Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For places that the computers won't ever see the Internet (Read: Mills and factories), is there any point to me installing the Windows Updates on new system builds? I know that about 90-95% of the updates are for security, with the others adding new features (i.e. XP SP3, IE9). Is just adding the base install enough for these systems if the company's SysAdmins won't grant Internet access anyways?

share|improve this question
can a flash stick be shoved into them? Can a drive be put on them from another machine? Is there still a local intranet? I would say if it aint broke dont fix it :-) but you didnt cover all the possible entry points for a security issue in the question yet. – Psycogeek Jan 14 '12 at 18:16
@Psycogeek That's because I wanted to know more or less about Internet vulnerabilities, but the Intranet thing is a good point, and yes. They do run a local Intranet, where only 2 computers have Internet access – Canadian Luke Jan 14 '12 at 18:47
Ok there have been viruses, that worked hard to move internally in a network. MS had also put out a few patches for that, at least way back in patch time. – Psycogeek Jan 14 '12 at 18:54
Well post that as an Answer then for some Rep – Canadian Luke Jan 14 '12 at 19:15
up vote 4 down vote accepted

Being a network admin and having moonlighted for a local company that manufactures biomass/recycle materials handling and another who makes moisture meters, I have been exposed to this issue. So for the outlay.

The full answer is, no machine is invulnerable to exploit. The wetware internet attached to it will do all sorts of things for many different reasons that in either expedience for getting their job done despite your imposed limitations (the more limits you place the more frustrated and willing to bypass they get) or wish for entertainment will attempt things that involve detachable/network moving of files. In the old days it was a floppy, now a USB stick or stuffing in a couple wireless boxes. In manufacturing where you're dealing with engineers, you are only providing them a problem to solve. That is the way they see it and they will do the expedient to get the job done. Same with your Techs and any field techs who come into your operation. They will be bearing laptops or USB sticks.

So, your theoretically isolated system is really a sieve. For a system to be truly isolated, it must be a stand alone computer with limited user access only, the USB and network ports glued shut and truly never need software updates for your installed process control software. For a networked system of computers, no one must have anything more than limited user access and strict control be enacted for any removable devices being connected by USB or Ethernet port. It has to be written into policy and that policy enforced. You must be willing to fire at will any engineer or tech who bypasses it. Also all field technicians from outside your company must be accompanied by someone who fully understands the policy and can monitor their access. So much for no patches at all.

The next level is to have limited user access and install all patches necessary for system stability, local machine exploits, network exploits, and for disabling AUTORUN/AUTOPLAY. This security level is an attempt to mitigate having your employees or some field tech plug in an infected USB stick or attach their laptop to your network for diagnostic purposes. It also deals with the reality that your process control software actually does change, need upgrades or diagnostics from an outside source. You'll be able to get by with a lot less patches, but you will also need to keep everything up to your self-determined current patch level. Once again, establish policy on the use of removable devices and network attached devices.

The current malware crop works on a multipronged attack. There are so many varieties now that the only summary is expect anything from anywhere. They come prepackaged to use whatever is available to them. Yes they may come in on the internet, but the most sophisticated use that merely as an initial infection vector. They tend to look for all shares and attached USB storage. So theoretically, the front office can get infected, someone can pull a USB stick, walk back to manufacturing and now it's on your totally unprotected stand-alone network.

The Iranians and US Military know all to well that theoretical is actually true-to-life. Once in, you have a real mess, one that can shut down your operations and the downtime losses can make the amount saved over the years not patching look like piddling pocket change.

Yes, you can get by not doing patching, just be sure to walk into it with eyes wide open. It's your judgement call.

Of course the absolute best is to fully patch (Microsoft offers a patch disk method to do this for remote systems) and have at least minimal antivirus that scans attached USB storage on insertion.

share|improve this answer

If those machines are connected, even indirectly (networked with others internet connected machines), is wise to keep them updated.

If you wish, a third part application like Windows Update Downloader or Auto Patcher (google for them, for as a new user, I can post only 2 links) can be used to download those updates on a connected machine, copy them to the off-line ones using a pen-drive or DVD, after what you can do manual install.

You probably only need to do that on a monthly basis, following Microsoft's security updates release schedule, the famous Patch Tuesday.

Sometimes there are minor releases for which you can be notified if you subscribe to Microsoft Technical Security Notifications.

Off-course, remember to update antivirus definitions too.

share|improve this answer
Also not all updates are security updates. You need at least the ones necessary to maintain system stability. After while other (non-Microsoft) software updates can depend upon them being installed. – Fiasco Labs Jan 21 '12 at 1:34
Thanks for remembering @FiascoLabs, but I was assuming that he would not change installed software. For third part software updates, remember to send necessary windows update too. – motobói Jan 21 '12 at 1:42
You're welcome! I just got through a couple third party upgrades that demanded XP SP3 be installed or no go. – Fiasco Labs Jan 21 '12 at 1:49

Well if you have no internet access, then installing the updates will be a real pain. Some software you might use might require an update, but that can be individually installed and brought in via a memory stick. As long as your only installing software you know won't break things, I don't foresee any issue with not installing Windows Updates.

share|improve this answer
That's what I thought – Canadian Luke Jan 14 '12 at 18:03

Updates never are necessary but they are very highly recommended.

But on computers with no Internet access at all, they still can have cases where updates would be a good idea. If it's a networked computer and if it has any security importance, it might be useful to update it. The risk of course depends on the situation. But if you are using removable media on the computer at all regularly, it should be regularly updated. Remember, viruses initially spread through infected floppy disks, before the Internet was a commonplace thing.

One very high-profile case in the modern day, while more extreme, still shows that internally networked computers, isolated off the Internet, can still be infected by USB thumb drives. It was the Stuxnet virus, which targeted Iran's nuclear facitilies. A computer on an isolated network, used for controlling equipment, was infected via a compromised USB thumbdrive inserted by an employee. It spread quickly and compromised the entire facility. This was a targeted attack, but used a zero-day exploit in Windows. Whether or not their Windows machines were updated is something I don't recall, and if it was a zero-day exploit, then it's unlikely it would have mattered. However, it shows just how vulnerable these computers still can be.

share|improve this answer
Which is why the military has taken to filling USB ports with glue. No internet access doesn't mean computers are safe from remote exploits. A majority of threats now are multi-pronged attacks. They attempt to propagate by many well known sofware vulnerabilities and then search for network shares and removable drives. So one really important patch is ANYTHING DEALING WITH AUTORUN/AUTOPLAY ON USB/NETWORK SHARES. Another vector in isolated systems is someone plugging in a laptop, had that happen. Some travelling salesperson without asking just pulled the computer cable and jacked in. – Fiasco Labs Jan 21 '12 at 17:39
Actually, the flash-drive source is an unconfirmed, though certainly possible, theory. – Synetech Jul 25 '13 at 19:27

For places that computers won't ever see the Internet (Read: Mills and factories), is there any point to installing Windows Updates? I know that about 90-95% of the updates are for security, with the others adding new features (i.e. XP SP3, IE9).

Yes there can be good reason to update an OS on a system that’s not connected to the Internet. As you said, most updates (these days) tend to be security fixes, but I don’t know about the numbers, and moreover, your statement about [all of] the remaining updates being new features is not quite correct.

Others have pointed out some of the obvious reasons to keep even an unconnected system update, like infected removable media and worms coming through the LAN. (As Ben reminded, Iran’s Siemens systems were not connected to the Internet either, and yet were still infected with Stuxnet.) But even if you never connect the system to any sort of network and it has no external drives or ports whatsoever, you might still want to update the system. I’m sure there are other reasons why an isolated system should be kept updated but these are a few obvious and common one.

One reason is that updates sometimes include improvements and optimizations that could increase the processing speed of the system or reduce resource usage. They also fix things like memory leaks and dead-locks. These sorts of updates can make the system more useful.

Another reason to update an unconnected OS is for stability. The updates can include patches and improvements that can prevent or repair problems that would have caused the software and/or system to crash before. These sorts of updates can make the system more reliable which is all the more important in the example scenarios like factories that you described.

Yet another reason to update an OS is because the software that you are running on the system might itself be faulty. Even if you don’t expose the system to infected software, your database program, accounting software, or web-server could have a flaw that might slip through and accidentally trigger a vulnerability in the OS. If the OS is left with the vulnerability, your software might not crash and it would go on performing incorrect operations which could for example, silently corrupt your database for who knows how long. If the OS were updated and the hole patched, then the faulty software would crash, thus alerting you to the problem. Now you can do something about it, like restoring backups and updating the software. These updates make the system safer—from itself.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .