I just took over as an admin for a network that uses corporate imaged hosts, to manage various special purpose machines.
These hosts directly connect to the equipment they are managing via Serial or ethernet(cross-ver), with absolutely no internet or intranet access.
A few of these hosts have not been connected to any network for ~2 years, since this is a standard image, windows updates or anti-virus updates have not occurred for over ~2 years.
The vulnerability I'm worried about, is the operators of the special purpose machines connect USB thumb drives to these air gapped hosts, for legitimate reasons as well as personal reasons (music etc.)
I would like to remediate this by one of the following options:
1- Connect these hosts to the corporate LAN to update anti-virus, windows on a periodic basis (once a month), and return to air gap
2- Create a special subnet[s], that only allows through windows update, anti-virus update
another things I'm considering is building custom image for these hosts that does not have unncessary apps (MS Offic etc.)
option 1 is cumbersome and easily forgotten, option 2 requires I go through IT Governance which would take a while to get through.
I would like to hear any recommendations you have, for this situation.