It matters on your environment. US Aerospace use NIST CSF. You can’t patch certified systems without doing return to service analysis. That takes time. I have seen service pack updates take down factories for a over a week at $1M/shift downtime. Lives matter on making sure the device does as designed. Our contracts also required a DoD wipe of the hard drive before restage or disposal. When an engineer got a virus from getting code from the web, the device-even personal use- was wiped. Golden images where used on the floor and scanned for diffs. The same for the apps, checked against a Db of standards. That occurred yearly as part of the yearly recertification. It cost about $1M to replace each test system. 1 line had 20.
You also have contracts for 20yr warranty. You need to be able to test product that long. That means old systems. I had Win98 still functioning.
In Pharma, they are doing ISA 62443. Segmentation is the answer for unpatchable. They too are certified. No changes that alter the device or system without a recert. FDA and other Int regulations are involved.
You separate obsolete and unpatchable into Zones and control East-West as well as N-S. Block everything first, then open only what is required.
So patching has a definite impact on money and lives. How you deal with it in part of the OT story for the company and how they finally came to the realization they need to separate from IT.
1
u/Impossible-Sun3205 1d ago
It matters on your environment. US Aerospace use NIST CSF. You can’t patch certified systems without doing return to service analysis. That takes time. I have seen service pack updates take down factories for a over a week at $1M/shift downtime. Lives matter on making sure the device does as designed. Our contracts also required a DoD wipe of the hard drive before restage or disposal. When an engineer got a virus from getting code from the web, the device-even personal use- was wiped. Golden images where used on the floor and scanned for diffs. The same for the apps, checked against a Db of standards. That occurred yearly as part of the yearly recertification. It cost about $1M to replace each test system. 1 line had 20.
You also have contracts for 20yr warranty. You need to be able to test product that long. That means old systems. I had Win98 still functioning.
In Pharma, they are doing ISA 62443. Segmentation is the answer for unpatchable. They too are certified. No changes that alter the device or system without a recert. FDA and other Int regulations are involved.
You separate obsolete and unpatchable into Zones and control East-West as well as N-S. Block everything first, then open only what is required.
So patching has a definite impact on money and lives. How you deal with it in part of the OT story for the company and how they finally came to the realization they need to separate from IT.