> Serious cyberattacks on industrial equipment aren’t common and take significant knowledge to prepare, according to security experts. Nonsense. All it takes

> Serious cyberattacks on industrial equipment aren’t common and take significant knowledge to prepare, according to security experts. Nonsense. All it takes is "caring enough to put in a bit of effort to figure out how to do it." The reason we haven't seen them, historically (and IMO...) is that nobody in the "evil hacker space" has generally been willing to attack actual physical targets directly. Over the past decade or so, we've seen a shift from "Only large, well funded actors attack physical infrastructure" (Stuxnet) to "More and more attacks on things increasingly close to physical infrastructure" (various pipeline attacks, the assorted industrial control system malware toolkits, etc). It's only a matter of time until the actual physical stuff is attacked, and this may or may not qualify - it sounds like the administrative side was attacked, but (perhaps?) not the actual turbines. Yet. The reality of control systems is just like that of anything else "digital" and "microchip" and "connected to a network" - they're not secure against a wide range of attackers, and the only saving grace is that most of them haven't been targeted by a sufficiently motivated adversary. We, as a general software ecosystem across a range of disciplines, add complexity faster (in hardware and software) faster than we understand and fix bugs. Shipping new things gets people promoted, "fixing weird old bugs in some poorly understood subsystem" doesn't - even if that archaic subsystem is useful to display (poorly encoded and often wrong) Xerox scans. See one of Apple's recent 0days... If you want a "secure" system for industrial control, it can't be network connected anymore. Yes, it's convenient, and the tradeoff is that someone can and will hack it, some day. Does it matter? Up to you and your company. But "air gaps" don't work, "Well, we'll use antivirus..." doesn't seem to matter, and "network connected computers" just suck at anything involving security.