NHPR did a long piece this morning. They talked about regulation, deregulation, and who was in favor of more regulation. Not once did they talk about what to do about vulnerabilities.
What to do is straight forward. Do not use the public internet to monitor or control generators, circuit breakers or other equipment. And do not use Windows computers for any of the same purposes.
Back when we were selling data acquisition equipment to the electric generating industry, I saw a remote controled generator. A big gas turbine unit was humming happily away. They had an ordinary desktop computer running a remote control program. The computer monitor showed an image of the turbine, a little arrow showed it was turning, instrument readings for oil temp, oil pressure, exhaust gas temp, rpm, amps, volts, engine pressure ratio, and more. It was about 10:30 AM, and the power station man sat down at the remote control and ordered the generator to shut down. It was a peaking plant, only run for the morning and evening power peaks, and 10:30 was the end of the morning peak period. A few key clicks, and the big turbine obediently shut down, we could see the RPM and EGT winding down on the display.
The turbine was l0cated a couple of miles away. The controller sent little messages (Start Up, Shut Down) over the internet. A computer at the remote generator listened to the internet and acted upon orders coming in from the net.
All an enemy hacker needs do, is learn the addresses and the codes used and send his own commands to the turbine. If the computer at the turbine is a Windows machine he can load his own code into it and really go to town. First step of such an invasive program is to reject all messages from it's proper owner, and only accept commands from the hacker.
The fix is simple. Connect the remote computer to the control center with a pair of your own wires, hung on your own poles, by your own people. Then the command link is secure against any sort of Internet attack. To gain control the hacker has to climb a pole and splice in a tap. Hackers are swivel chair people, they don't climb poles.
As for Windows, we all know how vulnerable Windows is to anything. The famous Stuxnet program that did great damage to the Iranian nuclear program spread via Windows "autorun" feature. Windows has so many security holes that it's beyond fixing. Computers running Linux, Unix, MAC OS, anything, can be made secure. Windows is so bad that it is beyond hope.