I just took over as an admin for a network that uses corporate imaged hosts, to manage various special purpose machines.

These hosts directly connect to the equipment they are managing via Serial or ethernet(cross-ver), with absolutely no internet or intranet access.

A few of these hosts have not been connected to any network for ~2 years, since this is a standard image, windows updates or anti-virus updates have not occurred for over ~2 years.

The vulnerability I'm worried about, is the operators of the special purpose machines connect USB thumb drives to these air gapped hosts, for legitimate reasons as well as personal reasons (music etc.)

I would like to remediate this by one of the following options:

1- Connect these hosts to the corporate LAN to update anti-virus, windows on a periodic basis (once a month), and return to air gap

2- Create a special subnet[s], that only allows through windows update, anti-virus update

another things I'm considering is building custom image for these hosts that does not have unncessary apps (MS Offic etc.)

option 1 is cumbersome and easily forgotten, option 2 requires I go through IT Governance which would take a while to get through.

I would like to hear any recommendations you have, for this situation.


If people are using their own usb drives on these PCs it certainly is an issue.

I would set them up on an isolated LAN along with a WSUS server and whatever software you antivirus provides for distributing patches. The new server could either have a second connection to the internet, or stay isolated and have you manually transfer updates to it on a regular basis to distribute to the rest.

  • to provide further clarification, none of the systems are related, and do not have the same requirements so it is difficult to put them all on a single LAN they range from a host controlling a specialized telemetry device, to a host controlling a large digital sign board, a host controller a laminating machine etc. I like your idea of using a dedicated WSUS server, however because of the different systems I hesitate to put them on the same LAN. – hyussuf Sep 7 '13 at 17:31

option 1 is cumbersome and easily forgotten, option 2 requires I go through IT Governance which would take a while to get through.

Option 1: IT management requires effort. If you go with option 1 then it's your responsibility to put in the effort to remember to do this. Create a calendar reminder or a recurring task for your self for this.

Option 2: Whatever you do you should make sure that you have the approval and buy in from the IT staff/management.

You can, as Michael points out in his comment, use an offline WSUS solution. You should also be able to download AV updates offline and apply them to these machines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.