An electric power utility allowed a contracted vendor to establish a VPN connection. Neither took adequate steps to ensure proper access protection thinking that the other had. The connection was originally intended to have miminal exposure to the internet when in fact it had significant exposure. A threat agent exploited this vunerability allowing penetration of the SCADA system. (#2)

No responses yet