- The CFO doesn't understand why we need separate server infrastructure (and the associated licensing and maintenance costs) for accounting and engineering.
- Software vendors can't answer the most basic questions about how their software communicates to allow network ops to build reasonable access control lists for network segmentation.
- The network gear doesn't have sufficient horsepower to do wire-speed stateful packet filtering because, apparently, that's still an exciting new idea in 2020, and we can't slow everybody's access down.
- Individual departments have end-run IT by using "cloud" offerings that effectively bridge different segments of the network together at layer 7.
- Everybody has to be able to open their email and click random links on any PC.
The problem with any defence based on filtering is that first you have to decide what to filter. In an enterprise-scale network, this is not an easy problem, despite the number of shiny and expensive tools available that are selling the hope that it is.
Individual departments have end-run IT by using "cloud" offerings that effectively bridge different segments of the network together at layer 7.
This might be the most challenging problem for modern IT security, perhaps along with BYOD. The software and equipment accessible by staff might no longer be fully controlled by the organisation. That changes the emphasis for IT security from "just" securing your own software and systems to also somehow securing your data against unauthorised transfer to other systems. And this is a hugely complicated problem with (at least) technical, legal and management dimensions.
If the networks were air gapped, it wouldn't be Matthew's fault. Someone who had access to the engineering network would need to screw up. Which is of course perfectly possible—engineers make mistakes too. (Furthermore, if they were hacked by a nation state... for all we know it really could have been done without any user action at all.)
Either that or one of the Siemens engineers who showed up at the plant's laptop was infected in anticipation of them showing up there to fix stuff.
Even if you got all of the issues caused by e-mails figured out, somehow you have to transfer them from one network to another. You'll either have to poke holes into your firewall or use USB sticks.
My point is: even in airgapped networks you usually want to exchange some data. The moment you want to exchange data, you have a path where a virus can be smuggled in.
What other security features claim that performance?