's easy to cut one ethernet pair, or one serial line wire, but building up a software stack that can use that for one-way communication still seems like a hassle.

[mikewarot]

The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network.

You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved.

The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection.

Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network.

A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job.

Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking.

[1] https://en.wikipedia.org/wiki/Unidirectional_network