The Cellular Router Is the Front Door

Ask how a small utility would get into its control system from outside and the answer is usually a description of the plant firewall and the virtual private network. Ask how an attacker would, and the honest answer is the cellular router at the lift station on the highway, installed three years ago by a contractor in an afternoon, with a public address from the carrier and the password printed on its label. It is not a hypothetical. It is the pattern in most of the public reports of intrusions at small water systems, and it is the easiest thing in the whole security program to fix.

How it gets installed

A lift station needs telemetry. Radio has no path, or the utility has no radio system, so a cellular router goes in: a small box with a data plan, an Ethernet port to the controller, and an antenna on the mast. The contractor sets it up so the SCADA server can poll the station, which means the router needs to be reachable from the plant, which means it gets a public address from the carrier and a port forwarded to the controller. Remote management stays enabled because the contractor might need it. The password stays default because the router is at a lift station behind a locked door. Everything works, and the utility has a device on the public internet with a control protocol port open behind it.

What the outside sees

None of that requires skill. It requires a search and a password from a manual. The reports of small water systems intruded through exactly this path involve attackers who changed a setpoint on a screen they found, not attackers who broke encryption.

Closing the door

1. 1

   Find them all

   An inventory of every cellular router, modem, and gateway the utility owns, with its address, its carrier, its firmware, and who installed it. The one nobody remembers is the one that is open.

2. 2

   Take them off the public internet

   A private cellular network from the carrier, in which the routers get private addresses reachable only from the plant through a tunnel the carrier terminates; or a firewall function on each router that drops every inbound connection except a virtual private network from the plant. Either way, nothing on the internet can reach the router or the controller directly.

3. 3

   Change every password

   The admin password on every router to a unique strong one, recorded in the credential vault, and the default accounts removed where the router allows.

4. 4

   Disable management on the outside

   The web and command interfaces reachable only from the tunnel or the site side. Remote management from the carrier network off.

5. 5

   Put the controller behind something

   The router connects to a firewalled port, the controller second port, or a small industrial firewall, with rules that permit only the SCADA polling from the plant. The drives and the touchscreen never see the router.

6. 6

   Patch them

   The router firmware in the same patch program as the servers, with the vendor advisories subscribed to.

7. 7

   Log and watch

   The router logs to the plant where possible; the SCADA communication statistics watched for a site that starts talking to something else.

Keeping the convenience

The reason the router was set up open was convenience: the contractor could reach it, the plant could poll it, and nobody had to configure a tunnel. All of that survives the fix. A private cellular network or a router-to-plant tunnel is configured once and then works exactly as the open setup did, from the plant side. The contractor reaches the router through the utility remote access path, with an account enabled for the session, which is also how they should reach everything else. The polling is unchanged. What changes is that the internet is no longer part of the control network.

The same door elsewhere

Cellular routers are the common case, but the pattern repeats: a remote desktop tool installed on the SCADA server so the integrator can help, a port forward on the plant router for a vendor, a modem on a controller from the last decade, a wireless bridge with the default key. Each is a convenience for someone, each is a door, and the inventory that finds the routers finds these too. The rule that closes all of them is one sentence in the security policy: every path into the control system goes through the remote access design, and any path that does not is removed.