30.09.2016 18:21

But what are you going to do about those older parts of the network – machines, sensors, etc. – that were installed before security was a thing? That’s where the real money is. But with security, you really can’t simply say, “Oh, we’ll get to that when we replace them in 5 years” the way you can with other equipment decisions. During those 5 years, the unprotected nodes will be an invitation to enter not by the back door, where that beefy bouncer stands guard with that all-important VIP list, but via the side door that everyone forgot about.

These old machines are like a stubborn old grandpa, still in his childhood home while the neighborhood gets turned into a mall*. And he’s still got plenty of useful years left. So he’s staying put, nothing’s going to make him move except six bodies and a box. So how do you integrate grandpa into the new neighborhood rather than forcing him out?

In other words, how do you lock those parts of the network down without replacing the grandpa equipment? There is at least one solution to this very specific application from Icon Labs. They call it Floodgate Defender, and it’s a hardware appliance that does all of those things that a security stack in new equipment would do. It’s basically a small, standalone firewall.

(Image courtesy Icon Labs)

Obviously, separate firewalls aren’t new; there are presumably racks of them floating up in the Cloud. But those cost lots of money and are way overkill for simply protecting a little piece of equipment. So this is a small unit, with Ethernet in and Ethernet out, that you add as a bump in the wire. Unplug the Ethernet from your equipment, and insert the firewall in between. Of course, this does mean that grandpa can’t be so old that he doesn’t even have a network connection. This works perhaps better for septuagenarians rather than centenarians – grandpas with network connections, but without security.

Configured in the default mode, your equipment is now protected from the network; if someone is prowling about, the firewall will stop them before they can monkey with your machinery. While useful, that’s frankly a scenario opposite to the one I tend to think in terms of, where the edge node becomes a possible point of entry to the network. So, is the firewall protecting the edge node from the network, or is it protecting the network from the edge node?

In this case, the answer turns out to be both. The device can be configured to protect in both directions, although you have to make sure to set that configuration up.

www.eejournal.com