ARGH...
Systems of these kind should NOT be anywhere near the same network as the Internet. The same goes for Power Plant and Industrial systems (all of these systems are collectively referred to as SCADA -- Supervisory Control And Data Acquisition)
This is a common rant among the infosec community about SCADA systems being exposed to the internet that I will forgo making, suffice to say, SCADA systems are *critical* systems and require the maximum security possible, in order to establish this, such systems must not be connected to a commonly accessible network and/or system.
But as for the LHC control systems, from my point of view, there is no real reason why such a system even needs to be internet connected. The main situation here is that there should be relaying the data via a separate network (satellite?) to scientists in other countries (if that's the reason why they want outside connectivity) for sensor data, however, they're being extremely cheap by just using the internet instead.