The article mentions that a huge number of water treatment facilities are controlled by publicly-accessible web portals. Maybe the goal isn't to make every sin

The article mentions that a huge number of water treatment facilities are controlled by publicly-accessible web portals. Maybe the goal isn't to make every single facility 100% secure to all threats, but it's totally defeatist to say that we couldn't somewhat increase the actual security of many systems. VPNs alone would provide a great first line of defense, and even for a government-run utility, the barrier to installation is very low there. I have a fair level of skepticism around security theatre, too, but I think it's unfairly cynical to suggest that we don't have a goal of making ourselves more secure.