So to sweep all of the water systems in the country in advance isn’t doable in any time frame?
IR isn’t an acronym I’m familiar with.
If budget weren’t an issue, how many clones of your teams would it take to do that for all the water systems in the US in five years?
What are the odds that the average muncipality understands the security implications of just existing on the internet these days?
“No, their platform doesn’t support any real secure protocols and won’t route over a VPN, it needs to be on the same subnet as the devices. […]”
They won’t know that much. They don’t understand that their job isn’t running a water department, it’s running the computers that maintain the water department and that includes security. For someone familiar with computer security it’s easy to recognize negligence, but until the law sees it as criminal negligence nothing’s going to change.
Small town municipal water departments aren’t going to be able to afford the guy holding the shield against international state actors.
Debian.
This is the future so Virtual Machines and containers are where most of the stuff will end up anyway. If you need a specific distro it’s minutes away with a VM or container.
If you think there’s a chance you might want some Redhat cert for a job at some point it might be the time to jump to Rocky, and I’ve never used Proxmox so I can’t comment except to say that if I come into two fairly large computers for self hosting, the first one will get Rocky so I can get much more familiar with it, and the second will get Proxmox.
It’s all systemd anyway.
And depending on the details of your employment, if you code for fun, on your own time, at home, using your own equipment, the company still owns it.