The age old question: Why are utility controls connected to public networks?
A. As an inexpensive way to communicate telemetry.
Back in the day, there were expensive EDI systems, but when internet access began to proliferate, a lot of utility information switched to the internet as a cheap way to move the data.
I will defer to anyone with current expertise; mine is from the early 1990’s in the Electric, Gas, and Water Utility industry, where I conducted research while working my way through law school. But my sense of it from back then was that it was the embedded systems, typically in electric transmission networks, that were almost completely unsecure.
These are long-lived assets; they get installed, and they may spend 20-30 years out there before they get replaced. If they have a flaw or a vulnerability when they are installed, it’s there until someone climbs the pole and replaces the hardware, out in the middle of nowhere. In a transmission system, it’s a huge logistical and financial problem.