I can speak from personal experience that the utilities themselves are working like mad on this. I can only speak from the power generation side of things, but the drive is to isolate all control systems from the outside. For example the projects that I worked on kept the CPUs and disk drives in a locked room away from the control room. We started advising our customers to do this when a control room operator tried to load a computer game onto the system. When I explained to the plant general manager what happened I thought his head would explode. Needless to say the plant was short one control room operator for a while.
To the best of my knowledge that isolation is now a FERC (Federal Energy Regulatory Commission) requirement. I am not sure how the Transmission and Distribution side is fighting the battle, but I suspect they are just as paranoid about this.
What scares everyone is an overlooked system no thought about. That’s why they are examining every system whether critical or not to make sure that will not happen.
Are we totally secure, absolutely not. However we are way ahead of where we were five years ago.
Believe me this is in the back over everyone’s mind as systems are upgraded.
Unfortunately, an attack on the physical elements we be much easier. For example the actual transmission lines, or transformers could be very disruptive and cause a cascading blackout.