Routers get shipped en mass pre-configured with standard corporate (known by many, easily cracked) passwords. Rarely are they changed.

SCADA isn't designed for ANY network attachment. Any security on it is an afterthought, and rarely works. The vast majority of our electrical infrastructure, chemical plants, manufacturing plants, etc, are run from off the shelf SCADA components which are not intended to be connected to the back-office network.

And they always connect it so the engineers can work remotely and the back-office people can get ongoing automated reports. Which in turn allows malware to attack them, and the malware is SIMPLE.

You work in the office. You hear all the good things that the managers are reporting. I work in the tranches. I see what they are not.

Your daily lookers are too busy fighting fires, and they don't have access to the proprietary underlying SCADA code to fix it anyway. They try to sandbox it via routers and firewalls, but it is piecemeal, and doesn't work.

But you know the vast open sea of SCADA installed base, just waiting to be hacked, isn't going away.