Note: the latest CNN report now says the engineer slammed on the brake just before the wreck. The engineer will not answer questions of police without an attorney. The Philadelphia mayor condemned the engineer, and the NTSB says the mayor is out of line. It now appears that an automatic speed control system in place between Washington and the Delaware line and in parts of New Jersey has not been implemented in the Pennsylvania portion -- so there was no control system to "hack" in this case. Once it is installed, as it must be, security for it will be critical.
Also, along the lines of topological isolation, I see that Newsweek (May 15). has an article on "Cyberpower" by Owen Matthews where the topic of "air gaps" to reach isolated utility networks is mentioned. I'll get into this on another posting soon.
Update: May 15
The Philadelphia Inquirer has a running update of the factual investigation here. An Atlanta TV station article here. LA times has more here. I haven't yet found any of Brandon's original blog postings.
Later update: It appears possible or even likely that the Amtrak train was struck by a bullet or missile, as was another SEPTA train (CNN). The engineer might have been struck, which could cause incapacitation that he did not remember (although medical examination of injuries should have found that by now). FBI is investigating. This sounds ominous, like "lone wolf" activity feared in recent FBI, Homeland Security, and NSA statements, to be honest. But facts are not in all in. Philadelphia Inquirer seems to be the most detailed and up-to-date.
May 16: The New York Times discusses the problem of objects being thrown at trains in the NE corridor, here.
May 22: NTSB says there's no evidence of a bullet, and some of the other stories about other trains being struck and conversations with the engineer have been discounted. The best theory, although speculative, may be that a thrown object struck the locomotive and distracted the engineer, and he made a mistake at the control, and thought he was north of the curve. That's not certain. But the lack of an automated speed control system on the northbound track was fatal. It has since been installed.