As Ethernet became the dominant technology within the
higher levels of automation systems and the expected number
of external connections to industrial networks grew, the need
for security was recognised. At first, the main threats were seen
as being incidental to the technology in use, with most security
considerations aimed at preventing accidental exposure of the
industrial network to conventional threats. Possible intruders
to the network were viewed mainly as a nuisance rather than
as serious opponents, with talk of ‘teenage hackers’ [47]
and ‘mischievous adversaries’ [48]. The majority of incidents
caused by security failures were not directly targeted at the
affected systems - for example the loss of servers and HMI
computers due to the spread of malicious software from
corporate networks, or the failure of communications paths
to RTUs due to third-party channels becoming compromised
by a conventional virus.