Controls isolation is becoming less viable as a cybersecurity strategy, in part because there are other mechanisms used by infrastructure managers and adversaries alike to perform the necessary task of moving data into and out of islanded control system networks. These include the use of USB sticks and removable media to bring patches and updates into the control system environment, and to move business data regarding production out to an otherwise unreachable business network. These mechanisms can carry viruses and malware without the knowledge of plant maintenance personnel.
Unfortunately, one of the largest threats comes from inside the power plant, like a disgruntled employee or someone unintentionally connecting a phone or USB port with a virus.
Beyond the risks associated with removable media, there are other potential issues with unexpected connectivity enabled by an adversary, malicious insider, or even an insider acting in good faith but incautiously. Even if wireless networks are forbidden, one of these kinds of actors can easily add wireless access points to the network by plugging it into an unused and unblocked network port. Such wireless access may even be accessible from outside the plant perimeter.