The main issue comes from the long life cycle of equipment and companies not wanting to change to new securer methods due to fear of costs implementing it.
Which is to say: These networks should be closed-loop, and air gapped from the internet. The best security is simply not letting an attacker connect to the equipment at all.
Same way cars are meant to work. One network for the vehicle control systems, another network for the fun stuff (in car entertainment, OnStar, etc). With well defined interconnections between them (that assumes the "fun stuff" side can misbehave).
If there is any interconnection between the critical infrastructure network and the internet, then it needs to be very well regulated, down to the packet lengths.
How many times do we see new web frameworks on HN without even a mention of security?
http://blog.erratasec.com/2015/09/whats-that-drama.html#.VhP...
We need to teach our children to understand that only a fool would put critical systems on the public internet. Only a fool would forget to implement account lockout rules or forget login rate limiting (edit) --where approprate--. Only a fool would create software with built in default usernames and passwords. Hello world, the "admin" username does not have to be admin or administrator. Computer security today is a joke. Almost a total illusion.
We need to pay less attention to Kim Kardashashen and more attention to HD Moore.
http://jklossner.com/computerworld/images/security26.gif