It's scary just how much SCADA software (electricity, water, fuel, prisons, etc) is absolutely ridden with vulnerabilities, protected ONLY by that air gap. Typi

It's scary just how much SCADA software (electricity, water, fuel, prisons, etc) is absolutely ridden with vulnerabilities, protected ONLY by that air gap. Typically this internal network will be accessed by terminals sitting immediately adjacent to terminals on the more general network (so a user can quickly switch between them over the air gap). They'd both need to be infected it's true, but that is quite achievable with USB social engineering or if an attacker can gain physical access to any of the terminals on the network. If that were the case then an attacker could get any information out that they wanted (flight data, prison routines, defence asset refueling movements, even just information enumeration and vulnerabilities in the network). The terminal probably wouldn't have a microphone it's true (typically very old hardware that everyone is too scared to upgrade), but if it did it would also give remote trigger access to abuse that infrastructure. It's actually good information for security architects. If you can't get approval to start using software updates, make sure your damn microphones are turned off.