[Michael Chandra]

Do keep in mind some Hosts are location-bound, so you must be at the scene to get in. And even then some of the crucial data will indeed be offline, because some departments can't even trust each other.

[Plan_B]

I've always seen it as there are some systems that are hardened or secured in such a way as to make remote hacking possible but so exceptionally difficult that you're going to call GOD or a demiGOD down on you simply by hacking it because it just takes far too long to penetrate the system and locate the paydata. Ultimately, in terms of abstracted game systems and mechanics, Overwatch Score is what limits a hacker from getting into any system they want. Beyond this, I have always run it as some systems are isolated in such a way that a hacker needs to be on site and directly connected to the physical infrastructure to hack a system (watch out for some seriously nasty IC on these systems), which means physical penetration of the secured site as well. It is for this reason that I have modified an idea of mine from previous experience to work with 6e that is a network attached device designed to compromise the integrity of the secured and isolated system and allow for remote access via the Matrix. You just have to get someone into the site, gain access to the network infrastructure, and attach the device without getting busted (good luck with that).

Most of the Sixth World is actively present and connected to the Matrix. This makes a lot of mundane stuff vulnerable to one degree or another. The most valuable stuff is secured in such a way that OS is likely to prevent you from getting in before you have to bail because it has gotten too high to risk further intrusion activities. The extremely valuable stuff is isolated and may only be connected to the Matrix for extremely short periods of time, or not at all. Additionally, none of this accounts for more than network architecture and IC. Let's not forget that security spiders are a thing. A network with extremely valuable data on it is going to have at least one (probably more) spider waiting to melt your brain with biofeedback.

The key thing to remember is that Matrix connectivity has a lot of value. That's why they use it. It does make things less secure but there are preventative measures to take, including nested hosts, high Device Ratings on those hosts, some nasty IC that will fry your brain, and corporate deckers or technomancers working as a security spider who will absolutely enjoy ruining your day. Just because something has potential vulnerabilities doesn't mean it is wide open for anyone to come look at.

[ZeroSum]

[...]My runs often feature air-gapped systems or physical media cold storage the runners must physically access to obtain the McGuffin. I guess, based on this thread, that it isn’t very canonical, but it works just fine for us. Doesn’t seem to cause any mechanical issues.

Systems that are offline or isolated are very much canon, and have been since the beginning. For your everyday run of the mill corp office or stuffer shack security is probably pretty lax because it costs toouch to properly secure something that few people are interested in in the first place.

Look at Stom Front; FastJack and Riser went to Alberquerque (or however that place is spelled) in order to get to something that was offline.

A lot of the Missions and adventure books feature hosts and devices that ate not remotely accessible because it serves a purpose, story wise. Ultimately, that's what matters.

Want your Decker to be able to slice through security from the van? Completely plausible in a large number of cases. Want to get your hacker off his hoop and into the highly secure bunker that contains the top secret Gizmo? Also totally plausible.

Personally I try not to think of how the Matrix works at a conceptual level too deeply, because it isn't really explained. Instead, I just accept that cameras and door locks are wireless so that my hacker has something to do while the street sam provides covering fire and the magician summons his spirits to do their thing.

Heck, people in the lore run around with wirelessly accessible electronics in their bodies. In their heads, even! A bricked cyberdeck does 8P damage! No rational modern-day person would risk a cranial detonation to protect their iPhone or whatever, but in the world of Shadowrun, this is as common as drinking soykaf and filtering out AR spam while walking down the streets.

[Reaver]

Right now, in the real world:

Just about EVERY major function of life and government is online.
Railway/subway/transit lines
Electrical power grid
Traffic lights in major cities
EMS
Police services
Various Social policies
Medical charts
Banking
Telecomms


that is NOW.... not in the dystopic cyber future

And, just like in SR... These systems can and do come under cyber-attack, and do get breached. You just don't hear of it, because well, the media can't figure out a way to blame Trump.... (there are Riots in 6 countries, Wars in 4 more, social unrest in a dozen more, disease outbreaks in 8 more.... yet Google News is full of Trump Twatter crap....)


Now, the history of computers, the matrix and all the crap that goes with it is a lot different in SR, then our world... but you can see the inspirations, and why they needed to update to a "wireless" system. (after all, why is the game that is set in the future, needs its "internet" to be wired, when the players are looking shit up wireless?)

Now when you get right down to the basic set up of the matrix, its not that bad really... in a thematic sense... (in a rules sense.. it get wonkty. Don't have 6e yet so no comment on it ATM). The Matrix is made up of millions of interconnected devices to share both the bandwith and processing power required to run all the activity. (so, even when your commlink is not being used by you, its STILL acting as a "pass through" device for everyone around you).
And this works and is SAFE because the devices sold to the public can not change the data they access, and the device that can change the data are limited to the corporations (and those that steal the tech - like runners and the black market)...


Keep in mind: There is are BILLIONS of people in SR, yet only a thousand that actually have the equipment and talent outside of the corps to actually "hack" matrix.... (and the technomancer population.. which is just one MAJOR reason why the Corps fear them)... Which is another reason why the entire system "just works".... to steal a catch phrase (and all its intended meaning ) The number of actual threats are so low.

As for security systems...
well... They will be as advanced or as little as the company feels is warranted (Same as today). And just like today, the more advanced ones will be connected to the matrix as the corp dictates. So smashing into the Azzie owned Stuffer Shack probably isn't going to trigger more then an alarm and alert to local Police. But the Azzie Pyramid in Seattle? When an alarm is tripped there.. Azzie SA, Azzie EU gets alerted along with every other Azzie asset in Seattle!
Why?
Because Aztech doesn't care about the Stuffer Shack or the employees there. But they care very much about their North American Headquarters!
 

[Mechanized82]

That's pretty much exactly what IS done.  Military secrets aren't doing the military any good if they're locked away in a vault with no access to the outside world.

I'm not military so all of this is either based on theory or some personal exp but I assumed this is how they handle certain things.  I have a good friend who worked for a big IT company, I think siemens, and they had a contract with the military.  One of his jobs was go to a secure bunker, pass through a serious security check and access their servers for maintenance.  Their stuff was not online.

I'd logically presume that things that needed an out, like CIA criminal database that needs to be shared around the country, would have to be online and thus hackable.  But if the U.S. military has a research project for creating a deathstar why would you want that online?  What benefit does it serve other than faster communication world wide? The risks are huge to have it online and the benefits small,  I'd think rather than risk the security breech they would just bring all of the help rather than have the info connected to the outside.

We're not using "online" in the same way.  That friend of yours who went into the bunker to access servers? Those servers were assuredly "online".  I can't guess what specifically he was working on, but for example the military has its own "separate" internet that is partitioned off from the public internet.  However, they use the exact same technology, and in certain critical points, even the same infrastructure.  Therefore, despite being "offline" in a "you and I can't access it through the internet" sense, it absolutely IS accessible in a "can you hack it from outside the network? Absolutely" sense.

Attempts to use shades of grey is how hackers get in.  The only secure computer is a computer that's powered off.  If someone can get into the computer to use it for legitimate purposes, then so too can a hacker. Think of securing your secrets is like putting them in a safe.  The only guaranteed way to ensure hackers can't get in is to weld it shut and make sure NOONE can get in.  But that's only of value in very niche circumstances.

If you know this to be true then that is pretty interesting.  I would have never guessed they would leave any entry way into anything sensitive.

I thank everyone on the responses.  They have helped me grasp some of the concepts a little better.