How do I scan nuclear power station computers without an internet connection?
Hi everyone, Leo Notenboom here for askleo.com.
And yes, this actually was a very real question.
I'll throw the full question here on the screen.
But the bottom line is that this actually applies to just about any situation where
a machine is not connected to the Internet.
Here are the restrictions, at least,
that were specified for this specific nuclear power station example.
They can't install an antivirus because it conflicts with their software.
They have no internet connection.
They have no Windows updates because those could result in conflicts.
They're not allowed to open their
computers, and there's only a one month window every year where the system
actually can be maintained, updated or whatnot.
So my initial reaction to the question is actually really simple.
Don't get me wrong, I'm happy with Windows.
I'm a fan.
But putting the phrase nuclear power station and Microsoft Windows in the same
context, it kind of makes me nervous for reasons that I'll explain a little later.
It doesn't seem like the combination that helps people sleep at night.
So the good news here is that all
of the things that are in place that keep the machine secure, the lack of updates,
the lack of connectivity and so on those
things make it very difficult to perform a scan or do any updates.
However, they also make it very difficult
for malware to arrive in the first place, as it should be.
That's probably the majority of the intent behind being that restrictive.
That's not to say that malware can't still arrive.
We've certainly heard scenarios of machines being infected via other
means, not involving an internet connection.
But the bottom line is that it is the primary vector these days.
Connectivity is where most malware comes
from, so by not having connectivity to an outside world, that's pretty good.
I do want to point out, however,
that updates are for more than just security,
so not taking updates for upwards of a year makes me really uncomfortable.
Again, security may not be quite as much
of an issue since so little is presumably changing on that machine.
But updates include bug fixes?
Yeah, they include features, I get that.
But they include bug fixes in addition to security updates.
Let's face it, security updates are, in fact, themselves bug fixes.
My concern would be
that a machine in that environment could
potentially run into a very rare obscure bug for which a fix had already been
produced and still fall to the bug with unexpected, unintended consequences.
So it makes me really uncomfortable to not take updates for close to a year.
I'd probably see if there weren't some way to reconsider that.
I've got a bigger reconsideration coming up, but I would at least consider making
an argument for doing something a little bit more often than once a year.
So how do you scan for malware if you don't have Internet?
Well, it's actually pretty simple.
On a machine that does have Internet download something,
write it to a USB stick, or burn it to a CDROM or a DVD Rom,
and then take that to the machine that you want to scan.
In years past, I'd say yes.
I've got the solution for you.
It's called Windows Defender Offline.
It's designed for exactly this scenario.
You would burn it to a CD or a DVD or
a USB stick, you'd boot from it, and Windows Defender would do its thing.
For reasons that I still don't understand, Windows Defender is no longer available.
In that scenario, Windows Defender Offline
doesn't exist in a burn to CD kind of scenario.
It still exists, but it now runs only from the operating system itself.
In other words,
you have to boot into the operating system in order to run Windows Defender Offline.
That means a couple of things.
One, if your machine is a year out
of date, Windows Defender is a year out of date, and the machine has got to be
running, it just seems like a very ineffective solution.
Certainly for the scenario that we're discussing here.
However, there are other options.
The manufacturers of a number of antimalware or security software
packages actually provide something along these very lines.
In many cases, you can find from those manufacturers a downloadable ISO or
something that can be written to a USB stick, from which you can then boot
the machine in question and run up to date security scams.
I have a list of them in the article,
a list of bootable security tools, and I've not used any of them.
But if there is a security vendor with which you already have
a relationship, check with them first on that list,
then also will be a number of really familiar names in the security space.
Choose one of the ones that you feel most comfortable with and give that one a run.
Now, I will say that this is something
that you need to do, for lack of a better term at the last minute.
The bottom line is that you want
that security package that you're downloading to be as up to date as
possible, and that typically means downloading the most recent copy you can
get, like I say at the last minute, then taking it to your machines,
running your scans and doing whatever it is you need to do.
That's what I would do in your scenario.
If you need to run an offline scan,
then periodically download one of these disks, burn it to CD, DVD or a USB stick,
and then boot the machines from that stick in order to run the scan.
Now I want to go back to talking about
Windows and nuclear power, because like I said, it feels icky.
For lack of a more scientific term, Windows is a great operating system
for personal use, for business use, and it's done some amazing things.
There are huge enterprises, websites, services that are all running on Windows.
Ultimately having life critical systems assigned to a Windows machine are
the kinds of things that make me feel uncomfortable.
Besides, there are alternatives.
Now, I realize that as the person in charge of at least doing the security
scans, this might be outside of your scope.
But for the record, there are other,
better, more purpose driven operating systems out there that I think would be
a better choice for these kinds of operations.
They're typically called real time operating systems or whatever,
but there are better choices, I would think, than for windows.
Now, to be clear, if these are machines
that are just running your bookkeeping operations or something else that happens
to be on the same site as your nuclear power plant, fine, I'm not worried.
But if it's actually in charge of the equipment that pulls the rods or
does whatever with your nuclear power plant, that's the time where even I am
going to say no, windows isn't really the solution for this.
I hope that's helpful. Hope it's not too scary for everybody else.
For Updates, For Comments, For related links
and more, visit askleo.com/3848. I'm Leo Notenboom. This is askleo.com.