So long as the attack is determined to be confined to the IT systems and not impacting the SCADA systems, they should be able to restart. However: The control

So long as the attack is determined to be confined to the IT systems and not impacting the SCADA systems, they should be able to restart. However: The control systems were considered safe for years because they were not connected to the internet, but hackers have found ways to penetrate them through unsecured remote access and networked systems. Many companies have older, vulnerable Windows platforms still embedded within energy facilities, and efforts to implement cybersecurity measures rarely move beyond the pilot-program stage, Mr. Sevier said. Because many industrial facilities run around the clock, it isn’t easy to take down plants to patch outdated systems, keeping older machines in place and providing “the perfect path for cyber pathogens” once they are connected to company networks, said Grant Geyer, chief product officer of Claroty Ltd., a cybersecurity company that specializes in critical infrastructure environments. Matters can be complicated by a cultural divide between the engineers who design operational control systems that run facilities and the IT teams responsible for a company’s security, according to consultants who work with such companies. The two groups rarely understand each other’s priorities, the consultants said, and often consider securing operational devices to be in the purview of the other. Also, many people running control rooms at industrial facilities came to their positions with little experience in information technology, said Michael Hamilton, founder and chief information security officer at Critical Insight Inc. Their mantra is “don’t touch anything if it works. But in today’s world, this stuff has to be constantly managed,” Mr. Hamilton said.