Regarding a "casino's main systems".. Going back a few years I was involved with a gaming organisation. We were advised that certain activities legally had to

Regarding a "casino's main systems".. Going back a few years I was involved with a gaming organisation. We were advised that certain activities legally had to be air gapped (we are not in the US), and I raised an issue of how it is that servers could be accessed by VNC (single dictionary word password) over the Internet if that were the case. I was advised that the server was installed in a rack with 1RU of space between it and the router connecting it to the internet, and that lawyers had reviewed it and considered that to meet the legal definition. I strongly suspect you'll find core activities just as vulnerable.