remote connection via analog phone line

well howdy all,
i have been in a conundrum regarding the various paranoid (and rightly so in some cases) government computers running off network software for local SCADA in industrial environments.
the issue is that quite a number of these machines are not local... the troubled ones always seem to be located in bumb'f'.
you get the idea. question is.. want to gain access to these machines over land line phone. it seems PC anywhere is no more. what are others doing in these situations? can I set up windows to accept a VPN connection via phone line?

signed, knucklehead

My experience is that analog line is so slow it's near unusable. I would first check to see what they allow and go from there. You can do a VPN via internet such as the Webport device and for added security, add a firewall and also a hardwired kill switch to it.

http://www.spectrumcontrols.com/webport.htm

If you have a modem at each end, you might be able to do it. Maybe something as simple as an old dialup 56k modem, though the speeds would be horrible. I've never tried creating a data connection with something so old, though.

I've seen people have good luck with cell modems for remote service as well.

However, in my experience, these kinds of situations arise specifically BECAUSE the customer doesn't want any kind of remote connectivity. I assume that the whole point of the network separation is that they want the PC's to not be able to be connected remotely.

thanks MK

thanks MK
that is correct... SCADA software if typically not on the governments list of approved software, too many open ports for them to comprehend i suppose...
speed is not the issue BTW, its just plain ole serviceability without traveling to a remote site to click a box in a dialog.
they are typically (as this one is) connected to local phone lines for the use of dial out alarms and sooooo phone is available.

IMHO a remote connection is a remote connection. An analog modem connection is far easier to hack than a high speed connection with proper security. Just my 2 cents.

PBuchanan said:

IMHO a remote connection is a remote connection. An analog modem connection is far easier to hack than a high speed connection with proper security. Just my 2 cents.

Click to expand...

I pretty much agree with PBuchanan. If your customer isn't comfortable with VPN type security, I don't think there is anything you can do over a phone line to be more secure than that.

thanks for your 2 cents and all but security is not the issue here. remote connections via phone line due to perceived security issues over internet is the issue.
you cant argue with the government you can only do the best you can with the tools given you

soooooo, speed is not an issue, security is not an issue.....

anyone still setting up remote phone access out there any more?
operating system windows7 pro

ltfordnr said:

thanks for your 2 cents and all but security is not the issue here. remote connections via phone line due to perceived security issues over internet is the issue.
you cant argue with the government you can only do the best you can with the tools given you

soooooo, speed is not an issue, security is not an issue.....

anyone still setting up remote phone access out there any more?
operating system windows7 pro

Click to expand...

But it is still the internet just a slower medium. Maybe so slow it will frustrate the hackers so much they'll give up...

Maybe point them to some of their own guidelines:
https://www.smartgrid.gov/document/...ontrol_systems_security_recommendations_stand

There are some guidelines for ICS VPN modem setups in this document. Nothing specific - there never is
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf

TimOB said:

But it is still the internet just a slower medium. Maybe so slow it will frustrate the hackers so much they'll give up...

Maybe point them to some of their own guidelines:
https://www.smartgrid.gov/document/...ontrol_systems_security_recommendations_stand

Click to expand...

Don't try to introduce common sense into the workings of the government its a lost cause, have tried, have failed. They don't use productivity or efficiency to gauge success they use appointed/elected officials success or failure in making the next tier the gauge.

That isn't meant to be a political statement that is my professional opinion based on my observations and interactions on how the government works.

Back to your point. I would try to push it to them to setup a WAN to connect these sites - however they wish to do it. I think you're asking for trouble if you set one up for them as a control integrator, especially with them being a government entity. Once that is done you can make any necessary connections and setup your SCADA. Many SCADA packages have had success with similar small remote sites like small drilling rigs operating at slow/intermittent data rates.

I still have to do work on systems that require Modem only access and this is my modem of choice http://www.usr.com/files/7913/9162/3123/3453c-ds.pdf

It has security authentication and Dialback features to make it a secure connection but depending on how critical the system is I use a Comm lock security device also http://www.charontech.com/commlock.html

thanks all, you guys are funny... like talking to my wife except she's much prettier than you knuckleheads

anyhoo our modem has been chosen due to TAPI requirements.

ill just try and set up a dial up through windows and see if I can get it to work.
i thought maybe someone has been doing this and had some place to go where some type of software was still available for dial up other than Windows but at least it has been entertaining.

btw, no requirements, nothing "official", just us trying to make our lives easier with absolutely no regard to government official precedence. i guess if someone had the mind to hack in and make a water tank overflow to drain in order to terrorize the guys at the treatment plant go ahead.... they don't do much anyway

POWER TO THE PEOPLE and all that hehehehe

ltfordnr said:

thanks all, you guys are funny... like talking to my wife except she's much prettier than you knuckleheads

anyhoo our modem has been chosen due to TAPI requirements.

ill just try and set up a dial up through windows and see if I can get it to work.
i thought maybe someone has been doing this and had some place to go where some type of software was still available for dial up other than Windows but at least it has been entertaining.

btw, no requirements, nothing "official", just us trying to make our lives easier with absolutely no regard to government official precedence. i guess if someone had the mind to hack in and make a water tank overflow to drain in order to terrorize the guys at the treatment plant go ahead.... they don't do much anyway

POWER TO THE PEOPLE and all that hehehehe

Click to expand...

The model I listed for you is TAPI compliant. In fact you would be hard pressed to find any modems being made today that are not TAPI compliant.

Your statement make me think you have poor understanding of what the TAPI standard is?

Thanks PB
i guess if we are going to be off topic just for the sake of banter....
the modem chosen was chosen due to the 64 bit win 7 and 8 support (drivers) and the tested operation with winn911.
we have gone through the whole TAPI modem thing on several occasions and not all modems are equal.
since there is not much call for this stuff any more the manufacturers are not updating drivers but advertising comparability. it seems that when attempting to use voice with TAPI is not one of the main concerns of most of these manufacturers.
the modem you called out (i like the USR products) may be well and fine and it may even work perfectly for what we are using it for but for what I know it has not been successfully tested with our combination of software but we have i now have an office with a special drawer full of modems that are not compatible but it was fun trying them all out.... what the hell, guys gotta have some fun right??

Which modem did you end up going with if you don't mind my asking?

If you have something guaranteed to work then yes that's the best choice.

I have used Win911 before and it's god software but I have never had to use it over standard modem connection only will cellular modem connections.