Are updates necessary with no Internet?

Question

For places that the computers won't ever see the Internet (Read: Mills and factories), is there any point to me installing the Windows Updates on new system builds? I know that about 90-95% of the updates are for security, with the others adding new features (i.e. XP SP3, IE9). Is just adding the base install enough for these systems if the company's SysAdmins won't grant Internet access anyways?

Answer 1

Being a network admin and having moonlighted for a local company that manufactures biomass/recycle materials handling and another who makes moisture meters, I have been exposed to this issue. So for the outlay.

The full answer is, no machine is invulnerable to exploit. The wetware internet attached to it will do all sorts of things for many different reasons that in either expedience for getting their job done despite your imposed limitations (the more limits you place the more frustrated and willing to bypass they get) or wish for entertainment will attempt things that involve detachable/network moving of files. In the old days it was a floppy, now a USB stick or stuffing in a couple wireless boxes. In manufacturing where you're dealing with engineers, you are only providing them a problem to solve. That is the way they see it and they will do the expedient to get the job done. Same with your Techs and any field techs who come into your operation. They will be bearing laptops or USB sticks.

So, your theoretically isolated system is really a sieve. For a system to be truly isolated, it must be a stand alone computer with limited user access only, the USB and network ports glued shut and truly never need software updates for your installed process control software. For a networked system of computers, no one must have anything more than limited user access and strict control be enacted for any removable devices being connected by USB or Ethernet port. It has to be written into policy and that policy enforced. You must be willing to fire at will any engineer or tech who bypasses it. Also all field technicians from outside your company must be accompanied by someone who fully understands the policy and can monitor their access. So much for no patches at all.

The next level is to have limited user access and install all patches necessary for system stability, local machine exploits, network exploits, and for disabling AUTORUN/AUTOPLAY. This security level is an attempt to mitigate having your employees or some field tech plug in an infected USB stick or attach their laptop to your network for diagnostic purposes. It also deals with the reality that your process control software actually does change, need upgrades or diagnostics from an outside source. You'll be able to get by with a lot less patches, but you will also need to keep everything up to your self-determined current patch level. Once again, establish policy on the use of removable devices and network attached devices.

The current malware crop works on a multipronged attack. There are so many varieties now that the only summary is expect anything from anywhere. They come prepackaged to use whatever is available to them. Yes they may come in on the internet, but the most sophisticated use that merely as an initial infection vector. They tend to look for all shares and attached USB storage. So theoretically, the front office can get infected, someone can pull a USB stick, walk back to manufacturing and now it's on your totally unprotected stand-alone network.

The Iranians and US Military know all to well that theoretical is actually true-to-life. Once in, you have a real mess, one that can shut down your operations and the downtime losses can make the amount saved over the years not patching look like piddling pocket change.

Yes, you can get by not doing patching, just be sure to walk into it with eyes wide open. It's your judgement call.

Of course the absolute best is to fully patch (Microsoft offers a patch disk method to do this for remote systems) and have at least minimal antivirus that scans attached USB storage on insertion.

Answer 2

If those machines are connected, even indirectly (networked with others internet connected machines), is wise to keep them updated.

If you wish, a third part application like Windows Update Downloader or Auto Patcher (google for them, for as a new user, I can post only 2 links) can be used to download those updates on a connected machine, copy them to the off-line ones using a pen-drive or DVD, after what you can do manual install.

You probably only need to do that on a monthly basis, following Microsoft's security updates release schedule, the famous Patch Tuesday.

Sometimes there are minor releases for which you can be notified if you subscribe to Microsoft Technical Security Notifications.

Off-course, remember to update antivirus definitions too.

Answer 3

Well if you have no internet access, then installing the updates will be a real pain. Some software you might use might require an update, but that can be individually installed and brought in via a memory stick. As long as your only installing software you know won't break things, I don't foresee any issue with not installing Windows Updates.

Answer 4

Updates never are necessary but they are very highly recommended.

But on computers with no Internet access at all, they still can have cases where updates would be a good idea. If it's a networked computer and if it has any security importance, it might be useful to update it. The risk of course depends on the situation. But if you are using removable media on the computer at all regularly, it should be regularly updated. Remember, viruses initially spread through infected floppy disks, before the Internet was a commonplace thing.

One very high-profile case in the modern day, while more extreme, still shows that internally networked computers, isolated off the Internet, can still be infected by USB thumb drives. It was the Stuxnet virus, which targeted Iran's nuclear facitilies. A computer on an isolated network, used for controlling equipment, was infected via a compromised USB thumbdrive inserted by an employee. It spread quickly and compromised the entire facility. This was a targeted attack, but used a zero-day exploit in Windows. Whether or not their Windows machines were updated is something I don't recall, and if it was a zero-day exploit, then it's unlikely it would have mattered. However, it shows just how vulnerable these computers still can be.