A problem family — different problems, same issues

built to be open. now under attack

12 problems across 7 fields

These 12 problems share a paradox: monitoring technology works, but it's bolted onto infrastructure designed before cybersecurity existed. As the collection grew, newer members include building automation systems using BACnet/Modbus protocols with no authentication, water treatment SCADA with no independent safety limits on chemical dosing, and maritime navigation systems accepting unverified AIS/GPS position data. Every physically deployed member is locked into an installed base. You can't upgrade the underlying system, so security solutions fail when retrofitted to legacy hardware.

You can bolt on monitoring, threat detection, and encryption — but the underlying system was designed in an era when 'cybersecurity' wasn't a word, and it can't be replaced without shutting everything down.

The 12 problems in this family

the lock is welded shutbuilt without the people who'd live with itmedium

explain the defense, expose the weaknesstested in the wrong worldhigh

millions of parts, no map of the wholeit fell between the cracksmedium

the ventilator has a password problembuilt without the people who'd live with ithigh

also in the rulebook was written for a world that no longer exists

the building runs on protocols with no passwordstested in the wrong worldhigh

smart defenses for dumb controllersbuilt without the people who'd live with ithigh

the water plant runs on software from the ninetiesbuilt without the people who'd live with itmedium

also in designed for a world that doesn’t exist here

ships trust position data from strangerstested in the wrong worldmedium

verifying the message takes longer than the braking windowthe rules got in the wayhigh

the pipe leaks, nobody shuts it offthe rules got in the wayhigh

also in the rulebook was written for a world that no longer exists, we can see the danger but the system won’t act

the bearing fails between detectorsthe rules got in the wayhigh

also in the rulebook was written for a world that no longer exists, we can see the danger but the system won’t act

the chlorine pump accepts any commandit fell between the crackshigh

Confidence: high = Tier-1 source — a primary expert source, fully fact-checked · medium = Tier-2/3 source — analyst, conference, or community source, fact-checked · needs sourcing = flagged for deeper sourcing — help us source it · the dot's size is its tier; a dashed dot needs sourcing

Loading…