Well, as far as I know "professionally run" (e.g. multi-site plants run by a big corporation with a dedicated network-security staff and so on...) industrial au

Well, as far as I know "professionally run" (e.g. multi-site plants run by a big corporation with a dedicated network-security staff and so on...) industrial automation networks are using VPNs, isolation of special-purpose segments with dedicated gatways, VPNs and similar technology. This I've learned from what I could see from contemporary power-plant projects. But "smaller" projects (for example when a few-people engineering firm builds a water-plant with one or two PLCs and tries to give the owner access to monitor it from the office) still just puts a port-forward to a basically unprotected device into the plastic DSL modem/router. Why's that? In my experience the guys running industrial automation were very always concerned about the reliability of their field-busses, redundancy of links, possibility of faults. But they only ever concerned themselves about the possibility of someone introducing faults deliberately and maliciously when we pointed it out explicitly. It was something that, in their world of professionally installed point-to-point-links, in armoured cable ducts on fenced industrial plants, did not exist. And that mind-set is still very much alive in the heads of the designers/engineers but takes a lot of effort to adjust to threats as they exist these days. Without a IT/Plant security department enforcing the rules (to the annoyance of all involved parties...) convenience, cheap hardware, less labor and planning will win.