I'm sure any number of military and intelligence agencies would be thrilled to give them a pile of money and all the cool toys they could handle.

Oddly enough, the Chinese government isn't stupid and takes a very long-term view of things.

This could be exactly what they're planning and want this to happen so they can have the benefits and freedom due to the "changing times" without having to embarrass themselves by back-peddling with their current policy. It also lets them selectively enforce "who has freedom" by allowing the access policy to the area be "leaky".

If you don't control everything on the box, you can't ensure security.

Regardless of what they claim or what they do, you're essentially sharing the box with hundreds or thousands of other users who potentially have access to run whatever they feel like.

I would suggest a Virtual Private Server on Linode. Your server is yours and security will live or die by how you configure it.

When most of the long haul and medium haul fiber was laid, they didn't just bury what they needed, they buried a bunch of it. However most was never connected to equipment (lit up).

This dark fiber is still sitting in trenches and conduits (many were taxpayer funded) running along a huge number of US superhighways, and has not seen a single byte of data.

This is mostly because having additional capacity would remove the artifical limits, increase the supply and cause prices for internet access to drop.

While some companies have problems with "the last mile" (to the home), companies that ran fiber to the home like Verizon, are still attempting to limit bandwidth and create artifical shortages.

My answer was to "say no"

In fact, I went on to say "If you really need 24x7x365 support, you need three shifts of employees, not one poor bastard that you think you can call at 3am because something is unhappy"

It worked just fine and I never got a call. when I went home at night, I was gone. When I came back in the morning, I was there.

Setting limits with employers will do wonders for reducing stress and workload. They probably won't fire you unless they're complete dickheads, in which case a better job awaits somewhere else.

If I get a text about a giant tornado headed my way, do you honestly think I care if they charge me 20 cents for the "head's up"?

That is completely impractical.

People in userland need data from the SCADA network to keep the business running. They absolutely must have a way to get it. Saying "no" isn't an option.

Sure it is.
 
  Watch this: "You're being paid to do a job. Being inconvient helps to safeguard the public utilities and prevents tampering from remote locations. If I find any systems that are connected to the public internet in any manner no matter how convoluted, I will fire the responsible individual(s) and their manager(s) on the spot."

See how easy that is?

Need data? Write it to a DVD and sneakernet it to whoever/whatever needs it.

Good advice. Try it with 30 plants covering a 1500sq mile area. While you were out all day updating your servers, an instrument tech forgot to clean his thumbdrive before plugging it in to an IEM to update the firmware. Since you didn't have regularly updating anti-virus, your whole network is now down and the company is losing millions of dollars an hour in lost production while you try to clean the 60 servers and 400 consoles on your SCADA network.

That's even more of a reason to not be connected to the net. The damage would be limited to the area one man could travel in a day, instead of everything, everywhere.

And you know what? I don't care if it's practical. Not all jobs get to be "convienient".
 

Good safe practice for separating a process control network from the internet is something like: internet > corporate network > buffer network > process network. Completely separating it is not advisable, because it can actually make it harder to administer and protect (updates, antivirus, etc). It's an option though if you are diligent with sneakernet updates and whatnot.

That's absolutely a recipe for disaster.

Nothing on the SCADA system should connect to anything, on any other network, using any method. No VPN, VLAN, Dameware, Citrix, or anything else you can come up with. Nada. Zip.

If this makes updates harder, that's awesome. It's supposed to. Someone is getting paid to do maintenance. It's their job. If by chance, you wish to do an update at some point, download the update, verify all the signatures with the vendor, burn it to a DVD and walk it over and install it. Then put the DVD somewhere safe, so when your system goes down you can find out what did it.

Advertising exists in order to create a demand for stuff people don't need.

People already know they need food, water and shelter. Nobody needs a steak from Outback or a new Disney toy.

They can't "force" anybody to do anything and if viewing specific content requires watching an ad, then I guess they'll have to get along without my business.

Will be very happy when the market tightens up again (which unfortunately means ageism since the boomers ahead of me have to frikkin retire). And I sympathize with the poor graduating 20 year olds- they are screwed. No jobs so no experience and a $40k college bill.

Sorry to be a downer, but I'm at the tail end of the boom, but really like consulting, and won't be retiring until they drop me into a nice plot near a shade tree and a headstone. 8-)

Happily, if you're good, you can do the same thing. The amount of great work available for competent consultants is nearly infinite. Most of it involves fixing and taking care of stuff some twenty-somethings wrote at 3am after two years of 80 hour weeks, but I don't care since it pays well enough that 20 hours now pays more than 80 hours a couple of decades ago.

because 20-something morons who have never seen a project managed competently think it's supposed to be that way." I would venture to guess...there are PLENTY of 40-50yr olds that have yet to see a project managed competently...

Most projects are doomed before they start, when the budget, timeline and requirements silently collide in huge explosion that nobody acknowledges seeing or hearing.

I remember back in the dark ages (early 90's) I sat through a meeting describing software that had an only slightly smaller scope than the creation of the universe. After the meeting, I told the project manager that the only way to be on-time, within budget and meet specs would be if he had a magic wand and a time machine.

For some reason that wasn't a popular opinion and I wasn't invited to any more meetings.

OTOH, the project was a massive money sucking hole, and when it was months overdue and way over budget, the company killed it and was sued for breach of contract. Then went bankrupt.

Successful project management starts with realistic expectations, budget and time-line, which due to market-pressures is usually absent.