> There's no such thing as a casual QoL update in SCADA.

> So, they don’t think about the consequences of connecting it to the Internet for remote access. It’s just a feature they want.

This is the disconnect that's so confusing.

It’s different sides of the house.

Operators understand how important having them connect to PLCs and various bits because failure can mean you can take out parts of whatever it’s controlling, the power grid, oil pipelines, etc. So, you need to be very aware of what you are doing when you do these upgrades. There’s a lot of process to ensure you don’t break things.

But, you tell them about network security and or having to have Modbus messages wrapped in TLS and some of them will tell you to shut up and get out of their way. These systems have literally been just ported from the equivalent of a PDP/11 to Linux. So, not the most robust things when you come from a network security perspective. They really are 1970s systems and it’s really annoying, but I don’t think there’s any money in really doing anything about it and a lot of people make good money consulting around for these things.

I don't work with many of the smaller players, but you're right. They're far more likely to not have their own teams building and managing these systems, so they're susceptible to the Lyle Lanleys of the industry who come in and show them how they can control everything from their phone. They get sold off-the-shelf products and told that they're plug-and-play, but they're usually not.