SCADA system vulnerabilities

This is generally true. The context varies somwhat from 1 system to the other, and (even more)
depending on the type of remote interaction:

- Data acqusition remote units (i.e acquiring sensor data locally and transmitting it to the
scada system): I have yet to see the internet used for that purpose. Not even the corporate
network was deemed acceptable by the customers I dealt with. The 2 nain reasons: availability
(corpae IT people don't mind 1/4 hour downtime on portions of the corprate network) and real
time performance. All customer pay us a lot of money to install dedicated network (this is
often the most expensive portion of a scada system).

- Remote user terminal in the field: also use a dedicated netwok, often with firewalls due to
the access control issue (nobody in the terminal area).

- Interface with corporate systems: this the growing trend, including customer information on
the web. This usually involve multiple layers of firewalls & dmz.

I sometime wish our customers contact specialized network security companies (which is a
problem on is own: how to identify the really competent ones?).