That, or just simplifying these systems with clear boundaries between them. Why are flight status displays running Windows with endpoint security in the first place? Data could be loaded periodically from one authorized machine/job on the network with all other outbound/inbound network access restricted.