According to the Wikipedia article [1], Stuxnet not only infected the Iranian infrastructure but apparently also a Russian nuclear plant. And so air gaps & co.

According to the Wikipedia article [1], Stuxnet not only infected the Iranian infrastructure but apparently also a Russian nuclear plant. And so air gaps & co. didn't help against a skilled, determined but still human-level attacker. But then I read the Wikipedia article more closely, and, for instance, it turns out that Stuxnet components were signed with stolen certificates so that Windows recognized them as legitimate. Which means that at best someone had not only write Stuxnet, but also get those certs. And even if it's easy in comparison, there had to be at least a remote hack involved, if not a physical one. And then there was the risk of those certs being revoked. Etc., etc. So, even if I'm more pessimistic than you, the lesson for me here is that if you start peeling the onion layers, it's all not so simple to pull off. [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet