The hardware running water/sewer systems, electrical grids, irrigation dams and the like are generally SCADA systems on their own air-gapped network. Generally they're required to be air-gapped by law if they're considered critical infrastructure. **HOWEVER** the organization that runs them is more frequently targeted through its back office systems, which can still be pretty disastrous . Imagine if your electrical utility's phone and/or email system is taken down and they have no way to dispatch service trucks or buy/sell power.

Because retail stores are cheap. They don't want to pay to hire someone competent to do it, much less pay them enough to maintain them in the position.

Service, maintenance and monitoring.

And how many people out there "have a clue" these days? Do you know anyone under 30 who has ever replaced parts in their computers, or repaired their own cars? We're becoming a society of hardware illiterates. If it doesn't have a GUI the majority of the people have no clue that it even **CAN** be accessed.

Service on the device. If a company charges $150/hr for a service tech would you rather they make changes remotely or charge you an additional two hours minimum for travel (for each site)?

You've never worked in retail, I take it. Stuff gets moved around all the time, what's in the cabinet next week may be bags of ice or frozen salmon.

Service is the big need, I've covered it a bit in https://it.slashdot.org/commen...

Service. Testing. Troubleshooting. Dispatching a service tech is very expensive, to the tune of $150/hr or more from the moment they leave the shop. If they unexpectedly need a part they then have to charge for going to get it. If they can access the system remotely and know they need Part #1234 and Filter #5678 before they leave the shop it's a huge saving for both the customer and the service company. If meat rather than milk is going to be stored in the unit the service company can make the change and test that it's working correctly. Plenty of other reasons, mostly due to the necessity to service them.

I worked in the Physical Security world for 17 years (key cards, cameras, alarms, that stuff). Default passwords are generally a necessity, since you need to be able to set the equipment up the first time. If the manufacturer doesn't require it to be changed after initial config that's an issue, but even if they do require it there's almost never any requirement that the installers **NOT** change it back to the default and that's what will be done more frequently than not. The reason is for ease of service, there's no guarantee that the guy who installed it today will be the same one who services it when it breaks or needs maintenance next year. Not that I'm saying that this is good practice, just that it's common.

Even more common in systems that allow secondary user accounts to be created (not all do, even with security equipment, and many building management systems don't) is to create one login to be used across all customers of the installation/service company. I could have logged in with God-like permissions in any installation in North America that was set up and/or serviced by the second-largest security company in the US, because we had their service account information. My company originally did that, until I instituted custom logins for all our customers and stored them in a Keepass database on the network. Our salescritters used that as a selling point, frequently after demonstrating how we could log into our competitions' installs.

Never updating the system software is more common than not, no one wants to take their core systems down for an upgrade unless there is critical new functionality or reliability being added, and there's always the risk of a catastrophic failure. In 2012 I updated the Lenel system at our local Coast Guard base from NT4.0 on SQL 2000, and then it was only because the hard drive on the server was spitting out errors.

Check your company's background systems (building management systems, security, elevators, power management, etc.) you may be shocked at what you find. It's terrible to find your security system is your company's biggest security hole.

Dog hit the Post button.

some sort of hero or defender of civilization. if you remove traffic accidents, caused mostly because they drive like assholes, they fall considerably lower on the list too.

Indeed, I've done several of those jobs and never insisted that society treat me as some sort of

The fun thing in this story was right at the end. They're going to allow the Flock license to expire, but unless they pay extra to remove them the cameras still stay and they're still collecting data 24x7.

Low paid profession? Average police salary is over $76,000/year, well above the US average.

Non-sense! There are plenty of very well designed software packages built using defensive programming practices that still have security flaws. To claim you have already lost when using those measures is to claim that only code with years of tireless review like NASA's near flawless software is good enough.

Just because we lacked the resources to find software flaws didn't mean that there were never massive vulnerabilities just waiting to be discovered, it just means it required dedication to find them. The lack of investment in security is about to be laid bare for all to see. Those that are actually interested in making secure software now have the opportunity to get even closer to that goal. Everyone that has been doing (and continues to do) the bare minimum is about to get a lesson in the importance of investing in real security.

Good security is expensive but having bad security is about to cost a whole lot more.

Reagan and Stockman made much of the 'multiplier effect' to justify their bloated military spending, but actually NASA has the highest multiplier effect of anything the US gov't does, something like 7 to 1. This would indicate NASA's R&D generates enough in taxes that they actually **MAKE MONEY** off the organization. Gerard O'Neil's university class did a study in the late '70s and found, to everyone's astonishment, that just the taxes of the advances in telecommunications generated by the space program would have paid for the entire Apollo program by the mid-'80s.