What are the lessons of Stuxnet  Recently, I have been getting
requests for interviews on Stuxnet and “son of Stuxnet”. I
believe Stuxnet has provided too much focus on PLCs and Siemens.
 The real ICS issues are: - It is possible to use cyber as a
weapon to destroy equipment or kill people. Cyber attacks are
more than just creating a denial-of-service or shutting down a
network. - It is not necessary to be a nation-state to hack
control system field devises. Stuxnet was complex because it was
a targeted surgical attack against a specific process and was
not meant to be found. The Maroochy wastewater hack in 2000
targeted field devices (not Siemens and not nation-state) and
was not readily identifiable as cyber. DePaul University IT
students with no control system background demonstrated they
could compromise a Rockwell controller network.  - Most, if not
all, ICS vendors have cyber vulnerabilities. ICS vendors other
than just Siemens use hard-coded default passwords that cannot
be changed.  Additionally, ther