The value of a good defence

Let us consider a scenario: one night, an executive responsible for operations for a remote downstream oil and gas refinery gets a call from one of their subordinates saying things started acting up ever since they plugged in a USB they brought from home. Multiple processes have become unstable and commands sent to equipment are not executed as requested. Panicking, they say there has been a cyber attack on the supervisory control and data acquisition (SCADA) system. Valves, pumps, and compressors connected to the system are going haywire, and the organisation's legacy systems were not equipped to prevent whatever new malware snuck into the system. Production comes to a halt for two days.