Well, as far as I know "professionally run" (e.g. multi-site plants run by a big corporation with a dedicated network-security staff and so on...) industrial automation networks are using VPNs, isolation of special-purpose segments with dedicated gatways, VPNs and similar technology. This I've learned from what I could see from contemporary power-plant projects.

But "smaller" projects (for example when a few-people engineering firm builds a water-plant with one or two PLCs and tries to give the owner access to monitor it from the office) still just puts a port-forward to a basically unprotected device into the plastic DSL modem/router.

Why's that?

In my experience the guys running industrial automation were very always concerned about the reliability of their field-busses, redundancy of links, possibility of faults. But they only ever concerned themselves about the possibility of someone introducing faults deliberately and maliciously when we pointed it out explicitly. It was something that, in their world of professionally installed point-to-point-links, in armoured cable ducts on fenced industrial plants, did not exist.

And that mind-set is still very much alive in the heads of the designers/engineers but takes a lot of effort to adjust to threats as they exist these days. Without a IT/Plant security department enforcing the rules (to the annoyance of all involved parties...) convenience, cheap hardware, less labor and planning will win.

I have absolutely no special knowledge of the situation, and I share your puzzlement and frustration.

But my simple (though completely speculative) theory (and I fully expect it to be the correct one) is that security is simply not something which integrates well into our economy right now.

Our economy is based on maximizing profit and efficiency, like safety, security is extremely difficult to quantify and even harder to accurately value. Therefore companies and individuals looking to minimize their bottom line are finding it naturally difficult to justify sane implementations such as your suggestions.

The simple reality, in other words, is that our current economic system does not adequately value security until disaster happens. It would not be hard to do as you suggest, but consider this thought experiment: would you spend $150 more for plane tickets if they would reduce your chance of crashing by 0.05%?

This is a similar scenario to that which faces these infrastructure companies. Until the 0.05% contingency actually materializes, the economy (unless the risk is demonstrated as serious and imminent) rewards the -$150 option as being "the better option".

I agree with your assessment. There was a New Yorker article last week on an unrelated topic (Slow Ideas) that came to a similar conclusion about inherent inefficiencies in our market system:

http://www.newyorker.com/reporting/2013/07/29/130729fa_fact_...

The key quote is here:

"This has been the pattern of many important but stalled ideas. They attack problems that are big but, to most people, invisible; and making them work can be tedious, if not outright painful. The global destruction wrought by a warming climate, the health damage from our over-sugared modern diet, the economic and social disaster of our trillion dollars in unpaid student debt—these things worsen imperceptibly every day. Meanwhile, the carbolic-acid remedies to them, all requiring individual sacrifice of one kind or another, struggle to get anywhere."

The article continues in a health-care context to discuss the importance of doing-things-that-don't-scale efforts to educate and change behavior. I anticipate the connection here would be some utility-by-utility effort to subscribe to best practice. I worry the opposite will occur.

These places are owned by many private companies, who might not understand the threats they face, or there is a culture where it is not a priority, plus there is no standard between these many companies, each has rolled their own solutions. Some might not be connected to the internet, but others are, there is a total mismatch between them. So, government has started to step in, by creating cybersecurity standards for infrastructure [1]. This will hopefully create a standard for everyone to start locking down their infrastructure in a consistent and reproducible way. This also plays into the moves to reduce data centers across the government [2], so they can create a standard, and hopefully reduce their security exposure.

[1] http://www.bloomberg.com/news/2013-02-13/obama-orders-cybers...

[2] http://articles.washingtonpost.com/2013-07-28/business/40859...

And many are monopolies that have little incentive to prepare for black swans. They will just be bailed out or allowed to raise rates to clean up a catastrophe.

Tokyo Electric Power Company in Japan was allowed to borrow billions after their colossal failure at Fukushima. A failure that could have been avoided with better planning. But with no competition, what incentive was there?

Medium & large utilities frequently do run their own fiber and/or microwave links. These places also tend to have some level of infosec awareness.

Small municipal utilities (primarily water/wastewater treatment) frequently do very bad things* for convenience and because they don't know better or they take view that nobody would want to attack them. If a security audit was required along with the water quality testing they'd learn pretty quickly...

* Things like not separating control and office networks, open wifi that is "secure" because DHCP is disabled, plain open wifi on the control network, etc.

The attack was launched via an infected Word file. You can separate your internal network from the public Internet - which power companies do - but that only reduces your attack surface, it doesn't eliminate it. Attack vectors are still available.

And why do you need Word installed on your industrial control console??