Water and wastewater utilities deliver one of the most essential services there is, and they run on operational technology: the SCADA systems, controllers and remote sites that manage treatment and distribution. A disruption can affect public health, which makes the sector a serious target.
At the same time, many water utilities operate with limited budgets, small teams and equipment that has been in place for decades. Their security challenge is less about buying advanced tools and more about reducing the exposure of systems that were never designed to be reachable from the internet.
01Key takeaways
- 01
Water and wastewater systems are critical infrastructure whose disruption can affect public health and safety.
- 02
Treatment and distribution rely on SCADA, PLCs and remote sites, often with legacy, insecure-by-design equipment.
- 03
Remote and internet-exposed access is a recurring weakness, especially at unmanned sites.
- 04
Many utilities lack dedicated security resources, so simple, durable controls matter most.
- 05
Segmentation and reduced reachability protect control systems without requiring large teams or budgets.
02Why water systems are targeted
Water utilities sit at the intersection of high consequence and uneven defenses. Interfering with treatment or distribution can threaten public health, which gives attackers, from opportunists to more capable actors, a reason to probe these systems.
Several documented incidents and warnings have highlighted attempts to reach water-sector controls, often through exposed remote access rather than sophisticated exploits. The threat is real, and the entry points are frequently mundane.
Attackers do not need a brilliant exploit to reach a water system. They often just need an exposed remote login that should not have been reachable.
03SCADA in treatment and distribution
Water operations depend on SCADA systems to monitor and control pumps, valves, chemical dosing, filtration and storage across a wide area. PLCs and remote terminal units carry out the control, while operators supervise through HMIs.
Much of this equipment is long-lived and insecure by design, speaking protocols with no authentication. As with other OT, that means network reachability often equals control: a system that can reach a controller can frequently command it.
04Remote sites and internet exposure
Water systems are geographically distributed, with pump stations, tanks and remote facilities spread across a service area. Managing these sites remotely is a practical necessity, which is why remote access is everywhere in the sector.
- Remote access services exposed to the internet for convenience.
- Unmanned sites with little physical security and standing connectivity.
- Cellular and radio links connecting remote assets back to the control center.
- Vendor and integrator access for maintaining distributed equipment.
Each remote connection is a potential entry point, and the more of them that stand permanently open, the larger the attack surface across the whole utility.
05The small-utility resource gap
Many water utilities are small, serving modest populations with a handful of staff who handle everything from operations to maintenance to whatever security exists. Dedicated cybersecurity expertise is often simply not available.
This reality shapes what good security looks like in the sector. Controls that require constant tuning, deep expertise or large budgets are unlikely to be sustained. Simple, durable measures that reduce risk without ongoing effort are far more valuable than sophisticated tools that go unmaintained.
06Segmentation and reachability reduction
The most dependable protection for water systems is to reduce how reachable the control systems are. Segmentation separates control networks from business systems and the internet, and reachability reduction removes standing connections that are not needed.
Because much water equipment cannot be hardened or patched easily, keeping it unreachable when it does not need to be reached is especially powerful. An AIRGAPNET controlled connectivity pattern can keep remote sites and sensitive control segments disconnected by default and reachable only for approved windows, which suits intermittently-managed assets and requires little ongoing effort.
07Remote access and monitoring without inbound paths
Remote management and visibility are essential in a distributed water system, but they should not depend on standing inbound access to control systems.
- Replace always-on remote access with controlled, time-bound sessions opened only when needed.
- Forward telemetry and alarms outward to a monitoring point rather than letting tools reach in.
- Remove direct internet exposure of remote-site controllers and interfaces.
- Tie any remote access to an approval so every connection has a reason and a record.
08Closing thought
Water utilities protect something irreplaceable with resources that are often stretched thin. That combination means their security cannot rely on large teams or complex tools; it has to rely on getting the fundamentals right.
The fundamental that matters most is reachability. Remove unnecessary internet exposure, segment the control systems, and keep remote sites disconnected by default. For a sector this critical and this lean, reducing exposure is the highest-value security investment available.
FAQFrequently asked questions
Why are water utilities a cybersecurity target?
Disrupting water treatment or distribution can threaten public health, giving attackers a motive to probe these systems. Many documented attempts have used exposed remote access rather than sophisticated exploits, so the entry points are often mundane.
What technology runs water treatment and distribution?
Water operations rely on SCADA systems, PLCs and remote terminal units to monitor and control pumps, valves, chemical dosing, filtration and storage across a wide area, much of it long-lived and insecure-by-design equipment.
Why is remote access such a risk for water utilities?
Water systems are geographically distributed, so remote access to pump stations, tanks and remote sites is common. Remote services exposed to the internet, unmanned sites and standing connectivity each create entry points that enlarge the attack surface.
How can small water utilities improve security with few resources?
By focusing on simple, durable measures rather than complex tools. Segmenting control networks, removing internet exposure, and keeping remote sites disconnected by default reduce risk substantially without requiring large teams or constant tuning.
How does reducing reachability protect water control systems?
Much water equipment cannot be hardened or patched easily, so keeping it unreachable when it does not need to be reached removes the main opportunity to attack it. Disconnect-by-default access suits intermittently-managed remote sites with little ongoing effort.
SRCSources of record
Critical service, lean team
Protect water systems by shrinking what can be reached.
Remove internet exposure, segment control networks, and keep remote sites disconnected by default, opening them only for approved windows, no large security team required.