I imagined in the past that super-critical infrastructure like the military would have a parallel network, even down to using different cables in the ground, and wouldn't share any of the IP layers with the public Internet. I guess this was feasible a few decades ago, but not nowadays.

Heard of SIPRNet, NIPRNet, and JIWCS?

You will still see security teams pushing endpoint protection with kernel level observability onto air-gapped systems, so this issue still exists

From my own limited experience, those air gapped systems are often no more well managed than anything else. Perhaps having one more hop between the update channel and the secure network is enough to catch crowdstrike, but don’t be surprised if it isn’t.

> You will still see security teams pushing endpoint protection with kernel level observability onto air-gapped systems

Why though? Is it just "because we do it on every other machine", scared to fail audit, or what? Obviously the regulatory environment is a problem but IT incompetence is also another.

I've had this discussion with many people involved in country infra. It falls on deaf ears. They talk about 'acceptable risk' and 'minimizing their long term costs' just to stay afloat while posting multi billion dollar profits.

I don't know where the delusion comes from, but some of them to go see the folly of their mistakes in the last few days. They will ride this off in the excuse that 'it affected so many other people, see, its not my fault !'.

How can you run your internet backbone without connecting it to the internet?

Infrastructure , ie.. water, power, electricity, traffic, dam control, hydrostations, sewerage etc.

My point is that a lot of critical infrastructure needs to be connected to the internet, including network (as I mentioned) and traffic control systems (as you mentioned).

I now see where you stand, and we're going to have to disagree. I've heard all the points that your side can make 20 times over and none of them are convincing. I have also learned that when people use the word "need" they have their minds made up, so no point continuing this discussion, have a good one.

Well you can't run your internet backbone at all unless you want to connect it to the internet. For something like a network of traffic light controllers, traffic sensors, variable speed signs, traffic monitoring cameras, ect... You either need to connect it to the internet, or some sort of incredible large intranet that would be distributed over such a large area as to only marginally reduce the attack surface. Unlike say a power plant, where all of the controllers, and all of the systems they are controlling can be contained within a single facility.