Using Ethernet inside the plant isn't the problem. It's where that Ethernet connects to the world outside of your plant. The most secure solution is to not let that ever happen. If you have to have a connection to the web, then you need to have a firewall.

As far as the radio communications: Yes the INET-II has AES-128 encryption http://en.wikipedia.org/wiki/Advanced_Encryption_Standard , which is good. But then DES was considered secure until somebody found a way around that protocol. It's a never ending game.

If you really want to get serious about this at a extremely professional level, Sandia National Laboratories in USA (Albuquerque, USA) has a group that has a plan to prevent hacking into plants by terrorists. This is a US government contractor so I'm not sure how they would go about helping, (maybe you need to promise you are not a terrorist and show them your library card for ID) ..... but the idea is that hackers can break into a power plant or some other plant (refinery, nuclear, or ???) and start opening and closing valves and making bad things happen that disrupt entire economies. So, they have a plan to prevent that and can even come show you how they can hack into your system before your eyes to show you how vulnerable you are.

I think my ex-wife hired these guys as my bank account seems to be kaput and my toilet is making ice cubes now also. I wouldn't go for the ice tea at my house until I get all this fixed.