There are zero reasons you should not be using VPN or at least IP whitelisting for that. Especially in the industrial settings.

> at least IP whitelisting

home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?

And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.

Application and VPN work on totally different OSI layers, so what other comment already pointed out - it's defence in dept that exactly is meant to prevent such cases: when one control fails, other might save the day. IP whitelisting is mostly suitable for centralised command center and fixed locations which might have been sufficient in this case, as I really don't believe that these fridges were individually and manuallly controlled by human users via their phones rather than some server and automation.

> home or mobile users often have dynamic IPs and thus can't be "whitelisted". Why would you not want someone on their phone access the controls?

points vaguely at the exploit and how easy it is to find the targets.

If "change it from their phone" is a requirement, they can connect the phone to shop's network, or VPN from phone to HQ then bounce to the controller.

It is security by obfuscation, yes, but it is somewhat effective at low cost.

> And VPNs are just external authentication & encryption mechanisms, you might as well implement those properly inside the application and forego VPN entirely.

The controllers go out of support after some years. They work just fine, so replacing one if possible is costly and seen as unnecessary.

Putting it between $50 VPN box decouples "keeping VPN software up to date" and "keeping the controller up to date". It also gives your IT a single type of VPN config to support rather than being controller dependent.

I think the commenter above is making the point that this should be defence-in-depth.

Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.

There is not good reason to control commercial fridges from home or from a mobile device.

There are rarely good reasons to control domestic fridges remotely. Why would you want to trigger defrosting when you are not there?

That's a survirvorship bias - we normally only hear of the attacks that succeed, not the ones that have been successfully prevented.

Modern aviation is an amazing engineering feat (all the environmental issues aside). With such numbers it means that "one in a million" failure occurs roughly evey week, but the fact that we have so little major incidents demonstrates how well aicrafts are engineered.