Great response. Sometimes they don't even craft devices, even shoddy devices would be better than other options some take. Sometimes it's just a matter of some

Great response. Sometimes they don't even craft devices, even shoddy devices would be better than other options some take. Sometimes it's just a matter of someone in the muni saying 'hey, we can fix this, let's put this on a password protected wireless network'. Sometimes it's not even password protected. Sometimes it's not the muni, but the vendor, who decides for remote management and puts the device on the internet. I agree with the other poster who said they thought data diode was the way to go. Make it so the companies and munis can get data, but cannot send data to the devices unless they are physically on site. Of course, that means the site has to be secured - a lot of times security through obscurity is relied on by putting in remote locales, fake locales, etc. This also includes securing the device - it should detect tampering and default to a 'tampered state' if tampered, one that is encoded at manufacturing so it cannot be changed. While I'm on it, I would love to start seeing TPM 2 chip and Sel4 OS a mandated minimal requirement for all SCADA devices. The cost would go through the roof - strike that, the atmosphere - but it is so necessary.