|
The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network. You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved. The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection. Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network. A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job. Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking. [1] https://en.wikipedia.org/wiki/Unidirectional_network |